@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/config.js

@@ -33,14 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidSessionPathError = void 0;
 exports.loadConfig = loadConfig;
 exports.resetConfigCache = resetConfigCache;
+exports.cacheRuntimeConfigForTests = cacheRuntimeConfigForTests;
+exports.cacheMachineRuntimeConfigForTests = cacheMachineRuntimeConfigForTests;
 exports.patchRuntimeConfig = patchRuntimeConfig;
 exports.getAzureConfig = getAzureConfig;
 exports.getMinimaxConfig = getMinimaxConfig;
 exports.getAnthropicConfig = getAnthropicConfig;
 exports.getOpenAICodexConfig = getOpenAICodexConfig;
 exports.getGithubCopilotConfig = getGithubCopilotConfig;
+exports.getOpenAICompatibleConfig = getOpenAICompatibleConfig;
 exports.getTeamsConfig = getTeamsConfig;
 exports.getTeamsSecondaryConfig = getTeamsSecondaryConfig;
 exports.getContextConfig = getContextConfig;
@@ -50,47 +54,23 @@ exports.getTeamsChannelConfig = getTeamsChannelConfig;
 exports.getBlueBubblesConfig = getBlueBubblesConfig;
 exports.getBlueBubblesChannelConfig = getBlueBubblesChannelConfig;
 exports.getIntegrationsConfig = getIntegrationsConfig;
+exports.getSyncConfig = getSyncConfig;
 exports.getOpenAIEmbeddingsApiKey = getOpenAIEmbeddingsApiKey;
 exports.getLogsDir = getLogsDir;
 exports.sanitizeKey = sanitizeKey;
+exports.canonicalizeTelegramSessionKey = canonicalizeTelegramSessionKey;
 exports.slugify = slugify;
+exports.isValidSessionCoordinate = isValidSessionCoordinate;
 exports.resolveSessionPath = resolveSessionPath;
 exports.sessionPath = sessionPath;
 exports.logPath = logPath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const identity_1 = require("./identity");
+const provider_credentials_1 = require("./provider-credentials");
+const runtime_credentials_1 = require("./runtime-credentials");
 const runtime_1 = require("../nerves/runtime");
-const DEFAULT_SECRETS_TEMPLATE = {
-    providers: {
-        // Keep provider field ordering consistent: model first, then auth credentials,
-        // then provider-specific transport fields.
-        azure: {
-            modelName: "",
-            apiKey: "",
-            endpoint: "",
-            deployment: "",
-            apiVersion: "2025-04-01-preview",
-            managedIdentityClientId: "",
-        },
-        minimax: {
-            model: "",
-            apiKey: "",
-        },
-        anthropic: {
-            model: "claude-opus-4-6",
-            setupToken: "",
-        },
-        "openai-codex": {
-            model: "gpt-5.4",
-            oauthAccessToken: "",
-        },
-        "github-copilot": {
-            model: "claude-sonnet-4.6",
-            githubToken: "",
-            baseUrl: "",
-        },
-    },
+const DEFAULT_LOCAL_RUNTIME_CONFIG = {
     teams: {
         clientId: "",
         clientSecret: "",
@@ -116,41 +96,41 @@ const DEFAULT_SECRETS_TEMPLATE = {
         serverUrl: "",
         password: "",
         accountId: "default",
+        ownHandles: [],
     },
     bluebubblesChannel: {
         port: 18790,
         webhookPath: "/bluebubbles-webhook",
         requestTimeoutMs: 30000,
     },
+    vault: {
+        masterPassword: "",
+    },
     integrations: {
         perplexityApiKey: "",
         openaiEmbeddingsApiKey: "",
     },
+    features: {
+        workbenchCoding: false,
+    },
 };
 function defaultRuntimeConfig() {
     return {
-        providers: {
-            azure: { ...DEFAULT_SECRETS_TEMPLATE.providers.azure },
-            minimax: { ...DEFAULT_SECRETS_TEMPLATE.providers.minimax },
-            anthropic: { ...DEFAULT_SECRETS_TEMPLATE.providers.anthropic },
-            "openai-codex": { ...DEFAULT_SECRETS_TEMPLATE.providers["openai-codex"] },
-            "github-copilot": { ...DEFAULT_SECRETS_TEMPLATE.providers["github-copilot"] },
-        },
-        teams: { ...DEFAULT_SECRETS_TEMPLATE.teams },
-        teamsSecondary: { ...DEFAULT_SECRETS_TEMPLATE.teamsSecondary },
-        oauth: { ...DEFAULT_SECRETS_TEMPLATE.oauth },
+        teams: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teams },
+        teamsSecondary: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsSecondary },
+        oauth: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.oauth },
         context: { ...identity_1.DEFAULT_AGENT_CONTEXT },
-        teamsChannel: { ...DEFAULT_SECRETS_TEMPLATE.teamsChannel },
-        bluebubbles: { ...DEFAULT_SECRETS_TEMPLATE.bluebubbles },
-        bluebubblesChannel: { ...DEFAULT_SECRETS_TEMPLATE.bluebubblesChannel },
-        integrations: { ...DEFAULT_SECRETS_TEMPLATE.integrations },
+        teamsChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.teamsChannel },
