@sjawhar/pi-legion-envoy 1.0.0 → 1.1.0

package/README.md

@@ -104,7 +104,9 @@ Configure the shared `envoy.json` with:
 
 The user file is `~/.config/opencode/envoy.json`; a
 `<cwd>/.opencode/envoy.json` file shallow-merges over it. `DISPATCH_URL` and
-`DISPATCH_TOKEN` override the file values for one process. Omitting
+`DISPATCH_TOKEN` override the file values for one process; `DISPATCH_TOKEN_FILE`
+(a path whose trimmed contents are the token — how the Legion daemon delivers it
+to a pane) wins over both and never falls back when unreadable. Omitting
 `dispatch.serverUrl` while `dispatch.enabled` is true targets
 `http://localhost:8766`, the Go server's listen address. Invalid configuration,
 an invalid URL, or an empty token leaves the twelve tools unavailable and reports

package/dist/envoy.js

@@ -31189,7 +31189,7 @@ ${envelope.payload ?? ""}`;
 }
 
 // ../envoy-client/src/dispatch-config.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { homedir } from "os";
 import * as path from "path";
 
@@ -31198,6 +31198,21 @@ function messageFor(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// ../envoy-client/src/secret-file.ts
+import { readFileSync } from "fs";
+function readSecretFile(variable, filePath) {
+  let contents;
+  try {
+    contents = readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error)}`);
+  }
+  const value = contents.trim();
+  if (value.length === 0)
+    throw new Error(`${variable} names ${filePath}, which is empty`);
+  return value;
+}
+
 // ../envoy-client/src/dispatch-config.ts
 var DEFAULT_SERVER_URL = "http://localhost:8766";
 function normalizeDispatchUrl(url2) {
@@ -31234,7 +31249,7 @@ function describeSchemaIssue(filePath, error) {
 function readEnvoyFile(filePath) {
   let raw;
   try {
-    raw = readFileSync(filePath, "utf-8");
+    raw = readFileSync2(filePath, "utf-8");
   } catch {
     return { kind: "absent" };
   }
@@ -31267,8 +31282,22 @@ function resolveDispatchConfig(env, options = {}) {
   };
   const rawUrl = explicitUrl !== undefined ? { value: explicitUrl, source: "DISPATCH_URL" } : merged.enabled === true ? { value: merged.serverUrl ?? DEFAULT_SERVER_URL, source: "dispatch.serverUrl" } : null;
   const url2 = rawUrl ? parsedDispatchUrl(rawUrl.value, rawUrl.source) : { url: null, error: null };
-  const token = env.DISPATCH_TOKEN ?? merged.token ?? null;
-  const tokenSource = env.DISPATCH_TOKEN === undefined ? "dispatch.token" : "DISPATCH_TOKEN";
+  let token;
+  let tokenSource;
+  if (env.DISPATCH_TOKEN_FILE !== undefined) {
+    tokenSource = "DISPATCH_TOKEN_FILE";
+    try {
+      token = readSecretFile(tokenSource, env.DISPATCH_TOKEN_FILE);
+    } catch (error) {
+      return { enabled: false, url: url2.url, token: null, error: messageFor(error) };
+    }
+  } else if (env.DISPATCH_TOKEN !== undefined) {
+    tokenSource = "DISPATCH_TOKEN";
+    token = env.DISPATCH_TOKEN;
+  } else {
+    tokenSource = "dispatch.token";
+    token = merged.token ?? null;
+  }
   if (url2.error !== null)
     return { enabled: false, url: null, token, error: url2.error };
   if (url2.url === null)

package/dist/legion.js

@@ -30432,6 +30432,21 @@ function messageFor(error) {
 var import_nats2 = __toESM(require_mod4(), 1);
 import { logger as logger2 } from "@oh-my-pi/pi-utils";
 
+// ../envoy-client/src/secret-file.ts
+import { readFileSync } from "fs";
+function readSecretFile(variable, filePath) {
+  let contents;
+  try {
+    contents = readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error)}`);
+  }
+  const value = contents.trim();
+  if (value.length === 0)
+    throw new Error(`${variable} names ${filePath}, which is empty`);
+  return value;
+}
+
 // src/legion/classify.ts
 function classifySession(env) {
   if (env.LEGION_CONTROLLER !== undefined && env.LEGION_TREE !== undefined) {
@@ -30457,10 +30472,20 @@ function requiredEnvironment(env, key) {
     throw new Error(`${key} is required for Legion`);
   return value;
 }
+function requiredSecret(env, key) {
+  const fileKey = `${key}_FILE`;
+  const file = env[fileKey];
+  if (file !== undefined)
+    return readSecretFile(fileKey, file);
+  return requiredEnvironment(env, key);
+}
 function requiredControllerCapability(env) {
+  if (env.LEGION_CONTROLLER_SECRET_FILE !== undefined) {
+    return readSecretFile("LEGION_CONTROLLER_SECRET_FILE", env.LEGION_CONTROLLER_SECRET_FILE);
+  }
   const secret = env.LEGION_CONTROLLER_SECRET;
   if (!secret) {
-    throw new Error("LEGION_CONTROLLER_SECRET is required to claim the controller. " + "Launch OMP with LEGION_CONTROLLER_SECRET in its environment before running " + "/legion-claim-controller.");
+    throw new Error("LEGION_CONTROLLER_SECRET or LEGION_CONTROLLER_SECRET_FILE is required to claim the controller. " + "Launch OMP with one of them in its environment before running /legion-claim-controller.");
   }
   return secret;
 }
@@ -31612,7 +31637,7 @@ ${envelope.payload ?? ""}`;
 }
 
