@theowlops/boombot 0.0.0-stage → 1.1.0

package/dist/cli/commands/migrate.js

@@ -0,0 +1,270 @@
+/**
+ * `boombot migrate --from openclaw` — best-effort import of an OpenClaw config.
+ *
+ * Never touches the network. Never overwrites existing BoomBot files: when
+ * the target config already exists the migrated one is written next to it
+ * as `config.migrated.json`. Provider details are stored AES-256-GCM
+ * encrypted in `<dataDir>/providers.json` via `@boombot/protocol` — the
+ * same store the gateway reads (no staging files).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { createProviderService, PROVIDER_KINDS, } from '@boombot/protocol';
+import { expandTilde, resolveConfigPath, saveConfig, } from "../config-file.js";
+import { ensureMasterKey, resolveMasterKeyPath } from "../master-key.js";
+const CANDIDATE_PATHS = [
+    '~/.openclaw/openclaw.json',
+    '~/.config/openclaw/openclaw.json',
+    '~/.config/openclaw/config.json',
+    '~/.openclaw.json',
+];
+/** Best-effort search for an OpenClaw config file. Returns the path or null. */
+export function findOpenClawConfig(explicitPath) {
+    if (explicitPath !== undefined && explicitPath !== '') {
+        const p = expandTilde(explicitPath);
+        return existsSync(p) ? p : null;
+    }
+    for (const candidate of CANDIDATE_PATHS) {
+        const p = path.join(homedir(), candidate.slice(2));
+        if (existsSync(p))
+            return p;
+    }
+    return null;
+}
+/**
+ * Whether a `--from` value is acceptable: the keyword `openclaw`, an
+ * absolute path, or a `~`/`.`-prefixed path.
+ *
+ * Absolute-ness is checked against BOTH path flavors deliberately:
+ * `path.isAbsolute` follows the host platform, so on POSIX it rejects
+ * `C:\...` and on Windows it rejects `/etc/...`. Checking `path.posix`
+ * and `path.win32` explicitly accepts absolute paths from either world,
+ * which is what a CLI flag should do.
+ */
+export function isSupportedMigrateSource(from) {
+    return (from === 'openclaw' ||
+        from.startsWith('~') ||
+        from.startsWith('.') ||
+        path.posix.isAbsolute(from) ||
+        path.win32.isAbsolute(from));
+}
+function getPath(obj, dotted) {
+    let cur = obj;
+    for (const part of dotted.split('.')) {
+        if (typeof cur !== 'object' || cur === null)
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+function asNonEmptyString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+function asStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = value.filter((v) => typeof v === 'string' && v !== '');
+    return out.length > 0 ? out : undefined;
+}
+function preview(value, secret) {
+    if (!secret)
+        return value.length > 60 ? value.slice(0, 57) + '…' : value;
+    return `*** (${value.length} chars)`;
+}
+const SLOTS = [
+    { target: 'provider.kind', candidates: ['provider', 'defaultProvider', 'llm.provider', 'modelProvider'], secret: false },
+    { target: 'provider.model', candidates: ['model', 'defaultModel', 'agent.model', 'llm.model'], secret: false },
+    { target: 'provider.apiKey', candidates: ['apiKey', 'api_key', 'openaiApiKey', 'anthropicApiKey', 'googleApiKey', 'providers.openai.apiKey', 'providers.anthropic.apiKey'], secret: true },
+    { target: 'provider.baseUrl', candidates: ['baseUrl', 'baseURL', 'apiBase', 'apiBaseUrl', 'llm.baseUrl'], secret: false },
+    { target: 'telegram.botToken', candidates: ['telegram.botToken', 'telegram.token', 'telegramBotToken', 'channels.telegram.botToken'], secret: true },
+    { target: 'telegram.allowlistChatIds', candidates: ['telegram.allowlist', 'telegram.allowlistChatIds', 'telegram.allowedChatIds', 'channels.telegram.allowlist'], secret: false },
+];
+/**
+ * Map recognizable OpenClaw fields to BoomBot targets. Pure — safe to unit test.