+        bluebubbles: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubbles },
+        bluebubblesChannel: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.bluebubblesChannel },
+        vault: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.vault },
+        integrations: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.integrations },
+        features: { ...DEFAULT_LOCAL_RUNTIME_CONFIG.features },
     };
 }
 let _runtimeConfigOverride = null;
 let _testContextOverride = null;
-function resolveConfigPath() {
-    return (0, identity_1.getAgentSecretsPath)();
-}
+let _providerConfigOverride = null;
 function deepMerge(defaults, partial) {
     const result = { ...defaults };
     for (const key of Object.keys(partial)) {
@@ -167,79 +147,31 @@ function deepMerge(defaults, partial) {
     }
     return result;
 }
+function localRuntimeFields(config) {
+    const { providers: _providers, context: _context, ...localFields } = config;
+    return localFields;
+}
 function loadConfig() {
-    const configPath = resolveConfigPath();
-    // Auto-create config directory if it doesn't exist
-    const configDir = path.dirname(configPath);
-    fs.mkdirSync(configDir, { recursive: true });
-    let fileData = {};
-    try {
-        const raw = fs.readFileSync(configPath, "utf-8");
-        fileData = JSON.parse(raw);
-    }
-    catch (error) {
-        const errorCode = error &&
-            typeof error === "object" &&
-            "code" in error &&
-            typeof error.code === "string"
-            ? error.code
-            : undefined;
-        if (errorCode === "ENOENT") {
-            try {
-                fs.writeFileSync(configPath, JSON.stringify(DEFAULT_SECRETS_TEMPLATE, null, 2) + "\n", "utf-8");
-            }
-            catch (writeError) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    event: "config_identity.error",
-                    component: "config/identity",
-                    message: "failed writing default secrets config",
-                    meta: {
-                        phase: "loadConfig",
-                        path: configPath,
-                        reason: writeError instanceof Error ? writeError.message : String(writeError),
-                    },
-                });
-            }
-        }
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "config read failed; defaults applied",
-            meta: {
-                phase: "loadConfig",
-                reason: error instanceof Error ? error.message : String(error),
-            },
-        });
-        // ENOENT or parse error -- use defaults
-    }
-    const sanitizedFileData = { ...fileData };
-    if ("context" in sanitizedFileData) {
-        delete sanitizedFileData.context;
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            event: "config_identity.error",
-            component: "config/identity",
-            message: "ignored legacy context block in secrets config",
-            meta: {
-                phase: "loadConfig",
-                path: configPath,
-            },
-        });
-    }
-    const mergedConfig = deepMerge(defaultRuntimeConfig(), sanitizedFileData);
+    const agentName = (0, identity_1.getAgentName)();
+    const runtimeResult = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+    const machineRuntimeResult = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName);
+    const vaultData = runtimeResult.ok ? localRuntimeFields(runtimeResult.config) : {};
+    const machineVaultData = machineRuntimeResult.ok ? localRuntimeFields(machineRuntimeResult.config) : {};
+    const mergedConfig = deepMerge(defaultRuntimeConfig(), vaultData);
+    const mergedWithMachineConfig = deepMerge(mergedConfig, machineVaultData);
     const config = _runtimeConfigOverride
-        ? deepMerge(mergedConfig, _runtimeConfigOverride)
-        : mergedConfig;
+        ? deepMerge(mergedWithMachineConfig, _runtimeConfigOverride)
+        : mergedWithMachineConfig;
     (0, runtime_1.emitNervesEvent)({
         event: "config.load",
         component: "config/identity",
-        message: "config loaded from disk",
+        message: "config loaded from runtime credential cache",
         meta: {
-            source: "disk",
-            used_defaults_only: Object.keys(fileData).length === 0,
+            source: runtimeResult.ok ? "vault-cache" : "defaults",
+            used_defaults_only: !runtimeResult.ok,
+            machine_runtime_credentials: machineRuntimeResult.ok ? "available" : machineRuntimeResult.reason,
             override_applied: _runtimeConfigOverride !== null,
+            runtime_credentials: runtimeResult.ok ? "available" : runtimeResult.reason,
