clementine-agent 1.0.0

package/dist/cli/tunnel.js

@@ -0,0 +1,141 @@
+/**
+ * Clementine TypeScript — Cloudflare Tunnel Manager.
+ *
+ * Manages a cloudflared quick tunnel to expose the dashboard remotely.
+ * No Cloudflare account required — uses free quick tunnels that generate
+ * a random *.trycloudflare.com URL.
+ *
+ * Security: The tunnel only points at localhost. Combined with the
+ * dashboard's session-cookie auth, remote users must know the access
+ * token before they can see anything.
+ */
+import { spawn, execSync } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import pino from 'pino';
+const logger = pino({ name: 'clementine.tunnel' });
+export class TunnelManager extends EventEmitter {
+    process = null;
+    _url = null;
+    port;
+    restartCount = 0;
+    maxRestarts = 3;
+    stopping = false;
+    constructor(port) {
+        super();
+        this.port = port;
+    }
+    /** Check if cloudflared is installed. */
+    static isInstalled() {
+        try {
+            execSync('which cloudflared', { stdio: 'pipe' });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Get install instructions for the current platform. */
+    static getInstallInstructions() {
+        if (process.platform === 'darwin') {
+            return 'brew install cloudflared';
+        }
+        return 'See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/';
+    }
+    /** Start the tunnel. Resolves with the public URL. */
+    async start() {
+        if (this.process) {
+            throw new Error('Tunnel is already running');
+        }
+        if (!TunnelManager.isInstalled()) {
+            throw new Error(`cloudflared is not installed. Install with: ${TunnelManager.getInstallInstructions()}`);
+        }
+        this.stopping = false;
+        this.restartCount = 0;
+        return this._spawn();
+    }
+    _spawn() {
+        return new Promise((resolve, reject) => {
+            const proc = spawn('cloudflared', ['tunnel', '--url', `http://localhost:${this.port}`], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            this.process = proc;
+            let resolved = false;
+            const urlPattern = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+            const onData = (chunk) => {
+                const text = chunk.toString();
+                const match = text.match(urlPattern);
+                if (match && !resolved) {
+                    resolved = true;
+                    this._url = match[0];
+                    logger.info({ url: this._url }, 'Tunnel established');
+                    this.emit('url', this._url);
+                    resolve(this._url);
+                }
+            };
+            proc.stdout?.on('data', onData);
+            proc.stderr?.on('data', onData);
+            proc.on('close', (code) => {
+                this.process = null;
+                const oldUrl = this._url;
+                this._url = null;
+                if (!resolved) {
+                    reject(new Error(`cloudflared exited (code ${code}) before establishing tunnel`));
+                    return;
+                }
+                if (!this.stopping && this.restartCount < this.maxRestarts) {
+                    this.restartCount++;
+                    logger.warn({ attempt: this.restartCount }, 'Tunnel closed — restarting');
+                    setTimeout(() => {
+                        if (!this.stopping) {
+                            this._spawn().catch((err) => {
+                                logger.error({ err }, 'Tunnel restart failed');
+                                this.emit('error', err);
+                            });
+                        }
+                    }, 5_000);
+                }
+                else if (!this.stopping) {
+                    logger.error('Tunnel closed — max restarts exceeded');
+                    this.emit('error', new Error('Max tunnel restarts exceeded'));
+                }
+                this.emit('close', oldUrl);
+            });
+            proc.on('error', (err) => {
+                this.process = null;
+                if (!resolved) {
+                    reject(err);
+                }
+                else {
+                    this.emit('error', err);
+                }
+            });
+            // Timeout: if no URL after 30s, fail
+            setTimeout(() => {
+                if (!resolved) {
+                    resolved = true;
+                    proc.kill();
+                    reject(new Error('Tunnel startup timed out (30s)'));
+                }
+            }, 30_000);
+        });
+    }
+    /** Stop the tunnel gracefully. */
+    stop() {
+        this.stopping = true;
+        if (this.process) {
+            this.process.kill('SIGTERM');
+            this.process = null;
+            this._url = null;
+            logger.info('Tunnel stopped');
+        }
+    }
+    /** Get the current public URL (null if not running). */
+    getUrl() {
+        return this._url;
+    }
+    /** Whether the tunnel process is alive. */
+    isRunning() {
+        return this.process !== null && !this.process.killed;
+    }
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/config.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Clementine TypeScript — Configuration and paths.
