@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/senses/shepherd/owner-notice.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOTICE_LIST_MAX = exports.NOTICE_COALESCE_MS = void 0;
+exports.noticeWanted = noticeWanted;
+exports.plain = plain;
+exports.noticeLine = noticeLine;
+exports.noticeMessage = noticeMessage;
+exports.resolveNoticeTargets = resolveNoticeTargets;
+exports.chooseTeamsBot = chooseTeamsBot;
+exports.createTeamsNoticeSender = createTeamsNoticeSender;
+exports.createOwnerNotifier = createOwnerNotifier;
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const await_alert_1 = require("../../heart/awaiting/await-alert");
+const config_1 = require("../../heart/config");
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * The owner notice: after a judged return, the agent's owner hears what happened in one short plain message on their
+ * own channel. It is deterministic, written here and sent with no model turn, so the owner hears about every return the
+ * policy covers whether or not the Ouro agent decides it matters. Returns that arrive close together share one message.
+ */
+exports.NOTICE_COALESCE_MS = 5_000;
+/** Returns named one by one in a coalesced message; the rest are counted. */
+exports.NOTICE_LIST_MAX = 6;
+const NAME_MAX = 60;
+const REASON_MAX = 300;
+const REPLY_MAX = 240;
+/** Kinds a "needs-me" owner still hears about. */
+const NEEDS_ME = new Set(["gate", "done", "loop_guard"]);
+function noticeWanted(policy, record) {
+    if (policy === "off")
+        return false;
+    return policy === "every" || NEEDS_ME.has(record.kind);
+}
+/**
+ * Untrusted terminal text as one bounded plain line: no control or invisible characters, and nothing Teams could read as
+ * markup, a mention or code (`< > [ ] * ~ # | \ @` and backticks). Double quotes become single, so a quoted reply stays one quote.
+ */
+function plain(value, max) {
+    const flat = value
+        .replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]+/gu, " ")
+        .replace(/[<>[\]*~#|\\@`]+/g, " ")
+        .replace(/"/g, "'")
+        .replace(/\s+/g, " ")
+        .trim();
+    return flat.length <= max ? flat : `${flat.slice(0, max - 1).trimEnd()}…`;
+}
+function who(record, ref) {
+    const agent = record.agent ? plain(record.agent, NAME_MAX) : "";
+    const folder = record.cwd ? plain(path.basename(record.cwd), NAME_MAX) : "";
+    const where = plain(ref ?? record.session.slice(0, 8), NAME_MAX);
+    return `${agent || "A coding agent"}${folder ? ` in ${folder}` : ""}${where ? ` (${where})` : ""}`;
+}
+/** One return as one sentence pair: who returned, what Shepherd did, and why. */
+function noticeLine(record, ref) {
+    const subject = who(record, ref);
+    const why = `Why: ${plain(record.reason, REASON_MAX) || "no reason given"}`;
+    switch (record.kind) {
+        case "premature":
+            if (record.action === "respond" && record.reply) {
+                const sent = record.reply.startsWith("key:") ? `pressed ${plain(record.reply.slice(4), 10)}` : `sent it back: "${plain(record.reply, REPLY_MAX)}"`;
+                return `${subject} stopped early, so I ${sent}. ${why}`;
+            }
+            return `${subject} stopped early, but I did not answer it, so it is waiting for you. ${why}`;
+        case "gate":
+            return `${subject} needs you. ${why}`;
+        case "done":
+            return `${subject} says it is done. ${why}`;
+        case "loop_guard":
+            return `${subject}: I stopped answering it after too many replies, so it is waiting for you. ${why}`;
+        case "working":
+            return `${subject} is still working in the background and has news. ${why}`;
+        case "unclear":
+            return `${subject} stopped and I could not tell what it needs, so I left it. ${why}`;
+        default:
+            return `${subject} stopped but I could not judge it, so I left it. ${why}`;
+    }
+}
+/** One message for a burst: a single return is its line; several are a short list, the extra ones counted. */
+function noticeMessage(records, refs = new Map()) {
+    const lines = records.slice(0, exports.NOTICE_LIST_MAX).map((record) => noticeLine(record, refs.get(record.session)));
+    if (records.length === 1)
+        return lines[0];
+    const more = records.length - lines.length;
+    return [`${records.length} coding agents stopped:`, ...lines.map((line) => `- ${line}`), ...(more > 0 ? [`- and ${more} more.`] : [])].join("\n");
+}
+function teamsAadId(friend) {
+    const ext = friend.externalIds.find((entry) => entry.provider === "aad" && !entry.externalId.startsWith("group:"));
+    return ext ? { id: ext.externalId.toLowerCase(), tenantId: ext.tenantId } : null;
+}
+/**
+ * Who hears the notice: every family friend reachable on Teams (a Teams user id the bot can open a chat with), once per
+ * Teams user even when several friend records share one. Teams is the only proactive channel wired today.
