@stagewhisper/stagewhisper 0.51.0 → 0.53.0

package/src/crypto.ts

@@ -1,203 +0,0 @@
-import { x25519 } from "@noble/curves/ed25519";
-import { xchacha20poly1305 } from "@noble/ciphers/chacha";
-import { hkdf } from "@noble/hashes/hkdf";
-import { sha256 } from "@noble/hashes/sha256";
-import { randomBytes } from "@noble/ciphers/webcrypto";
-
-export const ENVELOPE_VERSION = "static_v1";
-const ENVELOPE_HKDF_INFO = "stagewhisper-byo-envelope-v1";
-const REPLAY_GUARD_MAX_IDS = 10_000;
-
-export type SenderRole = "desktop" | "plugin";
-
-export type ContentType =
-  | "reasoning_input"
-  | "reasoning_output"
-  | "tool_intent"
-  | "tool_result"
-  | "task_content"
-  | "task_reply";
-
-export interface BYOEnvelope {
-  version: string;
-  sender_role: SenderRole;
-  message_id: string;
-  session_id: string;
-  correlation_id: string;
-  content_type: ContentType;
-  nonce: string;
-  ciphertext: string;
-}
-
-export class IdentityKeypair {
-  private secretKey: Uint8Array;
-  readonly publicKey: Uint8Array;
-
-  private constructor(secretKey: Uint8Array) {
-    this.secretKey = secretKey;
-    this.publicKey = x25519.getPublicKey(secretKey);
-  }
-
-  static generate(): IdentityKeypair {
-    const secretKey = randomBytes(32);
-    return new IdentityKeypair(secretKey);
-  }
-
-  static fromSecretBytes(bytes: Uint8Array): IdentityKeypair {
-    if (bytes.length !== 32) throw new Error(`Secret key must be 32 bytes, got ${bytes.length}`);
-    return new IdentityKeypair(bytes);
-  }
-
-  secretBytes(): Uint8Array {
-    return new Uint8Array(this.secretKey);
-  }
-
-  publicKeyBase64(): string {
-    return toBase64(this.publicKey);
-  }
-
-  static publicKeyFromBase64(b64: string): Uint8Array {
-    const bytes = fromBase64(b64);
-    if (bytes.length !== 32) throw new Error(`Public key must be 32 bytes, got ${bytes.length}`);
-    return bytes;
-  }
-
-  diffieHellman(peerPublicKey: Uint8Array): Uint8Array {
-    return x25519.getSharedSecret(this.secretKey, peerPublicKey);
-  }
-
-  deriveEnvelopeKey(peerPublicKey: Uint8Array): Uint8Array {
-    const shared = this.diffieHellman(peerPublicKey);
-    return hkdf(sha256, shared, undefined, ENVELOPE_HKDF_INFO, 32);
-  }
-}
-
-function buildAad(envelope: Omit<BYOEnvelope, "nonce" | "ciphertext">): Uint8Array {
-  const aadObj = {
-    content_type: envelope.content_type,
-    correlation_id: envelope.correlation_id,
-    message_id: envelope.message_id,
-    sender_role: envelope.sender_role,
-    session_id: envelope.session_id,
-    version: envelope.version,
-  };
-  return new TextEncoder().encode(JSON.stringify(aadObj));
-}
-
-function generateUUID(): string {
-  return crypto.randomUUID();
-}
-
-export function seal(
-  key: Uint8Array,
-  senderRole: SenderRole,
-  sessionId: string,
-  correlationId: string,
-  contentType: ContentType,
-  plaintext: Uint8Array,
-): BYOEnvelope {
-  const messageId = generateUUID();
-  const nonce = randomBytes(24);
-
-  const metadata = {
-    version: ENVELOPE_VERSION,
-    sender_role: senderRole,
-    message_id: messageId,
-    session_id: sessionId,
-    correlation_id: correlationId,
-    content_type: contentType,
-  };
-
-  const aad = buildAad(metadata);
-  const cipher = xchacha20poly1305(key, nonce, aad);
-  const ciphertext = cipher.encrypt(plaintext);
-
-  return {
-    ...metadata,
-    nonce: toBase64(nonce),
-    ciphertext: toBase64(ciphertext),
-  };
-}
-
-export function open(key: Uint8Array, envelope: BYOEnvelope): Uint8Array {
-  if (envelope.version !== ENVELOPE_VERSION) {
-    throw new Error(`Unsupported envelope version: ${envelope.version}`);
-  }
-
-  const nonce = fromBase64(envelope.nonce);
-  if (nonce.length !== 24) {
-    throw new Error(`Nonce must be 24 bytes, got ${nonce.length}`);
-  }
-
-  const ciphertext = fromBase64(envelope.ciphertext);
-  const aad = buildAad(envelope);
-  const cipher = xchacha20poly1305(key, nonce, aad);
-
-  return cipher.decrypt(ciphertext);
-}
-
-export function sealJson<T>(
-  key: Uint8Array,
-  senderRole: SenderRole,
-  sessionId: string,
-  correlationId: string,
-  contentType: ContentType,
-  value: T,
-): BYOEnvelope {
-  const plaintext = new TextEncoder().encode(JSON.stringify(value));
-  return seal(key, senderRole, sessionId, correlationId, contentType, plaintext);
-}
-
-export function openJson<T>(key: Uint8Array, envelope: BYOEnvelope): T {
-  const plaintext = open(key, envelope);
-  return JSON.parse(new TextDecoder().decode(plaintext));
-}
-
-export class ReplayGuard {
-  private seen = new Set<string>();
-  private order: string[] = [];
-
-  check(messageId: string): void {
-    if (this.seen.has(messageId)) {
-      throw new Error(`Replay detected: duplicate message_id ${messageId}`);
-    }
-    while (this.seen.size >= REPLAY_GUARD_MAX_IDS) {
-      const oldest = this.order.shift();
-      if (oldest !== undefined) {
-        this.seen.delete(oldest);
-      } else {
-        break;
-      }
-    }
-    this.seen.add(messageId);
-    this.order.push(messageId);
-  }
-}
-
-export function openChecked(
-  key: Uint8Array,
-  envelope: BYOEnvelope,
-  replayGuard: ReplayGuard,
-): Uint8Array {
-  replayGuard.check(envelope.message_id);
-  return open(key, envelope);
-}
-
-export function openJsonChecked<T>(
-  key: Uint8Array,
-  envelope: BYOEnvelope,
-  replayGuard: ReplayGuard,
-): T {
-  replayGuard.check(envelope.message_id);
-  return openJson<T>(key, envelope);
-}
-
-function toBase64(bytes: Uint8Array): string {
-  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
-  return btoa(binString);
-}
-
-function fromBase64(b64: string): Uint8Array {
-  const binString = atob(b64);
-  return Uint8Array.from(binString, (c) => c.codePointAt(0)!);
-}

