appback-remoteagent 0.17.1 → 0.20.0

package/dist/cli.js

@@ -0,0 +1,208 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import readline from "node:readline/promises";
+import { registerTelegramBot, readConfiguredOwnerId } from "./services/cli-config-service.js";
+import { exportSecrets, importSecrets } from "./services/secret-transfer-service.js";
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0) {
+        await import("./index.js");
+        return;
+    }
+    if (["help", "--help", "-h"].includes(args[0])) {
+        printHelp();
+        return;
+    }
+    const dataDir = path.resolve(takeOption(args, "--data-dir") || process.env.DATA_DIR?.trim() || path.join(os.homedir(), ".remoteagent"));
+    const [group, action] = args;
+    if (group === "bot" && action === "add") {
+        await addBot(dataDir, args.slice(2));
+        return;
+    }
+    if (group === "secret" && action === "export") {
+        await exportSecretCommand(dataDir, args.slice(2));
+        return;
+    }
+    if (group === "secret" && action === "import") {
+        await importSecretCommand(dataDir, args.slice(2));
+        return;
+    }
+    throw new Error(`Unknown command: ${args.join(" ")}\n\nRun 'remoteagent --help' for usage.`);
+}
+async function addBot(dataDir, args) {
+    const ownerOption = takeOption(args, "--owner");
+    const tokenFile = takeOption(args, "--token-file");
+    if (args.some((arg) => arg.startsWith("--"))) {
+        throw new Error(`Unknown bot option: ${args.find((arg) => arg.startsWith("--"))}`);
+    }
+    if (tokenFile && args[0]) {
+        throw new Error("Provide the bot token either as an argument or with --token-file, not both.");
+    }
+    const token = tokenFile
+        ? await readSingleLineFile(tokenFile)
+        : args.shift() || await promptHidden("Telegram bot token: ");
+    if (args.length > 0) {
+        throw new Error(`Unexpected bot argument: ${args[0]}`);
+    }
+    const configuredOwner = await readConfiguredOwnerId(dataDir);
+    const ownerId = ownerOption || configuredOwner || await promptVisible("Telegram owner user ID: ");
+    const result = await registerTelegramBot({ dataDir, token, ownerId });
+    console.log([
+        `${result.added ? "Registered" : "Updated"} @${result.identity.username} (${result.identity.id}).`,
+        `Configured bots: ${result.botCount}`,
+        `Configuration: ${result.envPath}`,
+        "Start or restart RemoteAgent to apply it:",
+        "  remoteagent-start",
+        "  # systemd runtime: sudo systemctl restart remoteagent",
+    ].join("\n"));
+}
+async function exportSecretCommand(dataDir, args) {
+    const passphraseFile = takeOption(args, "--passphrase-file");
+    if (args.some((arg) => arg.startsWith("--"))) {
+        throw new Error(`Unknown secret export option: ${args.find((arg) => arg.startsWith("--"))}`);
+    }
+    const outputPath = args.shift() || path.resolve(`remoteagent-secrets-${formatDate(new Date())}.ra-secrets`);
+    if (args.length > 0) {
+        throw new Error(`Unexpected secret export argument: ${args[0]}`);
+    }
+    const passphrase = passphraseFile
+        ? await readSingleLineFile(passphraseFile)
+        : await promptConfirmedPassphrase();
+    const result = await exportSecrets(dataDir, outputPath, passphrase);
+    console.log([
+        `Exported ${result.count} secret(s) to ${result.outputPath}.`,
+        "The bundle is encrypted. Transfer it together with neither the passphrase nor the source secret store.",
+    ].join("\n"));
+}
+async function importSecretCommand(dataDir, args) {
+    const passphraseFile = takeOption(args, "--passphrase-file");
+    const replace = takeFlag(args, "--replace");
+    if (args.some((arg) => arg.startsWith("--"))) {
+        throw new Error(`Unknown secret import option: ${args.find((arg) => arg.startsWith("--"))}`);
+    }
+    const inputPath = args.shift();
+    if (!inputPath) {