+ * Unrecognized shapes are reported under `skipped`, never crash.
+ */
+export function mapOpenClawConfig(src) {
+    const mapped = [];
+    const skipped = [];
+    const provider = {};
+    let telegramBotToken;
+    let telegramAllowlistChatIds = [];
+    for (const slot of SLOTS) {
+        if (slot.target === 'telegram.allowlistChatIds') {
+            const allow = findAllowlist(src, slot.candidates);
+            if (allow === undefined) {
+                skipped.push(slot.target);
+            }
+            else {
+                mapped.push({ target: slot.target, source: allow.source, valuePreview: preview(allow.ids.join(','), false) });
+                telegramAllowlistChatIds = allow.ids;
+            }
+            continue;
+        }
+        let found;
+        for (const candidate of slot.candidates) {
+            const value = asNonEmptyString(getPath(src, candidate));
+            if (value !== undefined) {
+                found = { source: candidate, value };
+                break;
+            }
+        }
+        if (found === undefined) {
+            skipped.push(slot.target);
+            continue;
+        }
+        mapped.push({ target: slot.target, source: found.source, valuePreview: preview(found.value, slot.secret) });
+        switch (slot.target) {
+            case 'provider.kind':
+                provider.kind = found.value;
+                break;
+            case 'provider.model':
+                provider.model = found.value;
+                break;
+            case 'provider.apiKey':
+                provider.apiKey = found.value;
+                break;
+            case 'provider.baseUrl':
+                provider.baseUrl = found.value;
+                break;
+            case 'telegram.botToken':
+                telegramBotToken = found.value;
+                break;
+        }
+    }
+    return { mapped, skipped, provider, telegramBotToken, telegramAllowlistChatIds };
+}
+/** Allowlist may be an array or a comma-separated string. */
+function findAllowlist(src, candidates) {
+    for (const candidate of candidates) {
+        const raw = getPath(src, candidate);
+        const arr = asStringArray(raw);
+        if (arr !== undefined)
+            return { source: candidate, ids: arr };
+        const str = asNonEmptyString(raw);
+        if (str !== undefined) {
+            const ids = str.split(',').map((s) => s.trim()).filter((s) => s !== '');
+            if (ids.length > 0)
+                return { source: candidate, ids };
+        }
+    }
+    return undefined;
+}
+function uniqueTargetPath(basePath) {
+    if (!existsSync(basePath))
+        return basePath;
+    const dir = path.dirname(basePath);
+    const migrated = path.join(dir, 'config.migrated.json');
+    if (!existsSync(migrated))
+        return migrated;
+    return path.join(dir, `config.migrated.${Date.now()}.json`);
+}
+export async function runMigrateFromOpenClaw(options = {}) {
+    const warnings = [];
+    const sourcePath = findOpenClawConfig(options.from);
+    if (sourcePath === null) {
+        return {
+            sourcePath: null,
+            mapping: null,
+            configWrittenTo: null,
+            providersWrittenTo: null,
+            warnings: [
+                'no OpenClaw config found in the standard locations ' +
+                    CANDIDATE_PATHS.join(', ') +
+                    ' — pass an explicit path with `--from <path>`',
+            ],
+        };
+    }
+    let src;
+    try {
+        src = JSON.parse(readFileSync(sourcePath, 'utf8'));
+    }
+    catch (err) {
+        return {
+            sourcePath,
+            mapping: null,
+            configWrittenTo: null,
+            providersWrittenTo: null,
+            warnings: [`${sourcePath} is not valid JSON: ${err.message}`],
+        };
+    }
+    const mapping = mapOpenClawConfig(src);
+    const config = {
+        host: '127.0.0.1',
+        port: 8787,
+        dataDir: options.dataDir ?? '~/.boombot/data',
+        ...(mapping.telegramBotToken !== undefined
+            ? {
+                telegram: {
+                    botToken: mapping.telegramBotToken,
+                    allowlistChatIds: mapping.telegramAllowlistChatIds,
+                },
+            }
+            : {}),
+    };
+    const targetPath = uniqueTargetPath(options.configPath ?? resolveConfigPath());
+    if (targetPath !== (options.configPath ?? resolveConfigPath())) {
+        warnings.push(`existing config preserved — migrated config written to ${targetPath} instead`);
+    }
+    saveConfig(config, targetPath);
+    let providersWrittenTo = null;
+    const provider = mapping.provider;
+    if (provider.kind !== undefined || provider.model !== undefined || provider.apiKey !== undefined || provider.baseUrl !== undefined) {
+        // Unknown/missing kinds fall back to the generic compatible kind; the
+        // gateway probes connectivity with `provider.test` either way.