package/src/health.test.ts

@@ -1,101 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { createHealthTracker } from "./health.js";
-
-describe("createHealthTracker", () => {
-  it("starts unverified", () => {
-    const tracker = createHealthTracker("gpt-4o");
-    const caps = tracker.get();
-    expect(caps.status).toBe("unverified");
-    expect(caps.supportsReasoning).toBe(true);
-    expect(caps.displayModel).toBe("gpt-4o");
-    expect(caps.consecutiveFailures).toBe(0);
-  });
-
-  it("records success and updates lastHealthyAt", () => {
-    const tracker = createHealthTracker(null);
-    tracker.recordFailure("timeout");
-    tracker.recordSuccess();
-    const caps = tracker.get();
-    expect(caps.status).toBe("healthy");
-    expect(caps.consecutiveFailures).toBe(0);
-    expect(caps.lastHealthyAt).toBeInstanceOf(Date);
-  });
-
-  it("degrades after 3 consecutive failures", () => {
-    const tracker = createHealthTracker(null);
-    tracker.recordFailure("err1");
-    tracker.recordFailure("err2");
-    expect(tracker.get().status).toBe("unverified");
-    tracker.recordFailure("err3");
-    expect(tracker.get().status).toBe("degraded");
-    expect(tracker.get().degradedReason).toBe("err3");
-  });
-
-  it("sets auth_required on 401/403 errors", () => {
-    const tracker = createHealthTracker(null);
-    tracker.recordFailure("401 Unauthorized");
-    expect(tracker.get().status).toBe("auth_required");
-  });
-
-  it("setModel updates displayModel", () => {
-    const tracker = createHealthTracker("gpt-4o");
-    tracker.setModel("claude-4");
-    expect(tracker.get().displayModel).toBe("claude-4");
-  });
-
-  it("setDisabled marks disabled", () => {
-    const tracker = createHealthTracker(null);
-    tracker.setDisabled();
-    const caps = tracker.get();
-    expect(caps.status).toBe("disabled");
-    expect(caps.supportsReasoning).toBe(false);
-  });
-
-  it("toHeartbeatPayload serializes snake_case", () => {
-    const tracker = createHealthTracker("gpt-4o");
-    tracker.recordSuccess();
-    const payload = tracker.toHeartbeatPayload();
-    expect(payload).toMatchObject({
-      supports_assistant_tasks: true,
-      supports_reasoning: true,
-      reasoning_transport: "openresponses",
-      display_model: "gpt-4o",
-      provider_ref: "openclaw",
-      status: "healthy",
-      degraded_reason: null,
-    });
-  });
-
-  it("get returns a copy, not the internal state", () => {
-    const tracker = createHealthTracker(null);
-    const caps = tracker.get();
-    caps.status = "disabled";
-    expect(tracker.get().status).toBe("unverified");
-  });
-
-  it("setDisconnected marks disconnected and setConnected restores", () => {
-    const tracker = createHealthTracker(null);
-    tracker.recordSuccess();
-    expect(tracker.get().status).toBe("healthy");
-
-    tracker.setDisconnected();
-    expect(tracker.get().status).toBe("disconnected");
-
-    tracker.setConnected();
-    expect(tracker.get().status).toBe("healthy");
-  });
-
-  it("setDisconnected does not override disabled", () => {
-    const tracker = createHealthTracker(null);
-    tracker.setDisabled();
-    tracker.setDisconnected();
-    expect(tracker.get().status).toBe("disabled");
-  });
-
-  it("setConnected is a no-op when not disconnected", () => {
-    const tracker = createHealthTracker(null);
-    tracker.recordSuccess();
-    tracker.setConnected();
-    expect(tracker.get().status).toBe("healthy");
-  });
-});

