@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/repertoire/bundle-templates.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Templates for agent bundle scaffolding.
+ *
+ * ## .gitignore design philosophy
+ *
+ * The bundle .gitignore handles FUNCTIONAL "shouldn't track" cases only:
+ *
+ *   - Runtime state (sessions, logs, runtime files) — stale data with no
+ *     value for review or history.
+ *   - Credentials — real secrets live in the agent vault, but defense
+ *     in depth in case anything leaks into the bundle.
+ *   - Editor / OS noise (.DS_Store, .idea/, etc.).
+ *   - Build artifacts (rare in bundles, but possible).
+ *
+ * It DOES NOT handle PII. The bundle is inherently full of PII — `friends/`,
+ * `desk/_record/`, `psyche/`, `arc/`, `facts/`, `family/`, `travel/`
+ * etc. That's the point of the bundle; blocking those via .gitignore would
+ * defeat the purpose.
+ *
+ * PII is handled at first-push time by `bundle_first_push_review`, which
+ * enumerates PII-bearing directories, shows the agent counts, probes the
+ * remote URL for GitHub visibility, and hard-pauses until the human
+ * confirms. See Directive D in the planning doc.
+ *
+ * No content-pattern blocks (no `**\/sk-ant-*` or similar). Content-review
+ * failures are a different safety layer — credential scanning at commit
+ * time would be a follow-up feature.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII_BUNDLE_DIRECTORIES = exports.BUNDLE_GITIGNORE_TEMPLATE = void 0;
+exports.BUNDLE_GITIGNORE_TEMPLATE = `# Runtime state — sessions, logs, runtime files, never tracked
+state/
+
+# Credentials — never tracked. Real secrets live in the agent vault, but
+# defense in depth in case anything leaks into the bundle.
+.env
+.env.*
+secrets/
+**/*.key
+**/*.pem
+**/*.credentials
+**/*.pfx
+
+# Editor and OS noise
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Build artifacts (rare in bundles, but possible if a workspace lands here)
+node_modules/
+dist/
+`;
+/**
+ * PII-sensitive bundle directories. Enumerated here so `bundle_first_push_review`
+ * can categorize and count. Adding a new PII bucket to the bundle means adding
+ * it here so the first-push warning includes it.
+ */
+exports.PII_BUNDLE_DIRECTORIES = [
+    "friends",
+    "desk/_record/diary",
+    "desk/_record/notes",
+    "psyche",
+    "arc",
+    "facts",
+    "family",
+    "travel",
+    "sessions",
+];

package/dist/repertoire/bw-installer.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Lazy bw CLI installer — auto-installs the Bitwarden CLI when not present.
+ *
+ * Prefers the Bitwarden CLI that ships with ouro (the `@bitwarden/cli` version pinned in our
+ * package.json), because a newer `bw` on PATH can run client migrations our Vaultwarden server
+ * does not support: bw 2026.9 posts a user key id that Vaultwarden 1.37 answers with 404, and its
+ * login then fails. PATH is the fallback, then an npm install of the same pinned version.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PINNED_BW_CLI_VERSION = void 0;
+exports.findExecutableOnPath = findExecutableOnPath;
+exports.findExecutableViaNpmPrefix = findExecutableViaNpmPrefix;
+exports.findBundledBwCli = findBundledBwCli;
+exports.bwCommand = bwCommand;
+exports.ensureBwCli = ensureBwCli;
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const INSTALL_TIMEOUT_MS = 120_000;
+const WHICH_TIMEOUT_MS = 5_000;
+const DEFAULT_WINDOWS_PATHEXT = ".EXE;.CMD;.BAT;.COM";
+/** Must match the `@bitwarden/cli` dependency in package.json (a test checks). */
+exports.PINNED_BW_CLI_VERSION = "2026.6.0";
+function execFileAsync(cmd, args, timeout) {
+    return new Promise((resolve, reject) => {
+        (0, node_child_process_1.execFile)(cmd, args, { timeout }, (err, stdout) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+function stripWrappingQuotes(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("\"") && trimmed.endsWith("\"")) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function isExecutableFile(targetPath, platform) {
+    try {