+ *
+ * Reads .env into a local record — never pollutes process.env.
+ * The Claude Code SDK subprocess inherits process.env, so keeping
+ * secrets out of it prevents accidental leakage.
+ */
+import type { Models } from './types.js';
+/** Package/code root (wherever npm installed the package). */
+export declare const PKG_DIR: string;
+/** Data home — user data, vault, .env, logs, sessions. */
+export declare const BASE_DIR: string;
+export declare const VAULT_DIR: string;
+export declare const SYSTEM_DIR: string;
+export declare const DAILY_NOTES_DIR: string;
+export declare const PEOPLE_DIR: string;
+export declare const PROJECTS_DIR: string;
+export declare const TOPICS_DIR: string;
+export declare const TASKS_DIR: string;
+export declare const TEMPLATES_DIR: string;
+export declare const INBOX_DIR: string;
+export declare const PROFILES_DIR: string;
+export declare const AGENTS_DIR: string;
+export declare const SOUL_FILE: string;
+export declare const AGENTS_FILE: string;
+export declare const MEMORY_FILE: string;
+export declare const HEARTBEAT_FILE: string;
+export declare const CRON_FILE: string;
+export declare const WORKFLOWS_DIR: string;
+export declare const TASKS_FILE: string;
+export declare const DAILY_TEMPLATE: string;
+export declare const PEOPLE_TEMPLATE: string;
+export declare const PROJECTS_META_FILE: string;
+export declare const WORKING_MEMORY_FILE: string;
+export declare const IDENTITY_FILE: string;
+export declare const ASSISTANT_NAME: string;
+export declare const ASSISTANT_NICKNAME: string;
+export declare const OWNER_NAME: string;
+export declare function shellEscape(s: string): string;
+export declare const MODELS: Models;
+export declare const BUDGET: {
+    readonly heartbeat: 0.5;
+    readonly cronT1: 2;
+    readonly cronT2: 5;
+    readonly chat: 5;
+    readonly unleashedPhase: undefined;
+    readonly memoryExtraction: undefined;
+    readonly summarization: undefined;
+    readonly reflection: undefined;
+};
+export declare const DEFAULT_MODEL_TIER: keyof Models;
+export declare const MODEL: string;
+/** Enable 1M context window for Sonnet (beta). Toggle via ENABLE_1M_CONTEXT=true in .env or dashboard. */
+export declare let ENABLE_1M_CONTEXT: boolean;
+/** Update 1M context flag at runtime (called from dashboard settings API). */
+export declare function setEnable1MContext(value: boolean): void;
+export declare const DISCORD_TOKEN: string;
+export declare const DISCORD_OWNER_ID: string;
+export declare const DISCORD_WATCHED_CHANNELS: string[];
+export declare const SLACK_BOT_TOKEN: string;
+export declare const SLACK_APP_TOKEN: string;
+export declare const SLACK_OWNER_USER_ID: string;
+export declare const TELEGRAM_BOT_TOKEN: string;
+export declare const TELEGRAM_OWNER_ID: string;
+export declare const TWILIO_ACCOUNT_SID: string;
+export declare const TWILIO_AUTH_TOKEN: string;
+export declare const WHATSAPP_OWNER_PHONE: string;
+export declare const WHATSAPP_FROM_PHONE: string;
+export declare const WHATSAPP_WEBHOOK_PORT: number;
+export declare const WEBHOOK_ENABLED: boolean;
+export declare const WEBHOOK_PORT: number;
+export declare const WEBHOOK_SECRET: string;
+export declare const GROQ_API_KEY: string;
+export declare const ELEVENLABS_API_KEY: string;
+export declare const ELEVENLABS_VOICE_ID: string;
+export declare const GOOGLE_API_KEY: string;
+export declare const MS_TENANT_ID: string;
+export declare const MS_CLIENT_ID: string;
+export declare const MS_CLIENT_SECRET: string;
