@sjawhar/pi-legion-envoy 5.5.10 → 5.6.0

package/dist/envoy.js

@@ -30517,11 +30517,8 @@ var phaseHandoffSchema = exports_external.discriminatedUnion("phase", [
 var AGENT_TOPIC_PREFIX = "notifications.agent.";
 var ROLE_TOPIC_PREFIX = "notifications.role.";
 var LEGION_NOTICE_TOPIC_PREFIX = "notifications.legion.";
-function legionNoticeSubject(project, issue2) {
-  return `${LEGION_NOTICE_TOPIC_PREFIX}${project}.${issue2}`;
-}
 function legionControllerNoticeSubject(project) {
-  return legionNoticeSubject(project, "controller");
+  return `${LEGION_NOTICE_TOPIC_PREFIX}${project}.controller`;
 }
 var DISPATCH_TOPIC_PREFIX = "notifications.dispatch.";
 var DISPATCH_ISSUE_TOPIC_PREFIX = `${DISPATCH_TOPIC_PREFIX}issue.`;
@@ -34382,6 +34379,39 @@ function subscriptionRemovedTopics(raw, sessionID) {
   return parsedPayload.data.topics ?? [];
 }
 
+// ../envoy-client/src/nats-auth.ts
+var import_nats = __toESM(require_mod4(), 1);
+var seedKeys = import_nats.nkeys;
+function natsAuthOptions(env) {
+  const { NATS_NKEY_SEED_FILE: file2, NATS_NKEY_SEED: plain } = env;
+  let seed;
+  let source;
+  if (file2 !== undefined) {
+    if (file2 === "")
+      throw new Error("NATS_NKEY_SEED_FILE is set but empty");
+    seed = readSecretFile("NATS_NKEY_SEED_FILE", file2);
+    source = `NATS_NKEY_SEED_FILE (${file2})`;
+  } else if (plain !== undefined) {
+    seed = plain.trim();
+    if (seed.length === 0)
+      throw new Error("NATS_NKEY_SEED is set but empty");
+    source = "NATS_NKEY_SEED";
+  } else {
+    return {};
+  }
+  const bytes = new TextEncoder().encode(seed);
+  let publicKey;
+  try {
+    publicKey = seedKeys.fromSeed(bytes).getPublicKey();
+  } catch (error48) {
+    throw new Error(`${source} does not hold a valid nkey seed: ${messageFor(error48)}`);
+  }
+  if (!publicKey.startsWith("U")) {
+    throw new Error(`${source} holds an nkey seed that is not a user's (public key ${publicKey})`);
+  }
+  return { authenticator: import_nats.nkeyAuthenticator(bytes) };
+}
+
 // ../envoy-client/src/tool-contract.ts
 var DELIVERY_CONTRACT = "Delivery is at-least-once, possibly out of order across topics; use id for dedupe and at for freshness.";
 var TOPIC_GUIDE = "Topic guide (all are under notifications.): agent.<session_id> (subscribe: own inbox); role.<role> " + "(publish-to; holders claim via envoy_role_set). > matches one or more trailing tokens and does not " + "match the base subject. Envoy registers the concrete base when you subscribe to <subject>.>, so " + "the recommended default remains github.<owner>.<repo>.pr.<n>.>. <owner> and <repo> are one token " + "each, with every dot in the name written _ (sjawhar/.github is github.sjawhar._github; " + "acme/site.io is github.acme.site_io), and a topic spelled with the dot receives nothing. " + "Default PR subscription: " + "github.<owner>.<repo>.pr.<n>.> (it receives the quiet PR family): pr.<n> (lifecycle: " + "opened/synchronize/closed; closed carries merged, merge_commit_sha, merged_by, head_sha), " + "pr.<n>.comment, pr.<n>.review, pr.<n>.mention, pr.<n>.checks (one head-checks settlement event: " + 'passed/failed/cancelled/skipped with failing names and URLs; re-fires with superseded_settlement: "true" ' + "when new runs appear for the same head). Other GitHub: issue.<n>, issue.<n>.comment, " + "issue.<n>.mention, mention, push.branch.<name>, push.tag.<name>, workflow.<file>.<action> (only " + "runs without an associated PR); slack.<team>.<channel>.message|mention and " + "slack.<team>.<channel>.thread.<ts>.message|mention; ghostwispr.<session>.<kind>; " + "whatsapp.<phone>.<jid>.<kind>; envoy.exceptions.<original-topic>.";
@@ -34767,7 +34797,7 @@ function sourceSession(sessionID) {
 
 // extensions/envoy.ts
 import { logger } from "@oh-my-pi/pi-utils";
-var import_nats = __toESM(require_mod4(), 1);
+var import_nats2 = __toESM(require_mod4(), 1);
 
 // src/envoy-session.ts
 import path2 from "path";
@@ -34999,7 +35029,7 @@ async function copySessionID(copyToClipboard2, sessionID) {
 }
 