         },
     });
     return config;
@@ -247,34 +179,85 @@ function loadConfig() {
 function resetConfigCache() {
     _runtimeConfigOverride = null;
     _testContextOverride = null;
+    _providerConfigOverride = null;
+    (0, provider_credentials_1.resetProviderCredentialCache)();
+    (0, runtime_credentials_1.resetRuntimeCredentialConfigCache)();
+}
+function cacheRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheRuntimeCredentialConfig)(agentName, config, new Date(0));
+}
+function cacheMachineRuntimeConfigForTests(agentName, config) {
+    (0, runtime_credentials_1.cacheMachineRuntimeCredentialConfig)(agentName, config, new Date(0), "machine_test");
+}
+function seedProviderCredentialCache(providers) {
+    if (!providers)
+        return;
+    _providerConfigOverride = deepMerge((_providerConfigOverride ?? {}), providers);
+    const records = Object.entries(_providerConfigOverride).map(([provider, rawConfig]) => {
+        const split = (0, provider_credentials_1.splitProviderCredentialFields)(provider, rawConfig);
+        return (0, provider_credentials_1.createProviderCredentialRecord)({
+            provider: provider,
+            credentials: split.credentials,
+            config: split.config,
+            provenance: { source: "manual" },
+            now: new Date(0),
+        });
+    });
+    (0, provider_credentials_1.cacheProviderCredentialRecords)((0, identity_1.getAgentName)(), records, new Date(0));
 }
 function patchRuntimeConfig(partial) {
+    const { providers, ...runtimePartial } = partial;
+    seedProviderCredentialCache(providers);
     const contextPatch = partial.context;
     if (contextPatch) {
         const base = _testContextOverride ?? identity_1.DEFAULT_AGENT_CONTEXT;
         _testContextOverride = deepMerge(base, contextPatch);
     }
-    _runtimeConfigOverride = deepMerge((_runtimeConfigOverride ?? {}), partial);
+    _runtimeConfigOverride = deepMerge((_runtimeConfigOverride ?? {}), runtimePartial);
+}
+function readProviderConfig(provider) {
+    const cached = (0, provider_credentials_1.readCachedProviderCredentialRecord)((0, identity_1.getAgentName)(), provider);
+    return cached.ok ? { ...cached.record.config, ...cached.record.credentials } : {};
 }
 function getAzureConfig() {
-    const config = loadConfig();
-    return { ...config.providers.azure };
+    const raw = readProviderConfig("azure");
+    return {
+        apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "",
+        endpoint: typeof raw.endpoint === "string" ? raw.endpoint : "",
+        deployment: typeof raw.deployment === "string" ? raw.deployment : "",
+        apiVersion: typeof raw.apiVersion === "string" ? raw.apiVersion : "2025-04-01-preview",
+        managedIdentityClientId: typeof raw.managedIdentityClientId === "string" ? raw.managedIdentityClientId : "",
+    };
 }
 function getMinimaxConfig() {
-    const config = loadConfig();
-    return { ...config.providers.minimax };
+    const raw = readProviderConfig("minimax");
+    return { apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "" };
 }
 function getAnthropicConfig() {
-    const config = loadConfig();
-    return { ...config.providers.anthropic };
+    const raw = readProviderConfig("anthropic");
+    return { setupToken: typeof raw.setupToken === "string" ? raw.setupToken : "" };
 }
 function getOpenAICodexConfig() {
-    const config = loadConfig();
-    return { ...config.providers["openai-codex"] };
+    const raw = readProviderConfig("openai-codex");
+    return {
+        oauthAccessToken: typeof raw.oauthAccessToken === "string" ? raw.oauthAccessToken : "",
+        ...(typeof raw.refreshToken === "string" ? { refreshToken: raw.refreshToken } : {}),
+        ...(typeof raw.expiresAt === "number" ? { expiresAt: raw.expiresAt } : {}),
+    };
 }
 function getGithubCopilotConfig() {
-    const config = loadConfig();
-    return { ...config.providers["github-copilot"] };
+    const raw = readProviderConfig("github-copilot");
+    return {
+        githubToken: typeof raw.githubToken === "string" ? raw.githubToken : "",
+        baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
+    };
+}
+function getOpenAICompatibleConfig(provider) {
+    const raw = readProviderConfig(provider);
+    return {
+        apiKey: typeof raw.apiKey === "string" ? raw.apiKey : "",
+        baseUrl: typeof raw.baseUrl === "string" ? raw.baseUrl : "",
+    };
 }
 function getTeamsConfig() {
     const config = loadConfig();
@@ -321,28 +304,47 @@ function getTeamsChannelConfig() {
 }
 function getBlueBubblesConfig() {
     const config = loadConfig();