+        fs.accessSync(targetPath, platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function executableNames(command, platform, pathExt) {
+    if (platform !== "win32")
+        return [command];
+    if (path.extname(command))
+        return [command];
+    const extensions = pathExt
+        .split(";")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    return extensions.length === 0
+        ? [command]
+        : extensions.map((extension) => (extension.startsWith(".") ? `${command}${extension}` : `${command}.${extension}`));
+}
+function findExecutableInDirectory(command, directory, platform, pathExt) {
+    const cleanDirectory = stripWrappingQuotes(directory);
+    if (!cleanDirectory)
+        return null;
+    for (const candidateName of executableNames(command, platform, pathExt)) {
+        const candidatePath = path.isAbsolute(candidateName)
+            ? candidateName
+            : path.join(cleanDirectory, candidateName);
+        if (isExecutableFile(candidatePath, platform)) {
+            return candidatePath;
+        }
+    }
+    return null;
+}
+function findExecutableOnPath(command, envPath = process.env.PATH ?? "", platform = process.platform, pathExt = process.env.PATHEXT ?? DEFAULT_WINDOWS_PATHEXT) {
+    if (path.isAbsolute(command) || command.includes(path.sep)) {
+        return isExecutableFile(command, platform) ? command : null;
+    }
+    for (const directory of envPath.split(path.delimiter)) {
+        const found = findExecutableInDirectory(command, directory, platform, pathExt);
+        if (found)
+            return found;
+    }
+    return null;
+}
+async function findExecutableViaNpmPrefix(command, platform = process.platform, pathExt = process.env.PATHEXT ?? DEFAULT_WINDOWS_PATHEXT) {
+    try {
+        const prefix = stripWrappingQuotes((await execFileAsync("npm", ["prefix", "-g"], WHICH_TIMEOUT_MS)).trim());
+        if (!prefix)
+            return null;
+        const searchDirs = platform === "win32"
+            ? [prefix, path.join(prefix, "bin")]
+            : [path.join(prefix, "bin"), prefix];
+        for (const directory of searchDirs) {
+            const found = findExecutableInDirectory(command, directory, platform, pathExt);
+            if (found)
+                return found;
+        }
+    }
+    catch {
+        // Prefix lookup is only a post-install fallback.
+    }
+    return null;
+}
+/**
+ * The `bw` entry point (`build/bw.js`) of the `@bitwarden/cli` package installed with ouro, or
+ * null when it is missing. It is run with ouro's own Node (see `bwCommand`), so it needs neither
+ * an executable bit nor `node` on PATH, and works on Windows too.
+ */
+function findBundledBwCli(resolvePackageJson = (id) => require.resolve(id)) {
+    try {
+        const packageJsonPath = resolvePackageJson("@bitwarden/cli/package.json");
+        const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        const bin = typeof pkg.bin === "string" ? pkg.bin : (pkg.bin && typeof pkg.bin === "object" ? pkg.bin.bw : undefined);
+        if (typeof bin !== "string")
+            throw new Error("@bitwarden/cli package.json names no bw entry point");
+        const entry = path.join(path.dirname(packageJsonPath), bin);
+        if (!fs.existsSync(entry))
+            throw new Error(`bundled bw entry point is missing: ${entry}`);
+        return entry;
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_cli_bundled_missing",
+            component: "repertoire",
+            message: "the bw that ships with ouro was not found; falling back to bw on PATH",
+            meta: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return null;
+    }
+}
+/** How to spawn a resolved `bw`: a `.js` entry point runs under this Node, anything else directly. */
+function bwCommand(bwBinaryPath, args, nodePath = process.execPath) {
+    return bwBinaryPath.endsWith(".js") ? { file: nodePath, args: [bwBinaryPath, ...args] } : { file: bwBinaryPath, args };
+}
+/**
+ * Ensure the `bw` CLI is available: `OURO_BW_BINARY` when set, else the bundled pinned one, else
+ * one on PATH, else install the pinned version via npm. Returns the path to the `bw` binary.