+export declare const MS_USER_EMAIL: string;
+export declare const SF_INSTANCE_URL: string;
+export declare const SF_CLIENT_ID: string;
+export declare const SF_CLIENT_SECRET: string;
+export declare const SF_USERNAME: string;
+export declare const SF_PASSWORD: string;
+export declare const SF_API_VERSION: string;
+export declare const ALLOW_ALL_USERS: boolean;
+/** User-configurable timezone. Falls back to system-detected timezone. */
+export declare const TIMEZONE: string;
+export declare const HEARTBEAT_INTERVAL_MINUTES: number;
+export declare const HEARTBEAT_ACTIVE_START: number;
+export declare const HEARTBEAT_ACTIVE_END: number;
+export declare const HEARTBEAT_MAX_TURNS = 5;
+export declare const HEARTBEAT_WORK_QUEUE_FILE: string;
+/** Max turns per phase in unleashed mode before checkpointing. */
+export declare const UNLEASHED_PHASE_TURNS = 75;
+/** Default max duration for unleashed tasks (hours). */
+export declare const UNLEASHED_DEFAULT_MAX_HOURS = 6;
+/** Max phases before forcing completion. */
+export declare const UNLEASHED_MAX_PHASES = 50;
+export declare const WORKSPACE_DIRS: string[];
+export declare const CHANNEL_DISCORD: boolean;
+export declare const CHANNEL_SLACK: boolean;
+export declare const CHANNEL_TELEGRAM: boolean;
+export declare const CHANNEL_WHATSAPP: boolean;
+export declare const CHANNEL_WEBHOOK: boolean;
+export declare const CHANNEL_OUTLOOK: boolean;
+export declare const CHANNEL_SALESFORCE: boolean;
+/**
+ * Validate that explicitly configured secrets actually resolved.
+ * Call at startup — throws on misconfiguration.
+ */
+export declare function validateSecrets(): string[];
+export declare const TEAM_COMMS_CHANNEL: string;
+export declare const TEAM_COMMS_LOG: string;
+export declare const LINK_EXTRACT_MAX_URLS = 3;
+export declare const LINK_EXTRACT_MAX_CHARS = 4000;
+export declare const MEMORY_DB_PATH: string;
+export declare const GRAPH_DB_DIR: string;
+export declare const SEARCH_CONTEXT_LIMIT = 3;
+export declare const SEARCH_RECENCY_LIMIT = 3;
+export declare const SYSTEM_PROMPT_MAX_CONTEXT_CHARS = 12000;
+export declare const SESSION_EXCHANGE_HISTORY_SIZE = 10;
+export declare const SESSION_EXCHANGE_MAX_CHARS = 2000;
+export declare const INJECTED_CONTEXT_MAX_CHARS = 6000;
+export declare const TEMPORAL_DECAY_HALF_LIFE_DAYS = 30;
+export declare const EPISODIC_DECAY_HALF_LIFE_DAYS = 7;
+export declare const SELF_IMPROVE_DIR: string;
+export declare const SOURCE_MODS_DIR: string;
+export declare const PENDING_SKILLS_DIR: string;
+export declare const GOALS_DIR: string;
+export declare const SEEN_CHANNELS_FILE: string;
+export declare const CRON_PROGRESS_DIR: string;
+export declare const CRON_REFLECTIONS_DIR: string;
+export declare const DELEGATIONS_DIR: string;
+export declare const HANDOFFS_DIR: string;
+export declare const PLAN_STATE_DIR: string;
+export declare const VAULT_MIGRATIONS_STATE: string;
+export declare const PLANS_DIR: string;
+export declare const ADVISOR_LOG_PATH: string;
+export declare const REMOTE_ACCESS_CONFIG: string;
+export declare const STAGING_DIR: string;
+export declare const CLAUDE_CODE_OAUTH_TOKEN: string;
+export declare const ANTHROPIC_API_KEY: string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -0,0 +1,278 @@
+/**
+ * Clementine TypeScript — Configuration and paths.
+ *
+ * Reads .env into a local record — never pollutes process.env.
+ * The Claude Code SDK subprocess inherits process.env, so keeping
+ * secrets out of it prevents accidental leakage.