+        throw new Error("Usage: remoteagent secret import <file> [--replace]");
+    }
+    if (args.length > 0) {
+        throw new Error(`Unexpected secret import argument: ${args[0]}`);
+    }
+    const passphrase = passphraseFile
+        ? await readSingleLineFile(passphraseFile)
+        : await promptHidden("Secret bundle passphrase: ");
+    const result = await importSecrets(dataDir, inputPath, passphrase, replace);
+    console.log([
+        `Imported ${result.imported} secret(s); overwritten=${result.overwritten}; total=${result.total}.`,
+        result.backupPath ? `Previous secret store backup: ${result.backupPath}` : "No previous secret store required a backup.",
+        "Secret values were not printed.",
+    ].join("\n"));
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0) {
+        return undefined;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    args.splice(index, 2);
+    return value;
+}
+function takeFlag(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0) {
+        return false;
+    }
+    args.splice(index, 1);
+    return true;
+}
+async function promptVisible(question) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error(`${question.trim()} is required as a command option in non-interactive mode.`);
+    }
+    const terminal = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return (await terminal.question(question)).trim();
+    }
+    finally {
+        terminal.close();
+    }
+}
+async function promptHidden(question) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY || !process.stdin.setRawMode) {
+        throw new Error("Interactive hidden input requires a TTY. Use the corresponding --*-file option instead.");
+    }
+    process.stdout.write(question);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const cleanup = () => {
+            process.stdin.off("data", onData);
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdout.write("\n");
+        };
+        const onData = (chunk) => {
+            for (const char of chunk) {
+                if (char === "\u0003") {
+                    cleanup();
+                    reject(new Error("Cancelled."));
+                    return;
+                }
+                if (char === "\r" || char === "\n") {
+                    cleanup();
+                    resolve(value);
+                    return;
+                }
+                if (char === "\u007f" || char === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += char;
+            }
+        };
+        process.stdin.on("data", onData);
+    });
+}
+async function promptConfirmedPassphrase() {
+    const first = await promptHidden("Secret bundle passphrase: ");
+    const second = await promptHidden("Confirm passphrase: ");
+    if (first !== second) {
+        throw new Error("Passphrases did not match.");
+    }
+    return first;
+}
+async function readSingleLineFile(filePath) {
+    const value = await fs.readFile(path.resolve(filePath), "utf8");
+    return value.replace(/[\r\n]+$/, "");
+}
+function formatDate(date) {
+    return date.toISOString().slice(0, 10).replace(/-/g, "");
+}
+function printHelp() {
+    console.log(`RemoteAgent CLI
+
+Usage:
+  remoteagent                         Start the foreground runtime
+  remoteagent bot add [token] [--owner <telegram-user-id>]
+  remoteagent bot add --token-file <file> --owner <telegram-user-id>
+  remoteagent secret export [file] [--passphrase-file <file>]
+  remoteagent secret import <file> [--replace] [--passphrase-file <file>]
+
+Global option:
+  --data-dir <path>                   Default: ~/.remoteagent
+
+Security:
+  Omit tokens and passphrases for hidden interactive prompts. File options are
+  intended for automation and keep sensitive values out of shell history.`);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`RemoteAgent CLI error: ${message}`);
+    process.exitCode = 1;
+});