+ */
+async function resolveNoticeTargets(agentRoot, store = new friends_1.FileFriendStore(path.join(agentRoot, "friends"))) {
+    const seen = new Set();
+    const targets = [];
+    for (const friend of await store.listAll()) {
+        if (friend.trustLevel !== "family")
+            continue;
+        const aad = teamsAadId(friend);
+        if (!aad || seen.has(aad.id))
+            continue;
+        seen.add(aad.id);
+        targets.push({ friendId: friend.id, name: friend.name, key: (0, await_alert_1.resolveAlertKey)(agentRoot, friend.id, "teams") ?? "shepherd", ...(aad.tenantId ? { tenantId: aad.tenantId } : {}) });
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.shepherd_notice_targets", message: "resolved Shepherd owner notice targets", meta: { count: targets.length } });
+    return targets;
+}
+/** The bot whose tenant is the friend's: the secondary bot when it serves that tenant, else the primary. */
+function chooseTeamsBot(tenantId, primary, secondary) {
+    if (tenantId && secondary.clientId && secondary.tenantId === tenantId)
+        return secondary;
+    return primary.clientId ? primary : null;
+}
+/* v8 ignore start -- the live Teams SDK client; its token and REST calls need a real bot registration @preserve */
+async function liveBotApi(config) {
+    const { App } = await Promise.resolve().then(() => __importStar(require("@microsoft/teams.apps")));
+    const app = new App({
+        clientId: config.clientId,
+        ...(config.clientSecret ? { clientSecret: config.clientSecret } : {}),
+        tenantId: config.tenantId,
+        ...(config.managedIdentityClientId ? { managedIdentityClientId: config.managedIdentityClientId } : {}),
+    });
+    return { id: app.id, conversations: app.api.conversations };
+}
+/* v8 ignore stop */
+/**
+ * Sends through the Teams sense's own proactive path (`sendProactiveTeamsMessageToSession`: trust check, internal-content
+ * guard, 1:1 chat with the friend's Teams id) with a bot client of this process's own, built from the agent's Teams
+ * credentials. Nothing listens on a port: the client only acquires a bot token and calls the Bot Framework.
+ */
+function createTeamsNoticeSender(agentRoot, deps = {}) {
+    const bots = new Map();
+    return async (target, text) => {
+        const config = chooseTeamsBot(target.tenantId, (deps.primary ?? config_1.getTeamsConfig)(), (deps.secondary ?? config_1.getTeamsSecondaryConfig)());
+        if (!config)
+            return { delivered: false, reason: "no_teams_bot" };
+        let bot = bots.get(config.clientId);
+        if (!bot) {
+            /* v8 ignore next -- tests inject the bot client; the live Bot Framework client is built only in the running sense @preserve */
+            bot = (deps.botApi ?? liveBotApi)(config);
+            bots.set(config.clientId, bot);
+            // A client that could not be built is built again for the next notice.
+            bot.catch(() => bots.delete(config.clientId));
+        }
+        const { sendProactiveTeamsMessageToSession } = await Promise.resolve().then(() => __importStar(require("../teams")));
+        return sendProactiveTeamsMessageToSession({ friendId: target.friendId, sessionKey: target.key, text, textFormat: "plain", intent: "generic_outreach" }, { botApi: await bot, store: new friends_1.FileFriendStore(path.join(agentRoot, "friends")) });
+    };
+}
+/** Collects notices for NOTICE_COALESCE_MS after the first, then sends them as one message. It never throws. */
+function createOwnerNotifier(options) {
+    const { agent, policy } = options;
+    const resolveTargets = options.resolveTargets ?? (() => resolveNoticeTargets(options.agentRoot));
+    const send = options.send ?? createTeamsNoticeSender(options.agentRoot);
+    const waiting = [];
+    let cancel = null;
+    async function flush() {
+        cancel?.();
+        cancel = null;
+        const records = waiting.splice(0);
+        if (records.length === 0)
+            return;
+        try {
+            const refs = new Map();
+            try {
+                for (const session of await options.listSessions())
+                    refs.set(session.id, session.ref);
+            }
+            catch {
+                // Without the host's handles, each notice names a short session id instead.
+            }
+            const text = noticeMessage(records, refs);
+            const targets = await resolveTargets();
+            if (targets.length === 0) {
+                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.shepherd_notice_no_target", message: "no family friend is reachable on Teams, so the Shepherd owner notice was not sent", meta: { agent, returns: records.length } });
+                return;
+            }
+            for (const target of targets) {
+                try {
+                    const result = await send(target, text);
+                    (0, runtime_1.emitNervesEvent)({
+                        level: result.delivered ? "info" : "warn",
+                        component: "senses",
+                        event: result.delivered ? "senses.shepherd_notice_sent" : "senses.shepherd_notice_not_sent",
+                        message: result.delivered ? "sent the Shepherd owner notice" : "the Shepherd owner notice was not delivered",
+                        meta: { agent, friendId: target.friendId, returns: records.length, ...(result.delivered ? {} : { reason: result.reason ?? "unknown" }) },
+                    });
+                }
+                catch (error) {
+                    (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.shepherd_notice_error", message: "sending the Shepherd owner notice failed", meta: { agent, friendId: target.friendId, error: error.message } });
+                }
+            }
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "senses", event: "senses.shepherd_notice_error", message: "preparing the Shepherd owner notice failed", meta: { agent, error: error.message } });
+        }
+    }
+    return {
+        notify(record) {
+            if (!noticeWanted(policy, record))
+                return;
+            waiting.push(record);
+            cancel ??= options.schedule(() => { void flush(); }, exports.NOTICE_COALESCE_MS);
+        },
+        flush,
+        stop() {
+            cancel?.();
+            cancel = null;
+        },
+    };
+}

package/dist/senses/shepherd/redact.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINGERPRINT_READ_LINES = exports.FINGERPRINT_LINES = void 0;
+exports.redactSecrets = redactSecrets;
+exports.screenTail = screenTail;
+exports.withoutNumbers = withoutNumbers;
+exports.screenFingerprint = screenFingerprint;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Terminal screens and agents' last messages can show credentials. Everything Shepherd hands to a
+ * model or a tool result (screen text, last messages) goes through this first. It is a best-effort net for
+ * secret-shaped strings, not a guarantee, so callers also keep their output bounded.