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// ── Path split: code vs data ────────────────────────────────────────
+/** Package/code root (wherever npm installed the package). */
+export const PKG_DIR = path.resolve(__dirname, '..');
+/** Data home — user data, vault, .env, logs, sessions. */
+export const BASE_DIR = process.env.CLEMENTINE_HOME || path.join(os.homedir(), '.clementine');
+// ── .env parser (never sets process.env) ────────────────────────────
+function readEnvFile() {
+    const envPath = path.join(BASE_DIR, '.env');
+    if (!existsSync(envPath))
+        return {};
+    const result = {};
+    for (const line of readFileSync(envPath, 'utf-8').split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eqIndex = trimmed.indexOf('=');
+        if (eqIndex === -1)
+            continue;
+        const key = trimmed.slice(0, eqIndex);
+        let value = trimmed.slice(eqIndex + 1);
+        // Strip surrounding quotes
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        result[key] = value;
+    }
+    return result;
+}
+const env = readEnvFile();
+/** Look up a config value: local .env first, then process.env fallback. */
+function getEnv(key, fallback = '') {
+    return env[key] ?? process.env[key] ?? fallback;
+}
+// ── Paths ────────────────────────────────────────────────────────────
+export const VAULT_DIR = path.join(BASE_DIR, 'vault');
+export const SYSTEM_DIR = path.join(VAULT_DIR, '00-System');
+export const DAILY_NOTES_DIR = path.join(VAULT_DIR, '01-Daily-Notes');
+export const PEOPLE_DIR = path.join(VAULT_DIR, '02-People');
+export const PROJECTS_DIR = path.join(VAULT_DIR, '03-Projects');
+export const TOPICS_DIR = path.join(VAULT_DIR, '04-Topics');
+export const TASKS_DIR = path.join(VAULT_DIR, '05-Tasks');
+export const TEMPLATES_DIR = path.join(VAULT_DIR, '06-Templates');
+export const INBOX_DIR = path.join(VAULT_DIR, '07-Inbox');
+export const PROFILES_DIR = path.join(SYSTEM_DIR, 'profiles');
+export const AGENTS_DIR = path.join(SYSTEM_DIR, 'agents');
+export const SOUL_FILE = path.join(SYSTEM_DIR, 'SOUL.md');
+export const AGENTS_FILE = path.join(SYSTEM_DIR, 'AGENTS.md');
+export const MEMORY_FILE = path.join(SYSTEM_DIR, 'MEMORY.md');
+export const HEARTBEAT_FILE = path.join(SYSTEM_DIR, 'HEARTBEAT.md');
+export const CRON_FILE = path.join(SYSTEM_DIR, 'CRON.md');
+export const WORKFLOWS_DIR = path.join(SYSTEM_DIR, 'workflows');
+export const TASKS_FILE = path.join(TASKS_DIR, 'TASKS.md');
+export const DAILY_TEMPLATE = path.join(TEMPLATES_DIR, '_Daily-Template.md');
+export const PEOPLE_TEMPLATE = path.join(TEMPLATES_DIR, '_People-Template.md');
+export const PROJECTS_META_FILE = path.join(BASE_DIR, 'projects.json');
+export const WORKING_MEMORY_FILE = path.join(BASE_DIR, 'working-memory.md');
+export const IDENTITY_FILE = path.join(SYSTEM_DIR, 'IDENTITY.md');
+// ── Assistant identity ───────────────────────────────────────────────
+export const ASSISTANT_NAME = getEnv('ASSISTANT_NAME', 'Clementine');
+export const ASSISTANT_NICKNAME = getEnv('ASSISTANT_NICKNAME', 'Clemmy');
+export const OWNER_NAME = getEnv('OWNER_NAME');
+// ── Secrets (with macOS Keychain fallback) ───────────────────────────
+export function shellEscape(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function getSecret(envKey, keychainService) {
+    const value = env[envKey] ?? '';
+    if (value)
+        return value;
+    const service = keychainService ?? ASSISTANT_NAME.toLowerCase();
+    try {
