@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/src/input/commands/mail-runtime.ts

@@ -0,0 +1,267 @@
+/**
+ * mail-runtime.ts — `/mail`, the terminal surface over the daemon's mail
+ * capability.
+ *
+ * This command implements no mail. Every verb here is one call into the
+ * gateway method catalog, where `src/daemon/handlers/email/` owns IMAP, SMTP,
+ * settings resolution, the credential read, and the confirmation gate. What
+ * lives in this file is argument parsing, rendering, and an honest refusal when
+ * the capability is not set up — nothing else.
+ *
+ * ## What is exposed, and what is not
+ *
+ * Reading (`list`, `read`) and drafting are exposed because checking mail
+ * without leaving the terminal is squarely what this product is for, and
+ * because a draft changes nothing outside the account's own Drafts folder.
+ *
+ * Sending is exposed too — a shipped route with no way to reach it is a route
+ * that is not wired up — but never in one step. `/mail send` first renders
+ * exactly what would leave the machine and stops; only a re-run carrying
+ * `--confirm` sets both flags the daemon's gate demands. That mirrors the
+ * preview-then-confirm shape `/review` uses for hunk reverts, and it means the
+ * dangerous action cannot happen from a typo or a recalled line of history.
+ *
+ * Message bodies are attacker-controlled text. They are printed as transcript
+ * output, which is display-only and never enters the model's message history,
+ * so a body cannot smuggle instructions into a turn by being read here.
+ */
+
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import {
+  EXPLICIT_WRITE_INVOCATION_CONTEXT,
+  READ_INVOCATION_CONTEXT,
+  errorText,
+  probeConnection,
+  renderConnectionStatus,
+} from './connection-status.ts';
+
+/** Inbox summary, exactly the daemon's `email.inbox.list` item shape. */
+interface InboxMessage {
+  readonly uid: number;
+  readonly from: string;
+  readonly subject: string;
+  readonly date: string;
+  readonly unread: boolean;
+  readonly bodyPreview: string;
+}
+
+/** Full message, exactly the daemon's `email.inbox.read` output shape. */
+interface FullMessage {
+  readonly uid: number;
+  readonly from: string;
+  readonly subject: string;
+  readonly date: string;
+  readonly bodyText?: string;
+  readonly attachments?: ReadonlyArray<{ readonly filename: string; readonly sizeBytes: number }>;
+}
+
+const DEFAULT_LIST_LIMIT = 15;
+const MAX_LIST_LIMIT = 100;
+
+function truncate(value: string, width: number): string {
+  const flat = value.replace(/\s+/g, ' ').trim();
+  return flat.length <= width ? flat : `${flat.slice(0, width - 1)}…`;
+}
+
+export function renderInboxList(messages: readonly InboxMessage[]): string {
+  if (messages.length === 0) return 'Inbox is empty (nothing matched).';
+  const lines = [`Inbox — ${messages.length} message${messages.length === 1 ? '' : 's'}:`];
+  for (const message of messages) {
+    const mark = message.unread ? '●' : ' ';
+    lines.push(`  ${mark} ${String(message.uid).padStart(6)}  ${truncate(message.from, 28).padEnd(28)}  ${truncate(message.subject, 48)}`);
+  }
+  lines.push('', '  /mail read <uid> — open one message');
+  return lines.join('\n');
+}
+
+export function renderMessage(message: FullMessage): string {
+  const lines = [
+    `From:    ${message.from}`,
+    `Subject: ${message.subject}`,
+    `Date:    ${message.date}`,
+  ];
+  const attachments = message.attachments ?? [];
+  if (attachments.length > 0) {
+    lines.push(`Files:   ${attachments.map((a) => `${a.filename} (${a.sizeBytes} bytes)`).join(', ')}`);
+  }
+  lines.push('', message.bodyText && message.bodyText.trim().length > 0
+    ? message.bodyText.trimEnd()
+    : '(no plain-text body)');
+  return lines.join('\n');
+}
+
+/**
+ * Split `to | subject | body` on unescaped pipes.
+ *
+ * A pipe rather than positional words because a subject and a body both
+ * contain spaces, and quoting rules invented per-command are their own bug
+ * source. Exactly three fields are required, so a missing one is a clear
+ * usage error rather than a message sent with an empty subject.
