aquaman-proxy 0.13.0 → 0.13.1

package/README.md

@@ -18,7 +18,7 @@ Agent / OpenClaw / Coding Agent              Aquaman Proxy
 │  No credentials.     │  proxy.sock         │                      │
 │  No open ports.      │  (chmod 0o600)      │                      │
 │  Nothing to steal.   │                     │                      │
-└──────────────────────┘                     └───┬──────────┬───────┘
+└──────────────────────┘                     └──┬──────────┬────────┘
                                                 │          │
                                                 │          ▼
                                                 │  ~/.aquaman/audit/

package/dist/cli/index.js

@@ -12,12 +12,13 @@ import { Command, Help } from 'commander';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import * as http from 'node:http';
-import { loadConfig, getConfigDir, ensureConfigDir, getDefaultConfig, expandPath, createAuditLogger, createCredentialStore, saveConfig, generateLoopbackToken, DEFAULT_LOOPBACK_PORT } from '../core/index.js';
+import { loadConfig, getConfigDir, ensureConfigDir, getDefaultConfig, expandPath, createAuditLogger, createCredentialStore, saveConfig, generateLoopbackToken, DEFAULT_LOOPBACK_PORT, wrapWithCache, resolveCacheTtl } from '../core/index.js';
 import { fileURLToPath } from 'node:url';
 import { createCredentialProxy } from '../daemon.js';
 import { createServiceRegistry, ServiceRegistry } from '../service-registry.js';
 import { createOpenClawIntegration, authProfilesAreSqliteOnly } from '../openclaw/integration.js';
 import { createHermesIntegration, detectHermes } from '../hermes/integration.js';
+import { managedScopeShadowedKeys, HERMES_MANAGED_ENV_PATH } from '../hermes/config-writer.js';
 import { loadPolicyFromConfig, validatePolicyConfig, getDefaultPolicyPresets, matchPolicy } from '../request-policy.js';
 import { stringify as yamlStringify, parse as yamlParse } from 'yaml';
 // Read version from package.json (single source of truth)
@@ -38,6 +39,49 @@ function validateCredName(label, value) {
         process.exit(1);
     }
 }
+/**
+ * Soft hint for 1Password users running in biometric/desktop-app mode: every
+ * `op` spawn prompts, which makes unattended agents unusable. The daemon cache
+ * (v0.13.1+) bounds it to one prompt per TTL per credential; a service account
+ * removes prompts entirely. Printed by `aquaman doctor` and deep doctors.
+ */
+function printOnePasswordModeHint(config, indent = '    ') {
+    if (config.credentials.backend !== '1password')
+        return;
+    if (process.env['OP_SERVICE_ACCOUNT_TOKEN'] || process.env['OP_CONNECT_HOST'])
+        return;
+    const vault = config.credentials.onePasswordVault || 'aquaman';
+    const ttl = resolveCacheTtl(config);
+    const cacheNote = ttl > 0
+        ? `the daemon cache bounds this to one per ${Math.round(ttl / 60)} min per credential`
+        : 'and the credential cache is disabled (cacheTtlSeconds: 0)';
+    console.log(`${indent}• 1Password is in biometric/desktop-app mode — each vault read prompts (${cacheNote}).`);
+    console.log(`${indent}  For zero prompts, create a service account scoped to the "${vault}" vault (create the`);
+    console.log(`${indent}  vault + credentials as a human first, or grant write_items) and start the daemon with`);
+    console.log(`${indent}  OP_SERVICE_ACCOUNT_TOKEN. If OP_CONNECT_HOST/OP_CONNECT_TOKEN are set they take precedence.`);
+}
+/**
+ * Map config.credentials onto CredentialStoreOptions — the single source for
+ * every createCredentialStore() call in this CLI. Env fallbacks mirror
+ * applyEnvOverrides() (belt and braces for callers that build partial configs).
+ */
+function storeOptionsFromConfig(config) {
+    return {
+        backend: config.credentials.backend,
+        encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
+        vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
+        vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
+        vaultNamespace: config.credentials.vaultNamespace,
+        vaultMountPath: config.credentials.vaultMountPath,
+        onePasswordVault: config.credentials.onePasswordVault,
+        onePasswordAccount: config.credentials.onePasswordAccount,
+        keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
+        keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+        bitwardenFolder: config.credentials.bitwardenFolder,
+        bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+        bitwardenCollectionId: config.credentials.bitwardenCollectionId
+    };
+}
 /**
  * Build loopback listener options from config for the daemon. Returns undefined
  * unless the loopback listener is explicitly enabled. If it's enabled but no
@@ -310,21 +354,10 @@ program
         // Vault \u2014 backend + creds
         try {
             const config = loadConfig();
-            const store = await createCredentialStore({
-                backend: config.credentials.backend,
-                encryptionPassword: config.credentials.encryptionPassword,
-                vaultAddress: config.credentials.vaultAddress,
-                vaultToken: config.credentials.vaultToken,
-                onePasswordVault: config.credentials.onePasswordVault,
-                onePasswordAccount: config.credentials.onePasswordAccount,
-                keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-                keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-                bitwardenFolder: config.credentials.bitwardenFolder,
-                bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-                bitwardenCollectionId: config.credentials.bitwardenCollectionId
-            });
+            const store = await createCredentialStore(storeOptionsFromConfig(config));
             const creds = await store.list();
             console.log(`    \u2713 ${config.credentials.backend} backend (${creds.length} credential${creds.length !== 1 ? 's' : ''})`);