+        const result = execSync(`security find-generic-password -s ${shellEscape(service)} -a ${shellEscape(envKey)} -w`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        return result.trim();
+    }
+    catch {
+        return '';
+    }
+}
+// ── Models ───────────────────────────────────────────────────────────
+export const MODELS = {
+    haiku: 'claude-haiku-4-5-20251001',
+    sonnet: 'claude-sonnet-4-6',
+    opus: 'claude-opus-4-6',
+};
+// ── Budget caps (USD per query) ──────────────────────────────────────
+export const BUDGET = {
+    heartbeat: 0.50, // $0.50 per heartbeat (Haiku, cheap)
+    cronT1: 2.00, // $2 per tier-1 cron job (needs room for outlook+search)
+    cronT2: 5.00, // $5 per tier-2 cron job
+    chat: 5.00, // $5 per interactive chat message
+    unleashedPhase: undefined,
+    memoryExtraction: undefined,
+    summarization: undefined,
+    reflection: undefined,
+};
+export const DEFAULT_MODEL_TIER = (getEnv('DEFAULT_MODEL_TIER', 'sonnet'));
+export const MODEL = MODELS[DEFAULT_MODEL_TIER] ?? MODELS.sonnet;
+/** Enable 1M context window for Sonnet (beta). Toggle via ENABLE_1M_CONTEXT=true in .env or dashboard. */
+export let ENABLE_1M_CONTEXT = getEnv('ENABLE_1M_CONTEXT', 'false').toLowerCase() === 'true';
+/** Update 1M context flag at runtime (called from dashboard settings API). */
+export function setEnable1MContext(value) {
+    ENABLE_1M_CONTEXT = value;
+}
+// ── Discord ──────────────────────────────────────────────────────────
+export const DISCORD_TOKEN = getSecret('DISCORD_TOKEN');
+export const DISCORD_OWNER_ID = getEnv('DISCORD_OWNER_ID', '0');
+export const DISCORD_WATCHED_CHANNELS = getEnv('DISCORD_WATCHED_CHANNELS')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+// ── Slack ────────────────────────────────────────────────────────────
+export const SLACK_BOT_TOKEN = getSecret('SLACK_BOT_TOKEN');
+export const SLACK_APP_TOKEN = getSecret('SLACK_APP_TOKEN');
+export const SLACK_OWNER_USER_ID = getEnv('SLACK_OWNER_USER_ID');
+// ── Telegram ─────────────────────────────────────────────────────────
+export const TELEGRAM_BOT_TOKEN = getSecret('TELEGRAM_BOT_TOKEN');
+export const TELEGRAM_OWNER_ID = getEnv('TELEGRAM_OWNER_ID', '0');
+// ── WhatsApp (Twilio) ────────────────────────────────────────────────
+export const TWILIO_ACCOUNT_SID = getSecret('TWILIO_ACCOUNT_SID');
+export const TWILIO_AUTH_TOKEN = getSecret('TWILIO_AUTH_TOKEN');
+export const WHATSAPP_OWNER_PHONE = getEnv('WHATSAPP_OWNER_PHONE');
+export const WHATSAPP_FROM_PHONE = getEnv('WHATSAPP_FROM_PHONE');
+export const WHATSAPP_WEBHOOK_PORT = parseInt(getEnv('WHATSAPP_WEBHOOK_PORT', '8421'), 10);
+// ── Webhook ──────────────────────────────────────────────────────────
+export const WEBHOOK_ENABLED = getEnv('WEBHOOK_ENABLED', 'false').toLowerCase() === 'true';
+export const WEBHOOK_PORT = parseInt(getEnv('WEBHOOK_PORT', '8420'), 10);
+export const WEBHOOK_SECRET = getSecret('WEBHOOK_SECRET');
+// ── Voice ────────────────────────────────────────────────────────────
+export const GROQ_API_KEY = getSecret('GROQ_API_KEY');
+export const ELEVENLABS_API_KEY = getSecret('ELEVENLABS_API_KEY');
+export const ELEVENLABS_VOICE_ID = getEnv('ELEVENLABS_VOICE_ID');
+// ── Video ────────────────────────────────────────────────────────────
+export const GOOGLE_API_KEY = getSecret('GOOGLE_API_KEY');
+// ── Outlook (Microsoft Graph) ───────────────────────────────────────
+export const MS_TENANT_ID = getEnv('MS_TENANT_ID');
+export const MS_CLIENT_ID = getEnv('MS_CLIENT_ID');
+export const MS_CLIENT_SECRET = getSecret('MS_CLIENT_SECRET');
+export const MS_USER_EMAIL = getEnv('MS_USER_EMAIL');