+ */
+export function parseComposeArgs(raw: string): { to: string; subject: string; body: string } | null {
+  const parts = raw.split('|').map((part) => part.trim());
+  if (parts.length !== 3) return null;
+  const [to, subject, body] = parts;
+  if (!to || !subject || !body) return null;
+  return { to, subject, body };
+}
+
+function parseLimit(raw: string | undefined): number {
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_LIST_LIMIT;
+  return Math.min(MAX_LIST_LIMIT, Math.floor(parsed));
+}
+
+const USAGE = [
+  'Usage:',
+  '  /mail                       connection status and the latest messages',
+  '  /mail status                connection status only',
+  '  /mail list [n]              list the n most recent messages (default 15)',
+  '  /mail read <uid>            open one message',
+  '  /mail draft <to | subject | body>   save a draft to the account',
+  '  /mail send  <to | subject | body> [--confirm]   preview, then send',
+].join('\n');
+
+export function registerMailRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'mail',
+    aliases: ['email'],
+    description: 'Mail over the daemon: connection status, inbox, read, draft, send',
+    usage: '[status|list|read|draft|send] …',
+    argsHint: '[status|list <n>|read <uid>|draft|send]',
+    async handler(args, ctx) {
+      const gateway = ctx.workspace.gatewayMethods;
+      const sub = (args[0] ?? '').toLowerCase();
+
+      if (sub === 'status') {
+        ctx.print(renderConnectionStatus(await probeConnection(gateway, 'mail')));
+        return;
+      }
+
+      if (!gateway) {
+        ctx.print(renderConnectionStatus(await probeConnection(undefined, 'mail')));
+        return;
+      }
+
+      if (sub === '' || sub === 'list') {
+        await listInbox(ctx, gateway, parseLimit(args[1]), sub === '');
+        return;
+      }
+      if (sub === 'read') {
+        await readMessage(ctx, gateway, args[1]);
+        return;
+      }
+      if (sub === 'draft' || sub === 'send') {
+        await compose(ctx, gateway, sub, args.slice(1));
+        return;
+      }
+      ctx.print(USAGE);
+    },
+  });
+}
+
+type Gateway = NonNullable<CommandContext['workspace']['gatewayMethods']>;
+
+/**
+ * Every failure path renders the connection status rather than a bare error:
+ * "not configured" is far more often the real cause than a transient fault,
+ * and the status carries the exact next step.
+ */
+async function withStatusOnFailure(
+  ctx: CommandContext,
+  gateway: Gateway,
+  label: string,
+  run: () => Promise<void>,
+): Promise<void> {
+  try {
+    await run();
+  } catch (error) {
+    ctx.print(`[mail ${label}] ${errorText(error)}`);
+    ctx.print(renderConnectionStatus(await probeConnection(gateway, 'mail')));
+  }
+}
+
+async function listInbox(ctx: CommandContext, gateway: Gateway, limit: number, withStatus: boolean): Promise<void> {
+  await withStatusOnFailure(ctx, gateway, 'list', async () => {
+    const result = await gateway.invoke('email.inbox.list', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { limit },
+    }) as { readonly messages?: readonly InboxMessage[] };
+    if (withStatus) {
+      ctx.print(renderConnectionStatus({
+        surface: 'mail',
+        state: 'ready',
+        detail: 'Mail is connected — the daemon reached the server and returned a result.',
+        nextActions: [],
+      }));
+    }
+    ctx.print(renderInboxList(result.messages ?? []));
+  });
+}
+
+async function readMessage(ctx: CommandContext, gateway: Gateway, rawUid: string | undefined): Promise<void> {
+  const uid = Number(rawUid);
+  if (!Number.isFinite(uid) || uid <= 0) {
+    ctx.print('Usage: /mail read <uid> — the uid column from /mail list.');
+    return;
+  }
+  await withStatusOnFailure(ctx, gateway, 'read', async () => {
+    const message = await gateway.invoke('email.inbox.read', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { uid },
+    }) as FullMessage;
+    ctx.print(renderMessage(message));
+  });
+}
+
+async function compose(ctx: CommandContext, gateway: Gateway, verb: 'draft' | 'send', rest: readonly string[]): Promise<void> {
+  const raw = rest.filter((part) => part !== '--confirm').join(' ');
+  const confirmed = rest.includes('--confirm');
+  const parsed = parseComposeArgs(raw);
+  if (parsed === null) {
+    ctx.print([
+      `Usage: /mail ${verb} <to | subject | body>`,
+      '  Three fields separated by | — for example:',
+      `  /mail ${verb} me@example.com | Build is green | All gates passed.`,
+    ].join('\n'));
+    return;
+  }
+
+  if (verb === 'draft') {
+    await withStatusOnFailure(ctx, gateway, 'draft', async () => {
+      // No `confirm` in the body: the SDK contract for draft.create does not
+      // declare one (its input schema is closed), and the handler is registered
+      // without the confirmation wrapper. Sending one would be a field the
+      // schema rejects.