package/dist/services/agent-memory-service.js

@@ -267,8 +267,7 @@ export class AgentMemoryService {
         return existed;
     }
     async getMacro(aliasOrIndex) {
-        const macros = Object.values(await this.readMacros())
-            .sort((left, right) => left.alias.localeCompare(right.alias, "ko"));
+        const macros = await this.getMacros();
         const trimmed = aliasOrIndex.trim();
         if (/^[0-9]+$/.test(trimmed)) {
             const index = Number.parseInt(trimmed, 10);
@@ -277,9 +276,12 @@ export class AgentMemoryService {
         const normalizedAlias = this.normalizeMacroAlias(trimmed);
         return macros.find((macro) => macro.alias === normalizedAlias);
     }
-    async listMacros() {
-        const macros = Object.values(await this.readMacros())
+    async getMacros() {
+        return Object.values(await this.readMacros())
             .sort((left, right) => left.alias.localeCompare(right.alias, "ko"));
+    }
+    async listMacros() {
+        const macros = await this.getMacros();
         if (macros.length === 0) {
             return "No macros are stored.";
         }

package/dist/services/bot-management-service.js

@@ -31,6 +31,9 @@ export class BotManagementService {
         }
         return this.formatBots(bots, await this.pollingState.list());
     }
+    async listBotChoices() {
+        return (await this.listConfiguredBots()).map(({ id, username }) => ({ id, username }));
+    }
     async formatCurrentBotSummary(currentBotId) {
         const env = await this.readEnvConfig();
         const bots = this.zipBots(env.tokens, env.usernames);

package/dist/services/bridge-service.js

@@ -181,15 +181,12 @@ export class BridgeService {
         }, chatSession.session.workspace);
     }
     async formatModelSelection(botId, chatId) {
-        const chatSession = await this.requireChat(botId, chatId);
-        const provider = chatSession.session.mode;
-        this.ensurePaired(chatSession, provider);
-        const providerSession = chatSession.session[provider];
-        const presets = MODEL_PRESETS[provider] ?? [];
+        const selection = await this.getModelSelection(botId, chatId);
+        const { provider, currentModel, presets } = selection;
         const lines = [
-            `session: ${chatSession.session.publicId}`,
+            `session: ${selection.sessionPublicId}`,
             `mode: ${provider}`,
-            `currentModel: ${providerSession.model ?? this.defaultModelFor(provider)}`,
+            `currentModel: ${currentModel}`,
             "availablePresets:",
             ...presets.map((item, index) => ` ${index + 1}. ${item}`),
             "",
@@ -200,6 +197,18 @@ export class BridgeService {
         }
         return lines.join("\n");
     }
+    async getModelSelection(botId, chatId) {
+        const chatSession = await this.requireChat(botId, chatId);
+        const provider = chatSession.session.mode;
+        this.ensurePaired(chatSession, provider);
+        const providerSession = chatSession.session[provider];
+        return {
+            sessionPublicId: chatSession.session.publicId,
+            provider,
+            currentModel: providerSession.model ?? this.defaultModelFor(provider),
+            presets: [...(MODEL_PRESETS[provider] ?? [])],
+        };
+    }
     async status(botId, chatId) {
         return this.store.getChatSession(botId, chatId);
     }