package/src/health.ts

@@ -1,94 +0,0 @@
-export type HostHealthStatus =
-  | "healthy"
-  | "degraded"
-  | "disconnected"
-  | "auth_required"
-  | "disabled"
-  | "unverified";
-
-export type HostCapabilities = {
-  supportsAssistantTasks: boolean;
-  supportsReasoning: boolean;
-  reasoningTransport: string | null;
-  displayModel: string | null;
-  providerRef: string;
-  status: HostHealthStatus;
-  degradedReason: string | null;
-  lastHealthyAt: Date | null;
-  consecutiveFailures: number;
-};
-
-const DEGRADED_THRESHOLD = 3;
-
-export function createHealthTracker(initialModel: string | null) {
-  const state: HostCapabilities = {
-    supportsAssistantTasks: true,
-    supportsReasoning: true,
-    reasoningTransport: "openresponses",
-    displayModel: initialModel,
-    providerRef: "openclaw",
-    status: "unverified",
-    degradedReason: null,
-    lastHealthyAt: null,
-    consecutiveFailures: 0,
-  };
-
-  let statusBeforeDisconnect: HostHealthStatus | null = null;
-
-  return {
-    get: (): HostCapabilities => ({ ...state }),
-
-    recordSuccess() {
-      state.consecutiveFailures = 0;
-      state.status = "healthy";
-      state.degradedReason = null;
-      state.lastHealthyAt = new Date();
-      statusBeforeDisconnect = null;
-    },
-
-    recordFailure(reason: string) {
-      state.consecutiveFailures += 1;
-      state.degradedReason = reason;
-      if (reason.includes("401") || reason.includes("403")) {
-        state.status = "auth_required";
-      } else if (state.consecutiveFailures >= DEGRADED_THRESHOLD) {
-        state.status = "degraded";
-      }
-    },
-
-    setModel(model: string) {
-      state.displayModel = model;
-    },
-
-    setDisabled() {
-      state.status = "disabled";
-      state.supportsReasoning = false;
-    },
-
-    setDisconnected() {
-      if (state.status !== "disabled") {
-        statusBeforeDisconnect = state.status;
-        state.status = "disconnected";
-      }
-    },
-
-    setConnected() {
-      if (state.status === "disconnected" && statusBeforeDisconnect !== null) {
-        state.status = statusBeforeDisconnect;
-        statusBeforeDisconnect = null;
-      }
-    },
-
-    toHeartbeatPayload(): Record<string, unknown> {
-      return {
-        supports_assistant_tasks: state.supportsAssistantTasks,
-        supports_reasoning: state.supportsReasoning,
-        reasoning_transport: state.reasoningTransport,
-        display_model: state.displayModel,
-        provider_ref: state.providerRef,
-        status: state.status,
-        degraded_reason: state.degradedReason,
-      };
-    },
-  };
-}