+      const result = await gateway.invoke('email.draft.create', {
+        ...EXPLICIT_WRITE_INVOCATION_CONTEXT,
+        body: { to: parsed.to, subject: parsed.subject, body: parsed.body },
+      }) as { readonly uid: number; readonly draftId: string };
+      ctx.print(`Draft saved to the account (uid ${result.uid}). Nothing was sent.`);
+    });
+    return;
+  }
+
+  // Send: preview first, always. The daemon would refuse an unconfirmed call
+  // anyway; showing exactly what would leave the machine is the point.
+  if (!confirmed) {
+    ctx.print([
+      'This would send:',
+      `  To:      ${parsed.to}`,
+      `  Subject: ${parsed.subject}`,
+      '',
+      parsed.body,
+      '',
+      'Nothing has been sent. Re-run the same line with --confirm to send it.',
+    ].join('\n'));
+    return;
+  }
+
+  await withStatusOnFailure(ctx, gateway, 'send', async () => {
+    const result = await gateway.invoke('email.send', {
+      ...EXPLICIT_WRITE_INVOCATION_CONTEXT,
+      body: { to: parsed.to, subject: parsed.subject, body: parsed.body, confirm: true },
+    }) as { readonly messageId: string; readonly sentAt: string };
+    ctx.print(`Sent to ${parsed.to} at ${result.sentAt} (message id ${result.messageId}).`);
+  });
+}

package/src/input/commands/operator-runtime.ts

@@ -65,7 +65,12 @@ export function registerOperatorRuntimeCommands(registry: CommandRegistry): void
 
   registry.register({
     name: 'profiles',
-    aliases: ['profile'],
+    // The singular `profile` alias was given up to /profile, the owner profile
+    // (docs/owner-profile.md). These are two unrelated things — this command
+    // loads saved display/provider settings presets, and the other one is what
+    // the platform knows about the person who owns it — and the singular word
+    // now belongs to the second. `/profiles` is unchanged; only the abbreviation
+    // moved. See the naming note in docs/owner-profile.md §3.
     description: 'Browse and load config profiles',
     handler(_args, ctx) {
       if (ctx.openProfilePicker) {

package/src/input/commands/payment-card-intake.ts

@@ -0,0 +1,200 @@
+/**
+ * /payments card — capture a payment card through the composer's concealed
+ * input mode, following the same guided-chain pattern as /channel pair
+ * (channel-pairing.ts) and the SAME concealed-input mechanism as
+ * provider-key-intake.ts (see concealed-input.ts).
+ *
+ * Card number, expiry, CVV, and cardholder name are secret-tier (see
+ * config/secret-config.ts's SECRET_CONFIG_KEYS): each is entered through one
+ * masked concealed-input prompt in turn and stored via
+ * persistSecretBackedConfigValue, the same secret-manager + config-reference
+ * path every other secret-backed setting in this app uses. The plaintext
+ * never reaches the transcript, input history, or a log line — only a
+ * redacted confirmation is printed after each field.
+ *
+ * Billing and shipping address are ordinary (non-secret) config fields, now
+ * real structured CONFIG_SCHEMA entries (payments.billingAddress.{name,
+ * line1, line2, city, region, postalCode, country} and the shippingAddress
+ * equivalents) — this command points the user at the Payments settings
+ * category (or /config payments) to set them, the same way /channel pair
+ * directs non-secret credential fields, rather than routing plain text
+ * through the concealed (masked) input path where it does not belong.
+ *
+ * Stored with `scope: 'daemon'`: the daemon — not just this interactive
+ * client — is what completes an autonomous purchase, so the credential must
+ * land in the daemon-scoped secret tier the daemon actually reads.