package/dist/services/cli-config-service.js

@@ -0,0 +1,154 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+export async function registerTelegramBot(options) {
+    const token = options.token.trim();
+    const ownerId = options.ownerId.trim();
+    assertBotToken(token);
+    assertOwnerId(ownerId);
+    const identity = options.identity ?? await fetchTelegramBotIdentity(token);
+    const envPath = path.join(options.dataDir, ".env");
+    const original = await fs.readFile(envPath, "utf8").catch((error) => {
+        if (error.code === "ENOENT") {
+            return "";
+        }
+        throw error;
+    });
+    const values = parseEnv(original);
+    const configuredTokens = parseCsv(values.get("TELEGRAM_BOT_TOKENS") || values.get("TELEGRAM_BOT_TOKEN") || "");
+    const configuredUsernames = parseCsv(values.get("TELEGRAM_BOT_USERNAMES") || "");
+    const validIndexes = configuredTokens
+        .map((configuredToken, index) => isBotToken(configuredToken) ? index : -1)
+        .filter((index) => index >= 0);
+    const tokens = validIndexes.map((index) => configuredTokens[index]);
+    const usernames = validIndexes.map((index) => configuredUsernames[index] || "");
+    const existingIndex = tokens.indexOf(token);
+    const usernameIndex = usernames.findIndex((value) => value.toLowerCase() === identity.username.toLowerCase());
+    if (usernameIndex >= 0 && existingIndex < 0) {
+        throw new Error(`Telegram bot @${identity.username} is already configured with another token.`);
+    }
+    const added = existingIndex < 0;
+    if (added) {
+        tokens.push(token);
+        usernames.push(identity.username);
+    }
+    else {
+        while (usernames.length < tokens.length) {
+            usernames.push("");
+        }
+        usernames[existingIndex] = identity.username;
+    }
+    const next = upsertEnv(original, {
+        TELEGRAM_BOT_TOKEN: tokens[0],
+        TELEGRAM_BOT_TOKENS: tokens.join(","),
+        TELEGRAM_BOT_USERNAMES: usernames.join(","),
+        TELEGRAM_OWNER_ID: ownerId,
+    });
+    await atomicWrite(envPath, next, 0o600);
+    return {
+        identity,
+        envPath,
+        added,
+        botCount: tokens.length,
+    };
+}
+export async function readConfiguredOwnerId(dataDir) {
+    const envPath = path.join(dataDir, ".env");
+    const text = await fs.readFile(envPath, "utf8").catch((error) => {
+        if (error.code === "ENOENT") {
+            return "";
+        }
+        throw error;
+    });
+    return parseEnv(text).get("TELEGRAM_OWNER_ID")?.trim() || undefined;
+}
+export async function fetchTelegramBotIdentity(token) {
+    assertBotToken(token);
+    let response;
+    try {
+        response = await fetch(`https://api.telegram.org/bot${token}/getMe`, {
+            signal: AbortSignal.timeout(20_000),
+        });
+    }
+    catch {
+        throw new Error("Telegram getMe request failed. Check this machine's network and DNS, then retry.");
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch {
+        throw new Error(`Telegram getMe returned an invalid response (HTTP ${response.status}).`);
+    }
+    if (!response.ok || !payload.ok || !payload.result?.id || !payload.result.username) {
+        throw new Error(payload.description || `Telegram rejected the supplied bot token (HTTP ${response.status}).`);
+    }
+    return {
+        id: payload.result.id,
+        username: payload.result.username,
+    };
+}
+function assertBotToken(token) {
+    if (!isBotToken(token)) {
+        throw new Error("Invalid Telegram bot token format.");
+    }
+}
+function isBotToken(token) {
+    return /^\d+:[A-Za-z0-9_-]{20,}$/.test(token);
+}
+function assertOwnerId(ownerId) {
+    if (!/^\d+$/.test(ownerId)) {
+        throw new Error("Telegram owner ID must contain digits only.");
+    }
+}
+function parseCsv(value) {
+    return value
+        .split(/[\r\n,]+/)
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function parseEnv(text) {
+    const result = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^([A-Z0-9_]+)=(.*)$/.exec(line);
+        if (match) {
+            result.set(match[1], match[2]);
+        }
+    }
+    return result;
+}
+function upsertEnv(text, replacements) {
+    const remaining = new Map(Object.entries(replacements));
+    const lines = text.split(/\r?\n/);
+    const output = [];
+    for (const line of lines) {
+        const match = /^([A-Z0-9_]+)=/.exec(line);
+        const key = match?.[1];
+        if (key && remaining.has(key)) {
+            output.push(`${key}=${remaining.get(key)}`);
+            remaining.delete(key);
+        }
+        else if (line || output.length > 0) {
+            output.push(line);
+        }
+    }
+    while (output.at(-1) === "") {
+        output.pop();
+    }
+    for (const [key, value] of remaining) {
+        output.push(`${key}=${value}`);
+    }
+    return `${output.join("\n")}\n`;
+}
+async function atomicWrite(filePath, content, mode) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        await fs.writeFile(tempPath, content, { encoding: "utf8", mode });
+        await fs.chmod(tempPath, mode).catch(() => undefined);
+        await fs.rename(tempPath, filePath);
+        await fs.chmod(filePath, mode).catch(() => undefined);
+    }
+    finally {
+        await fs.rm(tempPath, { force: true }).catch(() => undefined);
+    }
+}