package/src/openresponses.ts

@@ -1,107 +0,0 @@
-import type { OpenClawPluginApi } from "openclaw/plugin-sdk/core";
-
-type GatewayConfig = { url: string; apiKey: string | null };
-
-function resolveGatewayConfig(api: OpenClawPluginApi): GatewayConfig {
-  const cfg = api.config as Record<string, unknown>;
-  const gw = (cfg?.gateway as Record<string, unknown>) ?? {};
-  const auth = (gw?.auth as Record<string, unknown>) ?? {};
-
-  const port = Number(gw?.port) || 18789;
-  const explicitUrl = typeof gw?.url === "string" ? gw.url : null;
-  const url = (explicitUrl ?? `http://127.0.0.1:${port}`).replace(/\/+$/, "");
-
-  const token = typeof auth?.token === "string" ? auth.token : null;
-
-  return { url, apiKey: token };
-}
-
-export function isResponsesEndpointEnabled(api: OpenClawPluginApi): boolean {
-  const cfg = api.config as Record<string, unknown>;
-  const gw = (cfg?.gateway as Record<string, unknown>) ?? {};
-  const http = (gw?.http as Record<string, unknown>) ?? {};
-  const endpoints = (http?.endpoints as Record<string, unknown>) ?? {};
-  const responses = (endpoints?.responses as Record<string, unknown>) ?? {};
-  return responses?.enabled === true;
-}
-
-export async function callOpenResponses(
-  api: OpenClawPluginApi,
-  requestBody: OpenResponsesCreateResponseRequestBody,
-  signal?: AbortSignal,
-  correlationId?: string,
-): Promise<OpenResponsesResponseResource> {
-  const gw = resolveGatewayConfig(api);
-  const url = `${gw.url}/v1/responses`;
-
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-  if (gw.apiKey) {
-    headers["Authorization"] = `Bearer ${gw.apiKey}`;
-  }
-  if (correlationId) {
-    headers["X-Correlation-ID"] = correlationId;
-  }
-
-  const response = await fetch(url, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(requestBody),
-    signal,
-  });
-
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    if (response.status === 404) {
-      throw new OpenResponsesError(
-        "POST /v1/responses returned 404 — the OpenResponses HTTP API is most likely disabled. " +
-        'Enable it in OpenClaw config: gateway.http.endpoints.responses.enabled = true, then restart the gateway.',
-        response.status,
-      );
-    }
-    throw new OpenResponsesError(`POST /v1/responses returned ${response.status}: ${body}`, response.status);
-  }
-  return (await response.json()) as OpenResponsesResponseResource;
-}
-
-export class OpenResponsesError extends Error {
-  constructor(
-    message: string,
-    public readonly statusCode: number,
-  ) {
-    super(message);
-    this.name = "OpenResponsesError";
-  }
-
-  get retryable(): boolean {
-    return (
-      this.statusCode === 408 ||
-      this.statusCode === 429 ||
-      (this.statusCode >= 500 && this.statusCode < 600)
-    );
-  }
-}
-
-export type { components, operations, paths, webhooks } from "../openresponses";
-
-export type OpenResponsesCreateResponseOperation =
-  import("../openresponses").operations["createResponse"];
-export type OpenResponsesCreateResponseRequestBody =
-  import("../openresponses").components["schemas"]["CreateResponseBody"];
-export type OpenResponsesResponseResource =
-  import("../openresponses").components["schemas"]["ResponseResource"];
-export type OpenResponsesRequestItem =
-  import("../openresponses").components["schemas"]["ItemParam"];
-export type OpenResponsesResponseItem =
-  import("../openresponses").components["schemas"]["ItemField"];
-export type OpenResponsesTool =
-  import("../openresponses").components["schemas"]["ResponsesToolParam"];
-export type OpenResponsesToolChoice =
-  import("../openresponses").components["schemas"]["ToolChoiceParam"];
-export type OpenResponsesTextFormat =
-  import("../openresponses").components["schemas"]["TextFormatParam"];
-export type OpenResponsesReasoning =
-  import("../openresponses").components["schemas"]["ReasoningParam"];
-export type OpenResponsesStreamEvent =
-  import("../openresponses").operations["createResponse"]["responses"][200]["content"]["text/event-stream"];