+ *
+ * The config-reference half (the `goodvibes://secrets/...` marker
+ * persistSecretBackedConfigValue writes alongside the secret) goes through
+ * `ctx.platform.configManager` directly — the same real ConfigManager every
+ * other command in this app uses, not a TUI-local store. See
+ * payments-config.ts's header comment for why these particular keys
+ * (`payments.cardNumber`, etc., flat sub-keys under the SDK's real
+ * `payments` section) are ConfigManager-safe even though the SDK's
+ * CONFIG_SCHEMA has no scalar entry for them yet: `payments.` is a
+ * daemon-owned config prefix, so the reference lands in the daemon's own
+ * settings file and is visible to the daemon, the webui and the agent —
+ * not just this TUI session.
+ *
+ * ── Card details are entered only at a local terminal or the webui ────────
+ *
+ * Owner ruling (see the SDK's platform/payments/entry-surface.ts): card
+ * material may be TYPED only on `tui`, `agent-terminal`, or `webui` — never
+ * over Telegram, ntfy, Discord, Slack, WhatsApp, Signal, a webhook, or any
+ * other remote messaging surface. A card number typed into a hosted chat is
+ * stored on that provider's own servers, in history this app cannot erase,
+ * and it already passed through their infrastructure before reaching us —
+ * our own encryption at rest does nothing for a value copied elsewhere on
+ * its way in. This is a SEPARATE question from which surfaces may APPROVE or
+ * VETO a purchase (every command-authority channel still can); the two are
+ * never merged into one check.
+ *
+ * This command always runs inside the TUI's own composer (CARD_ENTRY_SURFACE
+ * below), which the SDK's allowlist accepts — so this gate changes nothing
+ * about today's behavior. What it buys is that the refusal already exists
+ * the moment this app (or a shared command registry) ever grows a path that
+ * lets `/payments card` be reached from somewhere else: the check is real
+ * and SDK-driven, not an implicit "this is the TUI so it's fine" assumption.
+ */
+
+import type { CommandRegistry, CommandContext } from '../command-registry.ts';
+import { persistSecretBackedConfigValue } from '../../config/secret-config.ts';
+import type { ConfigKey } from '../../config/index.ts';
+import { describeCardEntryRefusal, mayOfferCardEntryFlow } from '@pellux/goodvibes-sdk/platform/payments';
+import {
+  PAYMENTS_CARD_NUMBER_CONFIG_KEY,
+  PAYMENTS_CARD_EXPIRY_CONFIG_KEY,
+  PAYMENTS_CARD_CVV_CONFIG_KEY,
+  PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY,
+} from '../payments-config.ts';
+
+/**
+ * This command is wired only into the TUI's own composer command registry —
+ * it is never reachable from a channel bridge (Telegram, Discord, ...), each
+ * of which has its own separate command surface in the daemon. The constant
+ * still names the surface explicitly and is checked through the SDK's own
+ * allowlist below, rather than skipping the check because "this is the TUI".