-    const { serverUrl, password, accountId } = config.bluebubbles;
+    const { serverUrl, password, accountId, ownHandles } = config.bluebubbles;
     if (!serverUrl.trim()) {
-        throw new Error("bluebubbles.serverUrl is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.serverUrl is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
     }
     if (!password.trim()) {
-        throw new Error("bluebubbles.password is required in secrets.json to run the BlueBubbles sense.");
+        throw new Error("bluebubbles.password is required in this machine's agent-vault runtime config. Run `ouro connect bluebubbles --agent <agent>`.");
+    }
+    const normalizedHandles = [];
+    for (const handle of ownHandles) {
+        const trimmed = handle.trim();
+        if (trimmed.length > 0)
+            normalizedHandles.push(trimmed);
     }
     return {
         serverUrl: serverUrl.trim(),
         password: password.trim(),
         accountId: accountId.trim() || "default",
+        ownHandles: normalizedHandles,
     };
 }
 function getBlueBubblesChannelConfig() {
     const config = loadConfig();
-    const { port, webhookPath, requestTimeoutMs } = config.bluebubblesChannel;
-    return { port, webhookPath, requestTimeoutMs };
+    return { ...config.bluebubblesChannel };
 }
 function getIntegrationsConfig() {
     const config = loadConfig();
     return { ...config.integrations };
 }
+function getSyncConfig() {
+    try {
+        const agentConfig = (0, identity_1.loadAgentConfig)();
+        return {
+            enabled: agentConfig.sync?.enabled ?? false,
+            remote: agentConfig.sync?.remote ?? "origin",
+        };
+    }
+    catch {
+        /* v8 ignore next -- defensive: loadAgentConfig failure in test/bootstrap @preserve */
+        return { enabled: false, remote: "origin" };
+    }
+}
 function getOpenAIEmbeddingsApiKey() {
     return getIntegrationsConfig().openaiEmbeddingsApiKey;
 }
@@ -352,6 +354,19 @@ function getLogsDir() {
 function sanitizeKey(key) {
     return key.replace(/[/:]/g, "_");
 }
+function canonicalizeTelegramSessionKey(key) {
+    if (key.startsWith("telegram:"))
+        return key;
+    if (!key.startsWith("telegram_"))
+        return key;
+    const suffix = key.slice("telegram_".length);
+    if (suffix.startsWith("tg_"))
+        return `telegram:${suffix}`;
+    const numericSession = suffix.match(/^([0-9]+)_(-?[0-9]+)$/u);
+    if (numericSession)
+        return `telegram:${numericSession[1]}:${numericSession[2]}`;
+    return key;
+}
 function slugify(value) {
     return value
         .trim()
@@ -360,12 +375,40 @@ function slugify(value) {
         .replace(/^-+/, "")
         .replace(/-+$/, "");
 }
+class InvalidSessionPathError extends Error {
+}
+exports.InvalidSessionPathError = InvalidSessionPathError;
+function isValidSessionCoordinate(value) {
+    return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !/[/\\\0]/.test(value);
+}
+function isInsideSessionRoot(root, target) {
+    const relative = path.relative(root, target);
+    return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 function resolveSessionPath(friendId, channel, key, options) {
-    const dir = path.join((0, identity_1.getAgentRoot)(), "state", "sessions", friendId, channel);
+    const agentRoot = options?.agentRoot ?? (0, identity_1.getAgentRoot)();
+    if (options?.confined && (!isValidSessionCoordinate(friendId) || !isValidSessionCoordinate(channel)
+        || typeof key !== "string" || key.includes("\0") || !path.isAbsolute(agentRoot))) {
+        throw new InvalidSessionPathError("invalid session coordinates");
+    }
+    const sessionsRoot = path.join(agentRoot, "state", "sessions");
+    const dir = path.join(sessionsRoot, friendId, channel);
+    const file = path.join(dir, sanitizeKey(key) + ".json");
+    if (options?.confined) {
+        if (!isInsideSessionRoot(sessionsRoot, file))
+            throw new InvalidSessionPathError("session path escapes its root");
+        if (fs.existsSync(file)) {
+            const realSessionsRoot = fs.realpathSync(sessionsRoot);
+            if (!isInsideSessionRoot(fs.realpathSync(agentRoot), realSessionsRoot)
+                || !isInsideSessionRoot(realSessionsRoot, fs.realpathSync(file))) {
+                throw new InvalidSessionPathError("session path escapes the initiating agent");
+            }
+        }
+    }
     if (options?.ensureDir) {
         fs.mkdirSync(dir, { recursive: true });
     }
-    return path.join(dir, sanitizeKey(key) + ".json");
+    return file;
 }
 function sessionPath(friendId, channel, key) {
     return resolveSessionPath(friendId, channel, key, { ensureDir: true });