+// ── Salesforce CRM ─────────────────────────────────────────────────
+export const SF_INSTANCE_URL = getEnv('SF_INSTANCE_URL');
+export const SF_CLIENT_ID = getEnv('SF_CLIENT_ID');
+export const SF_CLIENT_SECRET = getSecret('SF_CLIENT_SECRET');
+export const SF_USERNAME = getEnv('SF_USERNAME');
+export const SF_PASSWORD = getSecret('SF_PASSWORD');
+export const SF_API_VERSION = getEnv('SF_API_VERSION', 'v62.0');
+// ── Security ─────────────────────────────────────────────────────────
+export const ALLOW_ALL_USERS = getEnv('ALLOW_ALL_USERS', 'false').toLowerCase() === 'true';
+// ── Timezone ─────────────────────────────────────────────────────────
+/** User-configurable timezone. Falls back to system-detected timezone. */
+export const TIMEZONE = getEnv('TIMEZONE') || Intl.DateTimeFormat().resolvedOptions().timeZone;
+// ── Heartbeat ────────────────────────────────────────────────────────
+export const HEARTBEAT_INTERVAL_MINUTES = parseInt(getEnv('HEARTBEAT_INTERVAL_MINUTES', '30'), 10) || 30;
+export const HEARTBEAT_ACTIVE_START = parseInt(getEnv('HEARTBEAT_ACTIVE_START', '8'), 10);
+export const HEARTBEAT_ACTIVE_END = parseInt(getEnv('HEARTBEAT_ACTIVE_END', '22'), 10);
+export const HEARTBEAT_MAX_TURNS = 5;
+export const HEARTBEAT_WORK_QUEUE_FILE = path.join(BASE_DIR, 'heartbeat', 'work-queue.json');
+// ── Unleashed mode ──────────────────────────────────────────────────
+/** Max turns per phase in unleashed mode before checkpointing. */
+export const UNLEASHED_PHASE_TURNS = 75;
+/** Default max duration for unleashed tasks (hours). */
+export const UNLEASHED_DEFAULT_MAX_HOURS = 6;
+/** Max phases before forcing completion. */
+export const UNLEASHED_MAX_PHASES = 50;
+// ── Workspace ───────────────────────────────────────────────────────
+export const WORKSPACE_DIRS = getEnv('WORKSPACE_DIRS')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+// ── Channel availability flags ───────────────────────────────────────
+export const CHANNEL_DISCORD = Boolean(DISCORD_TOKEN);
+export const CHANNEL_SLACK = Boolean(SLACK_BOT_TOKEN && SLACK_APP_TOKEN);
+export const CHANNEL_TELEGRAM = Boolean(TELEGRAM_BOT_TOKEN);
+export const CHANNEL_WHATSAPP = Boolean(TWILIO_ACCOUNT_SID && TWILIO_AUTH_TOKEN && WHATSAPP_OWNER_PHONE);
+export const CHANNEL_WEBHOOK = WEBHOOK_ENABLED && Boolean(WEBHOOK_SECRET);
+export const CHANNEL_OUTLOOK = Boolean(MS_TENANT_ID && MS_CLIENT_ID && MS_CLIENT_SECRET && MS_USER_EMAIL);
+export const CHANNEL_SALESFORCE = Boolean(SF_INSTANCE_URL && SF_CLIENT_ID && SF_CLIENT_SECRET);
+const SECRET_VALIDATIONS = [
+    { key: 'DISCORD_TOKEN', channel: 'Discord' },
+    { key: 'SLACK_BOT_TOKEN', channel: 'Slack', requiredWith: ['SLACK_APP_TOKEN'] },
+    { key: 'SLACK_APP_TOKEN', channel: 'Slack', requiredWith: ['SLACK_BOT_TOKEN'] },
+    { key: 'TELEGRAM_BOT_TOKEN', channel: 'Telegram' },
+    { key: 'TWILIO_ACCOUNT_SID', channel: 'WhatsApp', requiredWith: ['TWILIO_AUTH_TOKEN', 'WHATSAPP_OWNER_PHONE'] },
+    // Auth is optional here — clementine login sets CLAUDE_CODE_OAUTH_TOKEN (preferred).
+    // SDK subprocess reads CLAUDE_CODE_OAUTH_TOKEN > ANTHROPIC_AUTH_TOKEN > ANTHROPIC_API_KEY > Keychain.
+    { key: 'CLAUDE_CODE_OAUTH_TOKEN', channel: 'API (preferred — set via `clementine login`)' },
+    { key: 'ANTHROPIC_API_KEY', channel: 'API (legacy — use `clementine login` for OAuth instead)' },
+    { key: 'SF_CLIENT_SECRET', channel: 'Salesforce', requiredWith: ['SF_CLIENT_ID', 'SF_INSTANCE_URL'] },
+];
+/**
+ * Validate that explicitly configured secrets actually resolved.