+        const kind = provider.kind !== undefined && PROVIDER_KINDS.includes(provider.kind)
+            ? provider.kind
+            : 'openai-compatible';
+        if (provider.kind !== undefined && kind !== provider.kind) {
+            warnings.push(`unknown provider kind '${provider.kind}' — imported as 'openai-compatible'`);
+        }
+        const masterKey = ensureMasterKey(options.masterKeyPath ?? resolveMasterKeyPath());
+        const service = createProviderService({
+            storagePath: path.join(expandTilde(config.dataDir), 'providers.json'),
+            masterKey,
+        });
+        await service.load();
+        await service.save({
+            name: kind,
+            kind,
+            ...(provider.baseUrl !== undefined ? { baseUrl: provider.baseUrl } : {}),
+            ...(provider.model !== undefined ? { model: provider.model } : {}),
+            ...(provider.apiKey !== undefined ? { apiKey: provider.apiKey } : {}),
+        });
+        providersWrittenTo = path.join(expandTilde(config.dataDir), 'providers.json');
+    }
+    else {
+        warnings.push('no provider fields recognized — configure one with `boombot setup`');
+    }
+    if (provider.apiKey === undefined) {
+        warnings.push('no API key found in the OpenClaw config — you will need to paste it during `boombot setup`');
+    }
+    return { sourcePath, mapping, configWrittenTo: targetPath, providersWrittenTo, warnings };
+}
+/** Print the mapped/skipped table. */
+export function printMigrateReport(report) {
+    if (report.sourcePath === null || report.mapping === null) {
+        for (const w of report.warnings)
+            console.log(`warning: ${w}`);
+        return;
+    }
+    console.log(`source: ${report.sourcePath}\n`);
+    console.log('mapped:');
+    for (const m of report.mapping.mapped) {
+        console.log(`  ${m.target}  <-  ${m.source}  (${m.valuePreview})`);
+    }
+    if (report.mapping.skipped.length > 0) {
+        console.log('\nskipped (not found in source):');
+        for (const s of report.mapping.skipped)
+            console.log(`  ${s}`);
+    }
+    console.log('');
+    if (report.configWrittenTo !== null)
+        console.log(`wrote BoomBot config: ${report.configWrittenTo}`);
+    if (report.providersWrittenTo !== null) {
+        console.log(`wrote encrypted provider store: ${report.providersWrittenTo}`);
+    }
+    for (const w of report.warnings)
+        console.log(`warning: ${w}`);
+}

package/dist/cli/commands/plugin.js

@@ -0,0 +1,97 @@
+/**
+ * `boombot plugin` — install, uninstall, list plugins dynamically at runtime.
