appback-remoteagent 0.13.4 → 0.13.5

package/dist/bot.js

@@ -1571,6 +1571,10 @@ function formatSecretHelp() {
         "```text",
         "node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>",
         "```",
+        "If an agent obtains a new secret value such as an OAuth refresh token, it can delegate storage without printing the value:",
+        "```text",
+        "printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>",
+        "```",
     ].join("\n");
 }
 function formatRuntimeOptions() {

package/dist/secret-helper.js

@@ -2,17 +2,28 @@
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { readSecretValue } from "./services/agent-memory-service.js";
-function main() {
+import { readSecretValue, writeSecretValue } from "./services/agent-memory-service.js";
+async function main() {
     const [command, key] = process.argv.slice(2);
-    if (command !== "get" || !key) {
-        process.stderr.write("Usage: secret-helper get <KEY>\n");
+    if (!["get", "set"].includes(command ?? "") || !key) {
+        process.stderr.write("Usage: secret-helper get <KEY>\n       secret-helper set <KEY>  # reads value from stdin\n");
         process.exitCode = 2;
         return;
     }
     const dataDir = process.env.REMOTEAGENT_DATA_DIR?.trim()
         || process.env.DATA_DIR?.trim()
         || path.join(os.homedir(), ".remoteagent");
+    if (command === "set") {
+        const value = await readStdin();
+        if (!value) {
+            process.stderr.write("Secret value was empty.\n");
+            process.exitCode = 2;
+            return;
+        }
+        writeSecretValue(dataDir, key.trim(), value);
+        process.stdout.write(`Stored secret: ${key.trim()}\n`);
+        return;
+    }
     const value = readSecretValue(dataDir, key.trim());
     if (!value) {
         process.stderr.write(`Secret was not found: ${key}\n`);
@@ -21,4 +32,11 @@ function main() {
     }
     process.stdout.write(value);
 }
-main();
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+    }
+    return Buffer.concat(chunks).toString("utf8").trim();
+}
+void main();

package/dist/services/agent-memory-service.js

@@ -338,8 +338,16 @@ export class AgentMemoryService {
                 ? ["Document index:", ...docs.map((doc) => `- ${doc.keyword}: ${doc.targetPath}${doc.note ? ` (${doc.note})` : ""}`)].join("\n")
                 : undefined,
             secrets.length > 0
-                ? ["Secret keys available through `node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>`:", ...secrets.map((key) => `- ${key}`)].join("\n")
-                : undefined,
+                ? [
+                    "Secret keys available through `node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>`:",
+                    ...secrets.map((key) => `- ${key}`),
+                    "If you generate a new secret value such as an OAuth refresh token, store it without printing it:",
+                    "`printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>`",
+                ].join("\n")
+                : [
+                    "Secrets can be stored without printing values:",
+                    "`printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>`",
+                ].join("\n"),
             artifacts.length > 0
                 ? ["Recent session artifacts:", ...artifacts.map((artifact) => `- ${artifact.id} ${artifact.kind}: ${artifact.path}`)].join("\n")
                 : undefined,
@@ -735,3 +743,32 @@ export function readSecretValue(dataDir, key) {
         return undefined;
     }
 }
+export function writeSecretValue(dataDir, key, value) {
+    if (!/^[A-Z0-9_.-]{1,80}$/.test(key)) {
+        throw new Error("Secret key must be 1-80 chars using A-Z, 0-9, dot, underscore, or dash.");
+    }
+    const filePath = path.join(dataDir, "managed", "secrets.json");
+    fsSync.mkdirSync(path.dirname(filePath), { recursive: true });
+    let secrets = {};
+    try {
+        const raw = fsSync.readFileSync(filePath, "utf8");
+        secrets = JSON.parse(raw);
+    }
+    catch {
+        secrets = {};
+    }
+    const now = new Date().toISOString();
+    secrets[key] = {
+        key,
+        value,
+        createdAt: secrets[key]?.createdAt ?? now,
+        updatedAt: now,
+    };
+    fsSync.writeFileSync(filePath, `${JSON.stringify(secrets, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    try {
+        fsSync.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Best effort only; some platforms do not support chmod.
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appback-remoteagent",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "Personal installable session server for continuing local AI work across PC and Telegram",
   "license": "MIT",
   "type": "module",