 // extensions/envoy.ts
-var codec2 = import_nats.StringCodec();
+var codec2 = import_nats2.StringCodec();
 var NATS_RETRY_INTERVAL_MS = 15000;
 var CAPABILITIES_WITHOUT_BTW = DELIVERY_CAPABILITIES.filter((capability) => capability !== "btw");
 var ROLE_CLAIM_ENTRY = "envoy-role-claim";
@@ -35204,9 +35234,10 @@ function envoyExtension(pi) {
   const ensureConnection = async () => {
     if (connection?.isClosed() === false)
       return connection;
-    connection = await import_nats.connect({
+    connection = await import_nats2.connect({
       servers: [...defaults.natsUrls],
       name: `omp-${sessionID || "unknown"}`,
+      ...natsAuthOptions(process.env),
       reconnect: true,
       maxReconnectAttempts: -1,
       reconnectTimeWait: 2000

package/dist/legion.js

@@ -16136,13 +16136,63 @@ function messageFor(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// extensions/legion.ts
+// ../envoy-client/src/nats-auth.ts
 var import_nats = __toESM(require_mod4(), 1);
+
+// ../envoy-client/src/secret-file.ts
+import { readFileSync } from "fs";
+function readSecretFile(variable, filePath) {
+  let contents;
+  try {
+    contents = readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error)}`);
+  }
+  const value = contents.trim();
+  if (value.length === 0)
+    throw new Error(`${variable} names ${filePath}, which is empty`);
+  return value;
+}
+
+// ../envoy-client/src/nats-auth.ts
+var seedKeys = import_nats.nkeys;
+function natsAuthOptions(env) {
+  const { NATS_NKEY_SEED_FILE: file, NATS_NKEY_SEED: plain } = env;
+  let seed;
+  let source;
+  if (file !== undefined) {
+    if (file === "")
+      throw new Error("NATS_NKEY_SEED_FILE is set but empty");
+    seed = readSecretFile("NATS_NKEY_SEED_FILE", file);
+    source = `NATS_NKEY_SEED_FILE (${file})`;
+  } else if (plain !== undefined) {
+    seed = plain.trim();
+    if (seed.length === 0)
+      throw new Error("NATS_NKEY_SEED is set but empty");
+    source = "NATS_NKEY_SEED";
+  } else {
+    return {};
+  }
+  const bytes = new TextEncoder().encode(seed);
+  let publicKey;
+  try {
+    publicKey = seedKeys.fromSeed(bytes).getPublicKey();
+  } catch (error) {
+    throw new Error(`${source} does not hold a valid nkey seed: ${messageFor(error)}`);
+  }
+  if (!publicKey.startsWith("U")) {
+    throw new Error(`${source} holds an nkey seed that is not a user's (public key ${publicKey})`);
+  }
+  return { authenticator: import_nats.nkeyAuthenticator(bytes) };
+}
+
+// extensions/legion.ts
+var import_nats2 = __toESM(require_mod4(), 1);
 import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "5.5.10",
+  version: "5.6.0",
   type: "module",
   omp: {
     extensions: [
@@ -30590,11 +30640,8 @@ var phaseHandoffSchema = exports_external.discriminatedUnion("phase", [
 var AGENT_TOPIC_PREFIX = "notifications.agent.";
 var ROLE_TOPIC_PREFIX = "notifications.role.";
 var LEGION_NOTICE_TOPIC_PREFIX = "notifications.legion.";
-function legionNoticeSubject(project, issue2) {
-  return `${LEGION_NOTICE_TOPIC_PREFIX}${project}.${issue2}`;
-}
 function legionControllerNoticeSubject(project) {
-  return legionNoticeSubject(project, "controller");
+  return `${LEGION_NOTICE_TOPIC_PREFIX}${project}.controller`;
 }
 var DISPATCH_TOPIC_PREFIX = "notifications.dispatch.";
 var DISPATCH_ISSUE_TOPIC_PREFIX = `${DISPATCH_TOPIC_PREFIX}issue.`;
@@ -30960,21 +31007,6 @@ function zodSchemaApi(zod) {
     }
   };
 }
-// ../envoy-client/src/secret-file.ts
-import { readFileSync } from "fs";
-function readSecretFile(variable, filePath) {
-  let contents;
-  try {
-    contents = readFileSync(filePath, "utf8");
-  } catch (error48) {
-    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error48)}`);
-  }
-  const value = contents.trim();
-  if (value.length === 0)
-    throw new Error(`${variable} names ${filePath}, which is empty`);
-  return value;
-}
-
 // src/legion/classify.ts
 function classifySession(env) {
   if (env.LEGION_CONTROLLER !== undefined && env.LEGION_TREE !== undefined) {
@@ -31852,7 +31884,6 @@ async function bootstrapGoClaim(context, state) {
         secret: claim.secret
       });
       await claimEnvoyRole(sessionID, claim.claimToken, context);
-      await subscribeLegionNotice(sessionID, legionNoticeSubject(requiredEnvironment(process.env, "LEGION_PROJECT"), claim.role === "architect" ? claim.tree : claim.issue), context);
       await callGoReadyWithRetry("claims/ready", () => daemon.ready(ready));
       onEnvoyRoleRegained(async (role, reason) => {
         if (role !== claim.claimToken)
@@ -32705,7 +32736,7 @@ function legionExtension(pi) {
   const defaults = envoyDefaultsFromEnvironment(process.env);
   let controlConnection;
   let controlSubscription;
-  const controlCodec = import_nats.StringCodec();
+  const controlCodec = import_nats2.StringCodec();
   let capability;
   let bootstrap;
   const checkSubagentSession = subagentSessionCheck();
@@ -32774,9 +32805,10 @@ function legionExtension(pi) {
     if (defaults.natsUrls.length === 0) {
       throw new Error("ENVOY_NATS_URL is required for Legion control directives");
     }
-    const connection = await import_nats.connect({
+    const connection = await import_nats2.connect({
       servers: [...defaults.natsUrls],
       name: `legion-control-${sessionID}`,
+      ...natsAuthOptions(process.env),
       reconnect: true,
       maxReconnectAttempts: -1,
       reconnectTimeWait: 2000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "5.5.10",
+  "version": "5.6.0",
   "type": "module",
   "omp": {
     "extensions": [