+ */
+async function ensureBwCli(findBundled = findBundledBwCli) {
+    // 0. An explicit override (tests and unusual installs): OURO_BW_BINARY
+    const override = process.env.OURO_BW_BINARY?.trim();
+    if (override) {
+        if (findExecutableOnPath(override))
+            return override;
+        throw new Error(`OURO_BW_BINARY is set to ${override}, which is not an executable file`);
+    }
+    // 1. The bw that ships with ouro
+    const bundled = findBundled();
+    if (bundled) {
+        return bundled;
+    }
+    // 2. A bw already on PATH
+    const existing = findExecutableOnPath("bw");
+    if (existing) {
+        return existing;
+    }
+    // 3. Install the pinned version via npm
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.bw_cli_install_start",
+        component: "repertoire",
+        message: "bw CLI not found, installing via npm",
+        meta: {},
+    });
+    try {
+        await execFileAsync("npm", ["install", "-g", `@bitwarden/cli@${exports.PINNED_BW_CLI_VERSION}`], INSTALL_TIMEOUT_MS);
+    }
+    catch (err) {
+        /* v8 ignore next -- execFileCb always throws Error instances @preserve */
+        const reason = err instanceof Error ? err.message : String(err);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "repertoire.bw_cli_install_fail",
+            component: "repertoire",
+            message: "failed to install bw CLI via npm",
+            meta: { reason },
+        });
+        throw new Error(`failed to install bw CLI via npm: ${reason}`);
+    }
+    // 4. Verify installation and return path
+    const installed = findExecutableOnPath("bw") ?? await findExecutableViaNpmPrefix("bw");
+    if (installed) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_cli_install_end",
+            component: "repertoire",
+            message: "bw CLI installed successfully",
+            meta: { path: installed },
+        });
+        return installed;
+    }
+    throw new Error("bw CLI installed via npm but binary not found in PATH or npm global bin");
+}

package/dist/repertoire/coding/codex-jsonl.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Codex JSONL event parser.
+ * Parses typed events from Codex --json output:
+ * thread.started, turn.started, turn.completed, item.completed.
+ * Maps events to coding session status transitions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCodexJsonlEvent = parseCodexJsonlEvent;
+const runtime_1 = require("../../nerves/runtime");
+const KNOWN_TYPES = new Set(["thread.started", "turn.started", "turn.completed", "item.completed"]);
+/**
+ * Parse a single JSONL line from Codex --json output.
+ * Returns null for invalid JSON, empty strings, or unknown event types.
+ */
+function parseCodexJsonlEvent(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        (0, runtime_1.emitNervesEvent)({
+            component: "repertoire",
+            event: "repertoire.codex_jsonl_parse_error",
+            message: "failed to parse codex JSONL line",
+            meta: { line: trimmed.slice(0, 100) },
+        });
+        return null;
+    }
+    const type = parsed.type;
+    if (!type || !KNOWN_TYPES.has(type))
+        return null;
+    const event = {
+        type: type,
+        threadId: typeof parsed.thread_id === "string" ? parsed.thread_id : undefined,
+        turnId: typeof parsed.turn_id === "string" ? parsed.turn_id : undefined,
+        item: typeof parsed.item === "object" && parsed.item !== null ? parsed.item : undefined,
+        raw: parsed,
+        statusHint: mapStatusHint(type),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "repertoire",
+        event: "repertoire.codex_jsonl_event",
+        message: "parsed codex JSONL event",
+        meta: { type, threadId: event.threadId ?? null },
+    });
+    return event;
+}
+function mapStatusHint(type) {
+    switch (type) {
+        case "thread.started":
+        case "turn.started":
+            return "running";
+        case "turn.completed":
+        case "item.completed":
+            return null; // No automatic status change for completion events
+        /* v8 ignore next -- defensive default for unknown event types */
+        default:
+            return null;
+    }
+}