package/dist/services/secret-transfer-service.js

@@ -0,0 +1,237 @@
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { gunzipSync, gzipSync } from "node:zlib";
+const BUNDLE_FORMAT = "remoteagent-secret-bundle";
+const BUNDLE_VERSION = 1;
+const AAD = Buffer.from(`${BUNDLE_FORMAT}:v${BUNDLE_VERSION}`, "utf8");
+export async function exportSecrets(dataDir, outputPath, passphrase, options = {}) {
+    assertPassphrase(passphrase);
+    const secretsPath = path.join(dataDir, "managed", "secrets.json");
+    const storedSecrets = await readSecrets(secretsPath, false);
+    const secrets = selectSecrets(storedSecrets, options);
+    const payload = {
+        exportedAt: new Date().toISOString(),
+        secrets,
+    };
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const key = await deriveKey(passphrase, salt);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(AAD);
+    const compressedPayload = gzipSync(Buffer.from(JSON.stringify(payload), "utf8"));
+    const encrypted = Buffer.concat([
+        cipher.update(compressedPayload),
+        cipher.final(),
+    ]);
+    const bundle = {
+        format: BUNDLE_FORMAT,
+        version: BUNDLE_VERSION,
+        compression: "gzip",
+        kdf: {
+            name: "scrypt",
+            salt: salt.toString("base64"),
+        },
+        cipher: {
+            name: "aes-256-gcm",
+            iv: iv.toString("base64"),
+            tag: cipher.getAuthTag().toString("base64"),
+        },
+        data: encrypted.toString("base64"),
+    };
+    const resolvedOutputPath = path.resolve(outputPath);
+    await atomicWrite(resolvedOutputPath, `${JSON.stringify(bundle, null, 2)}\n`, 0o600);
+    return {
+        outputPath: resolvedOutputPath,
+        count: Object.keys(secrets).length,
+    };
+}
+function selectSecrets(secrets, options) {
+    const excluded = new Set((options.excludeKeys ?? []).map((key) => key.trim().toUpperCase()).filter(Boolean));
+    const requested = (options.includeKeys ?? []).map((key) => key.trim().toUpperCase()).filter(Boolean);
+    const selected = {};
+    if (requested.length > 0) {
+        const missing = requested.filter((key) => !secrets[key]);
+        if (missing.length > 0) {
+            throw new Error(`Secret key was not found: ${missing.join(", ")}`);
+        }
+        for (const key of requested) {
+            if (!excluded.has(key)) {
+                selected[key] = secrets[key];
+            }
+        }
+    }
+    else {
+        for (const [key, record] of Object.entries(secrets)) {
+            if (!excluded.has(key)) {
+                selected[key] = record;
+            }
+        }
+    }
+    if (Object.keys(selected).length === 0) {
+        throw new Error("No Secret values remain to export.");
+    }
+    return selected;
+}
+export async function importSecrets(dataDir, inputPath, passphrase, replace = false) {
+    assertPassphrase(passphrase);
+    const resolvedInputPath = path.resolve(inputPath);
+    const bundle = parseBundle(await fs.readFile(resolvedInputPath, "utf8"));
+    const salt = decodeBase64(bundle.kdf.salt, "salt");
+    const iv = decodeBase64(bundle.cipher.iv, "iv");
+    const tag = decodeBase64(bundle.cipher.tag, "authentication tag");
+    const encrypted = decodeBase64(bundle.data, "encrypted data");
+    const key = await deriveKey(passphrase, salt);
+    let plaintext;
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAAD(AAD);
+        decipher.setAuthTag(tag);
+        plaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    }
+    catch {
+        throw new Error("Secret bundle could not be decrypted. Check the passphrase and file integrity.");
+    }
+    let decodedPayload = plaintext;
+    if (bundle.compression === "gzip") {
+        try {
+            decodedPayload = gunzipSync(plaintext);
+        }
+        catch {
+            throw new Error("Secret bundle compressed payload is invalid.");
+        }
+    }
+    const payload = parsePayload(decodedPayload.toString("utf8"));
+    const secretsPath = path.join(dataDir, "managed", "secrets.json");
+    const existing = await readSecrets(secretsPath, true);
+    const incomingKeys = Object.keys(payload.secrets);
+    const overwritten = incomingKeys.filter((keyName) => Boolean(existing[keyName])).length;
+    const merged = replace ? payload.secrets : { ...existing, ...payload.secrets };
+    let backupPath;
+    if (Object.keys(existing).length > 0) {
+        backupPath = `${secretsPath}.backup-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+        await fs.mkdir(path.dirname(backupPath), { recursive: true });