+            printOnePasswordModeHint(config);
         }
         catch (err) {
             console.log(`    \u2717 Backend not accessible: ${err.message}`);
@@ -528,19 +561,7 @@ async function runVaultSetup(opts) {
     fs.mkdirSync(auditDir, { recursive: true, mode: 0o700 });
     let store;
     try {
-        store = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
-            vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
-            vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        store = await createCredentialStore(storeOptionsFromConfig(config));
     }
     catch (err) {
         console.error(`  Failed to initialize ${backend}: ${err instanceof Error ? err.message : err}`);
@@ -666,21 +687,7 @@ openclaw
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -822,21 +829,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -896,21 +889,7 @@ openclaw
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword,
-            vaultAddress: config.credentials.vaultAddress,
-            vaultToken: config.credentials.vaultToken,
-            vaultNamespace: config.credentials.vaultNamespace,
-            vaultMountPath: config.credentials.vaultMountPath,
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        credentialStore = wrapWithCache(await createCredentialStore(storeOptionsFromConfig(config)), resolveCacheTtl(config));
     }
     catch (err) {
         console.error(`Credential backend "${config.credentials.backend}" failed to initialize: ${err instanceof Error ? err.message : err}`);
@@ -1104,6 +1083,10 @@ hermes
     }
     catch { /* unreadable */ }
     console.log(`  ~/.hermes/.env:    ${envWired ? aqua('wired') : 'not wired'}  (${envPath})`);
+    const shadowed = managedScopeShadowedKeys(integration.configureHermes());
+    if (shadowed.length > 0) {
+        console.log(`  Managed scope:     ⚠ ${HERMES_MANAGED_ENV_PATH} pins ${shadowed.join(', ')} — proxy bypassed for these keys`);
+    }
     const info = await detectHermes(config.hermes?.binaryPath || 'hermes');
     console.log(`  Hermes CLI:        ${info.installed ? aqua(`v${info.version}`) : 'not found'}`);
     // Live liveness probe of the loopback listener (no token needed for _health).
@@ -1162,6 +1145,16 @@ hermes
     catch {
         fail(`Could not read ${envPath}`);
     }
+    // 3b. Hermes >=0.17 managed scope: /etc/hermes/.env overrides ~/.hermes/.env
+    {
+        const shadowed = managedScopeShadowedKeys(integration.configureHermes());
+        if (shadowed.length > 0) {
+            fail(`Hermes managed scope (${HERMES_MANAGED_ENV_PATH}) pins ${shadowed.join(', ')} — it overrides ~/.hermes/.env, so the proxy is BYPASSED for these keys. Remove them from the managed file or point them at the proxy.`);
+        }
+        else {
+            pass('No managed-scope override of aquaman env vars');
+        }
+    }
     // 4. Per-service vault credentials resolve
     const wired = integration.wiredServices();
     if (wired.length === 0) {
@@ -1169,21 +1162,7 @@ hermes
     }
     else {
         try {
-            const store = await createCredentialStore({
-                backend: config.credentials.backend,
-                encryptionPassword: config.credentials.encryptionPassword,
-                vaultAddress: config.credentials.vaultAddress,
-                vaultToken: config.credentials.vaultToken,
-                vaultNamespace: config.credentials.vaultNamespace,
-                vaultMountPath: config.credentials.vaultMountPath,
-                onePasswordVault: config.credentials.onePasswordVault,
-                onePasswordAccount: config.credentials.onePasswordAccount,
-                keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-                keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-                bitwardenFolder: config.credentials.bitwardenFolder,
-                bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-                bitwardenCollectionId: config.credentials.bitwardenCollectionId,
-            });
+            const store = await createCredentialStore(storeOptionsFromConfig(config));
             for (const svc of wired) {
                 const val = await store.get(svc, 'api_key');
                 if (val)
@@ -1191,6 +1170,7 @@ hermes
                 else
                     fail(`No credential for ${svc}/api_key — run: aquaman credentials add ${svc} api_key`);
             }
+            printOnePasswordModeHint(config, '  ');
         }
         catch (err) {
             fail(`Vault backend "${config.credentials.backend}" failed: ${err instanceof Error ? err.message : err}`);
@@ -1379,7 +1359,7 @@ openclaw
                     process.exit(1);
                 }
             }
-            catch (err) {
+            catch {
                 console.error(`  Cannot reach Vault at ${vaultAddr}.`);
                 process.exit(1);
             }
@@ -1459,19 +1439,7 @@ openclaw
     // 3. Prompt for API keys (or read from env in non-interactive mode)
     let store;
     try {
-        store = await createCredentialStore({
-            backend: config.credentials.backend,
-            encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
-            vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
-            vaultToken: config.credentials.vaultToken || process.env['VAULT_TOKEN'],
-            onePasswordVault: config.credentials.onePasswordVault,
-            onePasswordAccount: config.credentials.onePasswordAccount,
-            keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
-            bitwardenFolder: config.credentials.bitwardenFolder,
-            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
-            bitwardenCollectionId: config.credentials.bitwardenCollectionId
-        });
+        store = await createCredentialStore(storeOptionsFromConfig(config));
     }
     catch (err) {
         console.error(`  Failed to initialize ${backend} credential store: ${err instanceof Error ? err.message : err}`);