+ *
+ * install sources:
+ *   boombot plugin install browser          → marketplace alias
+ *   boombot plugin install boombot.browser  → full marketplace id
+ *   boombot plugin install /path/to/dir     → local directory
+ *   boombot plugin install https://github.com/org/repo → git clone
+ *   boombot plugin install npm:@scope/pkg   → npm package
+ *
+ * uninstall:
+ *   boombot plugin uninstall boombot.browser
+ *
+ * list:
+ *   boombot plugin list
+ *   boombot plugin list --marketplace
+ */
+import path from 'node:path';
+import { expandTilde } from "../config-file.js";
+import { loadConfig } from "../config-file.js";
+import { PluginInstaller } from '@boombot/plugins';
+const DEFAULT_DATA_DIR = '~/.boombot/data';
+function resolvePluginRoot() {
+    try {
+        const config = loadConfig();
+        const dataDir = expandTilde(config?.dataDir ?? DEFAULT_DATA_DIR);
+        return path.join(dataDir, '..', 'plugins');
+    }
+    catch {
+        return path.join(expandTilde(DEFAULT_DATA_DIR), '..', 'plugins');
+    }
+}
+export async function runPluginList(opts) {
+    if (opts.marketplace) {
+        const catalog = PluginInstaller.getMarketplace();
+        console.log(`\nPlugin Marketplace (${catalog.length} available):\n`);
+        for (const p of catalog) {
+            const tags = p.tags.join(', ');
+            console.log(`  ${p.id.padEnd(30)} v${p.version.padEnd(8)} ${p.description}`);
+            console.log(`    Tags: ${tags}\n`);
+        }
+        return;
+    }
+    const root = resolvePluginRoot();
+    const installed = await PluginInstaller.listInstalled(root);
+    if (installed.length === 0) {
+        console.log('\nNo plugins installed.');
+        console.log('Run `boombot plugin install <name>` to get started.');
+        console.log('Run `boombot plugin list --marketplace` to browse available plugins.\n');
+        return;
+    }
+    console.log(`\nInstalled Plugins (${installed.length}):\n`);
+    for (const p of installed) {
+        const status = p.isValid ? '✓' : '✗';
+        console.log(`  ${status} ${p.id.padEnd(30)} v${p.version.padEnd(8)} ${p.displayName ?? ''}`);
+        if (p.description)
+            console.log(`    ${p.description}`);
+        if (!p.isValid && p.error)
+            console.log(`    [Error] ${p.error}`);
+    }
+    console.log();
+}
+export async function runPluginInstall(spec, force = false) {
+    if (!spec) {
+        console.error('[plugin install] Usage: boombot plugin install <name|path|url>');
+        return 1;
+    }
+    const root = resolvePluginRoot();
+    console.log(`Installing plugin '${spec}'...`);
+    const result = await PluginInstaller.install(spec, { root, force });
+    if (result.ok) {
+        console.log(`✓ ${result.message}`);
+        console.log(`  Restart the gateway to load the plugin: pm2 restart boombot`);
+    }
+    else {
+        console.error(`✗ ${result.message}`);
+        return 1;
+    }
+    return 0;
+}
+export async function runPluginUninstall(pluginId) {
+    if (!pluginId) {
+        console.error('[plugin uninstall] Usage: boombot plugin uninstall <plugin-id>');
+        return 1;
+    }
+    const root = resolvePluginRoot();
+    const result = await PluginInstaller.uninstall(pluginId, { root });
+    if (result.ok) {
+        console.log(`✓ ${result.message}`);
+        console.log(`  Restart the gateway to unload: pm2 restart boombot`);
+    }
+    else {
+        console.error(`✗ ${result.message}`);
+        return 1;
+    }
+    return 0;
+}

package/dist/cli/commands/setup.js

@@ -0,0 +1,230 @@
+/**
+ * `boombot setup` — interactive first-run wizard (node:readline/promises).
+ *
+ * Walks through host/port, data dir, API key generation (printed ONCE),
+ * master-key generation (encrypts provider API keys at rest), optional
+ * Telegram pairing, and the default provider. The provider is stored
+ * AES-256-GCM encrypted in `<dataDir>/providers.json` via
+ * `@boombot/protocol` — the same store the gateway reads, so the key the
+ * user pastes once is immediately usable (no staging files).