 // ../envoy-client/src/dispatch-config.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { homedir } from "os";
 import * as path3 from "path";
 var DEFAULT_SERVER_URL = "http://localhost:8766";
@@ -31650,7 +31675,7 @@ function describeSchemaIssue(filePath, error) {
 function readEnvoyFile(filePath) {
   let raw;
   try {
-    raw = readFileSync(filePath, "utf-8");
+    raw = readFileSync2(filePath, "utf-8");
   } catch {
     return { kind: "absent" };
   }
@@ -31683,8 +31708,22 @@ function resolveDispatchConfig(env, options = {}) {
   };
   const rawUrl = explicitUrl !== undefined ? { value: explicitUrl, source: "DISPATCH_URL" } : merged.enabled === true ? { value: merged.serverUrl ?? DEFAULT_SERVER_URL, source: "dispatch.serverUrl" } : null;
   const url2 = rawUrl ? parsedDispatchUrl(rawUrl.value, rawUrl.source) : { url: null, error: null };
-  const token = env.DISPATCH_TOKEN ?? merged.token ?? null;
-  const tokenSource = env.DISPATCH_TOKEN === undefined ? "dispatch.token" : "DISPATCH_TOKEN";
+  let token;
+  let tokenSource;
+  if (env.DISPATCH_TOKEN_FILE !== undefined) {
+    tokenSource = "DISPATCH_TOKEN_FILE";
+    try {
+      token = readSecretFile(tokenSource, env.DISPATCH_TOKEN_FILE);
+    } catch (error) {
+      return { enabled: false, url: url2.url, token: null, error: messageFor(error) };
+    }
+  } else if (env.DISPATCH_TOKEN !== undefined) {
+    tokenSource = "DISPATCH_TOKEN";
+    token = env.DISPATCH_TOKEN;
+  } else {
+    tokenSource = "dispatch.token";
+    token = merged.token ?? null;
+  }
   if (url2.error !== null)
     return { enabled: false, url: null, token, error: url2.error };
   if (url2.url === null)
@@ -33985,7 +34024,7 @@ function legionExtension(pi) {
     return createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"), fetch, {
       recoveryToken: (sessionId) => {
         if (capability !== undefined && sessionId === capability.sessionID) {
-          return requiredEnvironment(process.env, "LEGION_BOOT_TOKEN");
+          return requiredSecret(process.env, "LEGION_BOOT_TOKEN");
         }
         throw new Error(`Legion session ${sessionId} has no persisted recovery token`);
       },
@@ -34068,7 +34107,7 @@ function legionExtension(pi) {
       return;
     if (bootstrap)
       return bootstrap;
-    const bootToken = requiredEnvironment(process.env, "LEGION_BOOT_TOKEN");
+    const bootToken = requiredSecret(process.env, "LEGION_BOOT_TOKEN");
     bootstrap = (async () => {
       const { sessionFile, agentId } = await persistedTranscript(context);
       const started = await (async () => {
@@ -34135,7 +34174,7 @@ function legionExtension(pi) {
       return;
     if (bootstrap)
       return bootstrap;
-    const bootToken = requiredEnvironment(process.env, "LEGION_BOOT_TOKEN");
+    const bootToken = requiredSecret(process.env, "LEGION_BOOT_TOKEN");
     const workspace = requiredEnvironment(process.env, "LEGION_WORKSPACE");
     bootstrap = (async () => {
       const { sessionFile, agentId } = await persistedTranscript(context);

package/dist/skills/legion-controller/SKILL.md

@@ -18,8 +18,9 @@ until that PR merges, this skill's contract is not yet runnable on `main`.
 The Legion extension claims `legion-<project>-controller` and registers controller readiness
 with the daemon during session startup. Do not handle a wake unless that startup succeeded.
 
-For an interactive takeover, start OMP with `LEGION_CONTROLLER_SECRET` and
-`LEGION_DAEMON_URL` in its environment, then run:
+For an interactive takeover, start OMP with `LEGION_CONTROLLER_SECRET` (or
+`LEGION_CONTROLLER_SECRET_FILE`, a path to a file holding it) and `LEGION_DAEMON_URL` in its
+environment, then run:
 
 ```text
 /legion-claim-controller

package/dist/skills/legion-worker/SKILL.md

@@ -19,8 +19,9 @@ until that PR merges, this skill's contract is not yet runnable on `main`.
 
 The daemon spawns you as a separate `omp --mode rpc` process (behind `legion worker-shim`,
 in a tmux pane) with `LEGION_TREE`, `LEGION_ISSUE`, `LEGION_ROLE`, `LEGION_GENERATION`,
-`LEGION_BOOT_TOKEN`, `LEGION_DAEMON_URL`, `LEGION_STATE_DIR`, and `LEGION_WORKSPACE` in your
-environment (`LEGION_PROJECT` is also supplied, but nothing reads it). The extension
+`LEGION_BOOT_TOKEN_FILE` (a 0600 file under `$LEGION_STATE_DIR/secrets` holding your boot token;
+the extension reads it for you), `LEGION_DAEMON_URL`, `LEGION_STATE_DIR`, and `LEGION_WORKSPACE`
+in your environment (`LEGION_PROJECT` is also supplied, but nothing reads it). The extension
 completes the boot handshake for you at session start — it registers with the daemon, claims
 your role, and signals readiness. You never call `envoy_role_set` yourself.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
   "omp": {
     "extensions": [