+ */
+const REDACTED = "[redacted]";
+const WHOLE_MATCH = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    /\bv1\.[A-Za-z0-9_-]{40,}\.[A-Za-z0-9_-]{40,}/g,
+    /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+];
+/** Keep the label (group 1), redact the value. */
+const LABELLED_VALUE = [
+    /(\b(?:Bearer|Basic)\s+)[A-Za-z0-9._~+/=-]{6,}/gi,
+    /(\b(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s'"&]+)/gi,
+    /([?&](?:token|key|api_key|access_token|sig|signature)=)[^&\s]+/gi,
+];
+function redactSecrets(text) {
+    let result = text;
+    for (const pattern of WHOLE_MATCH)
+        result = result.replace(pattern, REDACTED);
+    for (const pattern of LABELLED_VALUE)
+        result = result.replace(pattern, `$1${REDACTED}`);
+    if (result !== text) {
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.shepherd_redacted", message: "redacted secret-shaped text from cmux output", meta: { removedChars: text.length - result.length } });
+    }
+    return result;
+}
+/** The last `lines` lines of a screen, without its trailing blank space. */
+function screenTail(text, lines) {
+    return text.replace(/\s+$/, "").split("\n").slice(-lines).join("\n");
+}
+/**
+ * A screen with its numbers taken out: a timer or token counter at a waiting prompt is not the
+ * screen moving on. A timer can tick, grow a unit (`59s` to `1m 0s`), and come and go between
+ * redraws, shifting the padding beside it, so runs of numbers with time units vanish along with
+ * the space around them, and runs of spaces and line-end padding do not count.
+ */
+function withoutNumbers(screen) {
+    return screen.replace(/[ \t]*(\d+[hms]?[ \t]*)+/g, " ").replace(/[ \t]+/g, " ").replace(/ $/gm, "");
+}
+/** Lines a screen fingerprint covers, and the fewest lines a read must take to compute one. */
+exports.FINGERPRINT_LINES = 20;
+exports.FINGERPRINT_READ_LINES = 40;
+/**
+ * A short fingerprint of what a terminal shows now: its last lines, redacted, with numbers blanked so a ticking timer does
+ * not count as a change. `shepherd_read` hands it out and `shepherd_send` compares it, so a key is pressed only on the
+ * screen someone actually saw.
+ */
+function screenFingerprint(text) {
+    return (0, node_crypto_1.createHash)("sha256").update(withoutNumbers(screenTail(redactSecrets(text), exports.FINGERPRINT_LINES))).digest("hex").slice(0, 16);
+}

package/dist/senses/shepherd/returns.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shepherdStateDir = shepherdStateDir;
+exports.returnsLogPath = returnsLogPath;
+exports.appendReturn = appendReturn;
+exports.readReturns = readReturns;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+/** The returns log: one line per judgment, read by the sense, the Shepherd tools and the human. */
+const LOG_MAX_BYTES = 2 * 1024 * 1024;
+function shepherdStateDir(agentRoot) {
+    return path.join(agentRoot, "state", "senses", "shepherd");
+}
+function returnsLogPath(agentRoot) {
+    return path.join(shepherdStateDir(agentRoot), "returns.jsonl");
+}
+/** Appends one judgment. The log is machine-local (0700 directory, 0600 file) and rotates once at 2 MB. */
+function appendReturn(agentRoot, record) {
+    const file = returnsLogPath(agentRoot);
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    try {
+        if (fs.statSync(file).size > LOG_MAX_BYTES)
+            fs.renameSync(file, `${file}.1`);
+    }
+    catch {
+        // No log yet.
+    }
+    fs.appendFileSync(file, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.shepherd_return_logged", message: "logged a Shepherd judgment", meta: { kind: record.kind, action: record.action } });
+}
+function readReturns(agentRoot) {
+    try {
+        return fs.readFileSync(returnsLogPath(agentRoot), "utf-8").split("\n").flatMap((line) => {
+            try {
+                return line ? [JSON.parse(line)] : [];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}