+ */
+import path from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { createProviderService, PROVIDER_KINDS } from '@boombot/protocol';
+import { ensureApiKey } from "../api-key.js";
+import { expandTilde, loadConfig, resolveConfigPath, saveConfig, validateConfig, } from "../config-file.js";
+import { ensureMasterKey, resolveMasterKeyPath } from "../master-key.js";
+export function parsePort(raw, fallback) {
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return fallback;
+    const parsed = Number.parseInt(trimmed, 10);
+    return Number.isInteger(parsed) && parsed >= 1 && parsed <= 65535 ? parsed : fallback;
+}
+export function parseAllowlist(raw) {
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s !== '');
+}
+async function ask(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return await rl.question(question);
+    }
+    finally {
+        rl.close();
+    }
+}
+async function askDefault(question, def) {
+    const answer = await ask(`${question} [${def}]: `);
+    return answer.trim() === '' ? def : answer.trim();
+}
+async function askRequired(question) {
+    for (;;) {
+        const answer = (await ask(question)).trim();
+        if (answer !== '')
+            return answer;
+        console.log('This value is required.');
+    }
+}
+async function askYesNo(question, def) {
+    const hint = def ? 'Y/n' : 'y/N';
+    const answer = (await ask(`${question} [${hint}]: `)).trim().toLowerCase();
+    if (answer === '')
+        return def;
+    return answer === 'y' || answer === 'yes';
+}
+/** Read a secret with echo disabled (masked). Falls back to plain ask when not a TTY. */
+async function readSecret(prompt) {
+    if (!process.stdin.isTTY) {
+        return (await ask(prompt)).trim();
+    }
+    return new Promise((resolve) => {
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw === true;
+        stdin.setRawMode(true);
+        stdin.resume();
+        let value = '';
+        const done = (result) => {
+            stdin.off('data', onData);
+            stdin.setRawMode(wasRaw);
+            stdin.pause();
+            process.stdout.write('\n');
+            if (result === null)
+                process.exit(130);
+            resolve(result);
+        };
+        const onData = (data) => {
+            for (const ch of data.toString('utf8')) {
+                if (ch === '\r' || ch === '\n' || ch === '\u0004') {
+                    done(value);
+                    return;
+                }
+                if (ch === '\u0003') {
+                    done(null); // Ctrl+C
+                    return;
+                }
+                if (ch === '\u007f' || ch === '\b') {
+                    value = value.slice(0, -1);
+                }
+                else if (ch >= ' ' || ch === '\t') {
+                    value += ch;
+                }
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
+async function readRequiredSecret(prompt) {
+    for (;;) {
+        const answer = (await readSecret(prompt)).trim();
+        if (answer !== '')
+            return answer;
+        console.log('This value is required.');
+    }
+}
+function isProviderKind(value) {
+    return PROVIDER_KINDS.includes(value);
+}
+/**
+ * Ask for a provider kind. Empty input skips provider setup entirely
+ * (returns `null`); anything else must be a known kind.
+ */
+async function askProviderKind() {
+    for (;;) {
+        const raw = (await ask(`Provider kind (${PROVIDER_KINDS.join('/')}) [empty = skip]: `))
+            .trim()
+            .toLowerCase();
+        if (raw === '')
+            return null;
+        if (isProviderKind(raw))
+            return raw;
+        console.log(`Unknown kind '${raw}'. Choose one of: ${PROVIDER_KINDS.join(', ')}.`);
+    }
+}
+/** Host as typed for the browser: 0.0.0.0/:: mean "this machine". Exported for tests. */
+export function browserHost(host) {
+    return host === '0.0.0.0' || host === '::' ? '127.0.0.1' : host;
+}
+export async function runSetup() {
+    console.log('🦉 BoomBot setup\n');
+    const existing = loadConfig();
+    const host = await askDefault('Gateway host', existing?.host ?? '127.0.0.1');
+    const defaultPort = existing?.port ?? 8787;
+    const port = parsePort(await ask(`Gateway port [${defaultPort}]: `), defaultPort);
+    const dataDir = await askDefault('Data directory', existing?.dataDir ?? '~/.boombot/data');
+    // API key — kept at <config-dir>/api.key (0600) so it stays recoverable; the
+    // config only ever holds its sha256. An existing key is reused, never rotated.