+ */
+export const CARD_ENTRY_SURFACE = 'tui';
+
+interface CardField {
+  readonly key: ConfigKey;
+  readonly label: string;
+  readonly placeholder: string;
+}
+
+/** Order matters only for the guided prompt sequence, not for storage. */
+const CARD_SECRET_FIELDS: readonly CardField[] = [
+  { key: PAYMENTS_CARD_NUMBER_CONFIG_KEY, label: 'Card number', placeholder: '4242424242424242' },
+  { key: PAYMENTS_CARD_EXPIRY_CONFIG_KEY, label: 'Expiry (MM/YY)', placeholder: '12/34' },
+  { key: PAYMENTS_CARD_CVV_CONFIG_KEY, label: 'CVV', placeholder: '123' },
+  { key: PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY, label: 'Cardholder name', placeholder: 'as printed on the card' },
+];
+
+function fieldConfigured(ctx: CommandContext, field: CardField): boolean {
+  const raw: unknown = ctx.platform.configManager.get(field.key);
+  return typeof raw === 'string' && raw.trim().length > 0;
+}
+
+function renderCardStatus(ctx: CommandContext): string[] {
+  const lines = ['Payment card on file:'];
+  for (const field of CARD_SECRET_FIELDS) {
+    lines.push(`  ${field.label.padEnd(20)} ${fieldConfigured(ctx, field) ? 'set' : 'not set'}`);
+  }
+  lines.push('');
+  lines.push('Run /payments card to enter or replace the card (masked input, chained prompts).');
+  lines.push('Billing/shipping address, budgets, windows and the rest of the payment capability are ordinary config values: set them via /config payments or the Settings > Payments category.');
+  return lines;
+}
+
+/** Chain a masked prompt for each card secret field, storing each through the daemon-scoped secret tier. */
+function promptCardFields(ctx: CommandContext, fields: readonly CardField[], index: number): void {
+  if (index >= fields.length) {
+    ctx.print('\nCard stored. Billing/shipping address and the rest of the payment capability are ordinary config values — set them via /config payments or the Settings > Payments category.');
+    ctx.renderRequest();
+    return;
+  }
+  const field = fields[index]!;
+  if (!ctx.beginConcealedInput) {
+    ctx.print('[payments] Concealed input is unavailable on this surface; card entry requires it and cannot fall back to plaintext.');
+    return;
+  }
+  ctx.print(`[payments] Enter ${field.label} (e.g. ${field.placeholder}) — masked; Enter to store, Esc to stop.`);
+  ctx.beginConcealedInput({
+    label: field.label,
+    onSubmit: (value) => {
+      if (value.length === 0) {
+        ctx.print(`[payments] ${field.label} left unset.`);
+        promptCardFields(ctx, fields, index + 1);
+        return;
+      }
+      void persistSecretBackedConfigValue(
+        ctx.platform.configManager,
+        ctx.platform.secretsManager,
+        field.key,
+        value,
+        { scope: 'daemon' },
+      )
+        .then(() => {
+          ctx.print(`[payments] ${field.label} stored securely (hidden).`);
+          promptCardFields(ctx, fields, index + 1);
+        })
+        .catch((error: unknown) => {
+          ctx.print(`[payments] Failed to store ${field.label}: ${error instanceof Error ? error.message : String(error)}`);
+          promptCardFields(ctx, fields, index + 1);
+        });
+    },
+    onCancel: () => {
+      ctx.print(`[payments] Stopped. Re-run /payments card to finish the remaining fields.`);
+    },
+  });
+}
+
+/**
+ * Start the card-entry flow, gated on the SDK's own entry-surface allowlist
+ * rather than an assumption baked into this command. `surface` defaults to
+ * this command's real, fixed identity (CARD_ENTRY_SURFACE) — exposed as a
+ * parameter only so tests can drive the refusal path without needing this
+ * app to actually be reachable from a remote channel.
+ */
+export function startCardEntryFlow(ctx: CommandContext, surface: string = CARD_ENTRY_SURFACE): void {
+  if (!mayOfferCardEntryFlow(surface)) {
+    ctx.print(describeCardEntryRefusal(surface));
+    return;
+  }
+  if (!ctx.beginConcealedInput) {
+    ctx.print('[payments] Concealed input is unavailable on this surface.');
+    return;
+  }
+  ctx.print(`Entering ${CARD_SECRET_FIELDS.length} card field(s) — masked; Esc to stop at any point.`);
+  promptCardFields(ctx, CARD_SECRET_FIELDS, 0);
+}
+
+/** Entry point for `/payments [card|status]` — exported directly so tests can drive it without the registry. */
+export function runPaymentsCommand(args: readonly string[], ctx: CommandContext): void {
+  const sub = (args[0] ?? '').toLowerCase();
+  if (sub === '' || sub === 'status') {
+    ctx.print(renderCardStatus(ctx).join('\n'));
+    return;
+  }
+  if (sub === 'card') {
+    startCardEntryFlow(ctx);
+    return;
+  }
+  ctx.print('Usage: /payments [card|status]');
+}
+
+/** Card secret fields in prompt order — exported for tests that need to drive the chain field-by-field. */
+export { CARD_SECRET_FIELDS };
+
+export function registerPaymentCardCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'payments',
+    description: 'Payment card on file for daemon-initiated purchases (card entry is masked input)',
+    usage: '/payments [card]',
+    argsHint: '[card]',
+    handler(args, ctx) {
+      runPaymentsCommand(args, ctx);
+    },
+  });
+}