package/src/reasoning.test.ts

@@ -1,116 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { executeReasoningJob, type ReasoningJobEnvelope } from "./reasoning.js";
-import type { OpenClawPluginApi } from "openclaw/plugin-sdk/core";
-
-vi.mock("./openresponses.js", () => ({
-  callOpenResponses: vi.fn(),
-  OpenResponsesError: class extends Error {
-    status: number;
-    retryable: boolean;
-    constructor(message: string, status: number) {
-      super(message);
-      this.status = status;
-      this.retryable = status >= 500;
-    }
-  },
-}));
-
-const { callOpenResponses, OpenResponsesError } = await import("./openresponses.js");
-const mockCall = vi.mocked(callOpenResponses);
-
-function makeApi(): OpenClawPluginApi {
-  return {
-    logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
-    config: { get: vi.fn().mockReturnValue({}) },
-  } as unknown as OpenClawPluginApi;
-}
-
-function makeJob(overrides: Partial<ReasoningJobEnvelope> = {}): ReasoningJobEnvelope {
-  return {
-    event_type: "reasoning_job",
-    job_id: "job-123",
-    purpose: "live_analysis",
-    deadline_at: new Date(Date.now() + 30_000).toISOString(),
-    idempotency_key: "idem-1",
-    schema_version: 1,
-    response_schema: {
-      type: "object",
-      properties: { signals: { type: "array" } },
-      required: ["signals"],
-    },
-    payload: { transcript: "Hello world" },
-    ...overrides,
-  };
-}
-
-describe("executeReasoningJob", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("returns completed with parsed JSON output", async () => {
-    mockCall.mockResolvedValue({
-      id: "resp-abc",
-      model: "gpt-4o",
-      output: [
-        {
-          type: "message",
-          content: [
-            { type: "output_text", text: '{"signals": [{"severity": "green", "message": "ok"}]}' },
-          ],
-        },
-      ],
-      usage: { input_tokens: 100, output_tokens: 50 },
-    } as never);
-
-    const result = await executeReasoningJob(makeApi(), makeJob(), "gpt-4o");
-    expect(result.status).toBe("completed");
-    expect(result.job_id).toBe("job-123");
-    expect(result.output).toEqual({ signals: [{ severity: "green", message: "ok" }] });
-    expect(result.usage).toEqual({ input_tokens: 100, output_tokens: 50 });
-    expect(result.provider_run_id).toBe("resp-abc");
-  });
-
-  it("returns timed_out when deadline already passed", async () => {
-    const job = makeJob({ deadline_at: new Date(Date.now() - 1000).toISOString() });
-    const result = await executeReasoningJob(makeApi(), job, "gpt-4o");
-    expect(result.status).toBe("timed_out");
-    expect(result.error_code).toBe("deadline_expired_before_start");
-    expect(mockCall).not.toHaveBeenCalled();
-  });
-
-  it("returns failed when output is not valid JSON", async () => {
-    mockCall.mockResolvedValue({
-      id: "resp-bad",
-      output: [
-        { type: "message", content: [{ type: "output_text", text: "not json" }] },
-      ],
-      usage: { input_tokens: 10, output_tokens: 5 },
-    } as never);
-
-    const result = await executeReasoningJob(makeApi(), makeJob(), "gpt-4o");
-    expect(result.status).toBe("failed");
-    expect(result.error_code).toBe("response_parse_error");
-  });
-
-  it("returns failed with retryable flag on 5xx errors", async () => {
-    const err = new (OpenResponsesError as unknown as new (msg: string, status: number) => Error & { retryable: boolean })(
-      "Internal Server Error",
-      500,
-    );
-    mockCall.mockRejectedValue(err);
-
-    const result = await executeReasoningJob(makeApi(), makeJob(), "gpt-4o");
-    expect(result.status).toBe("failed");
-    expect(result.error_code).toBe("retryable_error");
-  });
-
-  it("returns failed with execution_error on non-retryable errors", async () => {
-    mockCall.mockRejectedValue(new Error("Network failure"));
-
-    const result = await executeReasoningJob(makeApi(), makeJob(), "gpt-4o");
-    expect(result.status).toBe("failed");
-    expect(result.error_code).toBe("execution_error");
-    expect(result.error_message).toBe("Network failure");
-  });
-});