+    const { apiKey, apiKeyHash, keyPath, created, fromEnv } = ensureApiKey();
+    if (fromEnv) {
+        console.log('\nUsing the API key from BOOMBOT_API_KEY (no key file written).\n');
+    }
+    else if (created) {
+        console.log('\n────────────────────────────────────────');
+        console.log('Your gateway API key (save it somewhere safe):');
+        console.log(`\n  ${apiKey}\n`);
+        console.log(`Also stored at ${keyPath} (mode 0600) — \`boombot gateway\` reads it from`);
+        console.log('there and signs your browser in automatically, so you can ignore this');
+        console.log('notice. Only the sha256 hash is written to config.json.');
+        console.log('────────────────────────────────────────\n');
+    }
+    else {
+        console.log(`\nKeeping the existing gateway API key from ${keyPath}.`);
+        console.log('(delete that file and re-run setup to rotate it)\n');
+    }
+    // Master key — encrypts provider API keys at rest. The gateway needs it
+    // as BOOMBOT_MASTER_KEY; `boombot gateway` loads this file automatically.
+    const masterKeyPath = resolveMasterKeyPath();
+    const masterKey = process.env['BOOMBOT_MASTER_KEY'] || ensureMasterKey(masterKeyPath);
+    console.log(`Master key for provider encryption: ${masterKeyPath}`);
+    console.log('(mode 0600 — it decrypts your provider keys, keep it safe)\n');
+    // Telegram (optional).
+    let telegram = existing?.telegram;
+    if (await askYesNo('Configure Telegram bot?', false)) {
+        const botToken = await readSecret('Telegram bot token: ');
+        const allowlist = parseAllowlist(await ask('Allowlisted chat IDs (comma-separated, empty = none): '));
+        telegram = { botToken: botToken.trim(), allowlistChatIds: allowlist };
+    }
+    // Default provider → the real encrypted store (<dataDir>/providers.json),
+    // the same store the gateway reads. The key is pasted once, masked, and
+    // never written in plaintext anywhere.
+    let providerSaved = false;
+    if (await askYesNo('Configure a default LLM provider?', true)) {
+        const kind = await askProviderKind();
+        if (kind !== null) {
+            const model = await askRequired('Default model: ');
+            const needsBaseUrl = kind === 'openai-compatible' || kind === 'local';
+            const baseUrl = needsBaseUrl
+                ? await askRequired('Base URL (required for this provider kind): ')
+                : (await ask('Base URL (empty = provider default): ')).trim();
+            const providerApiKey = kind === 'local'
+                ? (await readSecret('Provider API key (empty = none): ')).trim()
+                : await readRequiredSecret('Provider API key: ');
+            const service = createProviderService({
+                storagePath: path.join(expandTilde(dataDir), 'providers.json'),
+                masterKey,
+            });
+            await service.load();
+            const saved = await service.save({
+                name: kind,
+                kind,
+                ...(baseUrl !== '' ? { baseUrl } : {}),
+                model,
+                ...(providerApiKey !== '' ? { apiKey: providerApiKey } : {}),
+                active: true,
+            });
+            providerSaved = true;
+            const keyNote = providerApiKey !== '' ? ' — API key stored encrypted' : ' — no API key stored';
+            console.log(`\nSaved default provider '${saved.name}' (${saved.kind})${keyNote}.`);
+        }
+    }
+    const config = {
+        ...existing,
+        host,
+        port,
+        dataDir,
+        apiKeyHash,
+        ...(telegram !== undefined ? { telegram } : {}),
+    };
+    const problems = validateConfig(config);
+    if (problems.length > 0) {
+        console.error(`\nInvalid config: ${problems.join('; ')}`);
+        process.exitCode = 1;
+        return;
+    }
+    const configPath = resolveConfigPath();
+    saveConfig(config, configPath);
+    const permsNote = process.platform === 'win32'
+        ? 'permissions NOT enforced on Windows (chmod is a no-op) — see SECURITY.md §5'
+        : 'mode 0600 — secrets protected';
+    console.log(`\nSaved config to ${configPath} (${permsNote}).`);
+    const url = `http://${browserHost(host)}:${port}`;
+    console.log('\nNext steps:');
+    console.log(`  1. boombot gateway   # start the gateway — opens ${url} in your browser`);
+    console.log('  2. boombot doctor    # health check, if anything looks off');
+    if (!providerSaved) {
+        console.log('  (tip: re-run `boombot setup` any time to add a default provider)');
+    }
+}