+        await fs.copyFile(secretsPath, backupPath);
+        await fs.chmod(backupPath, 0o600).catch(() => undefined);
+    }
+    await atomicWrite(secretsPath, `${JSON.stringify(merged, null, 2)}\n`, 0o600);
+    return {
+        imported: incomingKeys.length,
+        overwritten,
+        total: Object.keys(merged).length,
+        backupPath,
+    };
+}
+function parseBundle(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Secret bundle is not valid JSON.");
+    }
+    const bundle = value;
+    if (bundle.format !== BUNDLE_FORMAT
+        || bundle.version !== BUNDLE_VERSION
+        || (bundle.compression !== undefined && bundle.compression !== "gzip")
+        || bundle.kdf?.name !== "scrypt"
+        || bundle.cipher?.name !== "aes-256-gcm"
+        || typeof bundle.kdf.salt !== "string"
+        || typeof bundle.cipher.iv !== "string"
+        || typeof bundle.cipher.tag !== "string"
+        || typeof bundle.data !== "string") {
+        throw new Error("Unsupported or malformed RemoteAgent secret bundle.");
+    }
+    return bundle;
+}
+function parsePayload(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Decrypted secret payload is invalid.");
+    }
+    const payload = value;
+    if (!payload.secrets || typeof payload.secrets !== "object" || Array.isArray(payload.secrets)) {
+        throw new Error("Decrypted secret payload has no valid secret records.");
+    }
+    validateSecrets(payload.secrets);
+    return payload;
+}
+async function readSecrets(filePath, missingIsEmpty) {
+    let text;
+    try {
+        text = await fs.readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            if (missingIsEmpty) {
+                return {};
+            }
+            throw new Error(`No RemoteAgent secrets were found at ${filePath}.`);
+        }
+        throw error;
+    }
+    let secrets;
+    try {
+        secrets = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`RemoteAgent secret store is invalid JSON: ${filePath}`);
+    }
+    if (!secrets || typeof secrets !== "object" || Array.isArray(secrets)) {
+        throw new Error(`RemoteAgent secret store is malformed: ${filePath}`);
+    }
+    validateSecrets(secrets);
+    return secrets;
+}
+function validateSecrets(secrets) {
+    for (const [key, record] of Object.entries(secrets)) {
+        if (!/^[A-Z0-9_.-]{1,80}$/.test(key)
+            || !record
+            || typeof record !== "object"
+            || record.key !== key
+            || typeof record.value !== "string"
+            || typeof record.createdAt !== "string"
+            || typeof record.updatedAt !== "string") {
+            throw new Error(`Secret record is malformed: ${key}`);
+        }
+    }
+}
+function assertPassphrase(passphrase) {
+    if (passphrase.length < 8) {
+        throw new Error("Secret bundle passphrase must be at least 8 characters.");
+    }
+}
+function decodeBase64(value, label) {
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.length === 0) {
+        throw new Error(`Secret bundle ${label} is empty or invalid.`);
+    }
+    return decoded;
+}
+function deriveKey(passphrase, salt) {
+    return new Promise((resolve, reject) => {
+        scrypt(passphrase, salt, 32, (error, key) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(key);
+        });
+    });
+}
+async function atomicWrite(filePath, content, mode) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        await fs.writeFile(tempPath, content, { encoding: "utf8", mode });
+        await fs.chmod(tempPath, mode).catch(() => undefined);
+        await fs.rename(tempPath, filePath);
+        await fs.chmod(filePath, mode).catch(() => undefined);
+    }
+    finally {
+        await fs.rm(tempPath, { force: true }).catch(() => undefined);
+    }
+}

package/dist/telegram-command-menu.js

@@ -11,7 +11,7 @@ export const TELEGRAM_COMMAND_MENU = [
     { command: "attach", description: "Attach an existing provider session" },
     { command: "state", description: "Show or edit session state notes" },
     { command: "option", description: "Show or change runtime options" },
-    { command: "secret", description: "Store or manage hidden secret values" },
+    { command: "secret", description: "Store, export, or manage hidden secrets" },
     { command: "docs", description: "Pin or find session documents" },
     { command: "macro", description: "Save or run reusable instructions" },
     { command: "model", description: "Show or change provider model" },