+ * Call at startup — throws on misconfiguration.
+ */
+export function validateSecrets() {
+    const warnings = [];
+    for (const v of SECRET_VALIDATIONS) {
+        // Only check if the key is explicitly present in .env (not process.env fallback)
+        const explicitlyConfigured = v.key in env;
+        if (!explicitlyConfigured)
+            continue;
+        const value = getSecret(v.key);
+        if (!value) {
+            warnings.push(`${v.channel}: ${v.key} is configured in .env but resolved to empty. ` +
+                `Check your .env file or Keychain entry.`);
+        }
+        // Check companion keys
+        if (value && v.requiredWith) {
+            for (const companion of v.requiredWith) {
+                const companionValue = env[companion] ?? '';
+                // Only warn if the companion is also in .env but empty
+                if (companion in env && !companionValue) {
+                    warnings.push(`${v.channel}: ${v.key} is set but companion ${companion} is empty.`);
+                }
+            }
+        }
+    }
+    return warnings;
+}
+// ── Team ────────────────────────────────────────────────────────────
+export const TEAM_COMMS_CHANNEL = getEnv('TEAM_COMMS_CHANNEL');
+export const TEAM_COMMS_LOG = path.join(BASE_DIR, 'logs', 'team-comms.jsonl');
+// ── Link Extraction ──────────────────────────────────────────────────
+export const LINK_EXTRACT_MAX_URLS = 3;
+export const LINK_EXTRACT_MAX_CHARS = 4000;
+// ── Memory / Search ──────────────────────────────────────────────────
+export const MEMORY_DB_PATH = path.join(VAULT_DIR, '.memory.db');
+export const GRAPH_DB_DIR = path.join(BASE_DIR, '.graph.db');
+export const SEARCH_CONTEXT_LIMIT = 3;
+export const SEARCH_RECENCY_LIMIT = 3;
+export const SYSTEM_PROMPT_MAX_CONTEXT_CHARS = 12000;
+// ── Session Persistence ──────────────────────────────────────────────
+export const SESSION_EXCHANGE_HISTORY_SIZE = 10;
+export const SESSION_EXCHANGE_MAX_CHARS = 2000;
+export const INJECTED_CONTEXT_MAX_CHARS = 6000;
+// ── Search Ranking ───────────────────────────────────────────────────
+export const TEMPORAL_DECAY_HALF_LIFE_DAYS = 30;
+export const EPISODIC_DECAY_HALF_LIFE_DAYS = 7;
+// ── Self-Improvement ─────────────────────────────────────────────────
+export const SELF_IMPROVE_DIR = path.join(BASE_DIR, 'self-improve');
+export const SOURCE_MODS_DIR = path.join(SELF_IMPROVE_DIR, 'source-mods');
+export const PENDING_SKILLS_DIR = path.join(SELF_IMPROVE_DIR, 'pending-skills');
+// ── Goals & Cron Progress ───────────────────────────────────────────
+export const GOALS_DIR = path.join(BASE_DIR, 'goals');
+export const SEEN_CHANNELS_FILE = path.join(BASE_DIR, 'seen-channels.json');
+export const CRON_PROGRESS_DIR = path.join(BASE_DIR, 'cron', 'progress');
+export const CRON_REFLECTIONS_DIR = path.join(BASE_DIR, 'cron', 'reflections');
+export const DELEGATIONS_DIR = path.join(VAULT_DIR, '00-System', 'agents');
+export const HANDOFFS_DIR = path.join(BASE_DIR, 'handoffs');
+export const PLAN_STATE_DIR = path.join(BASE_DIR, 'plan-state');
+export const VAULT_MIGRATIONS_STATE = path.join(BASE_DIR, '.vault-migrations.json');
+// ── Daily Plans ─────────────────────────────────────────────────────
+export const PLANS_DIR = path.join(BASE_DIR, 'plans');
+// ── Advisor Decision Log ────────────────────────────────────────────
+export const ADVISOR_LOG_PATH = path.join(BASE_DIR, 'cron', 'advisor-decisions.jsonl');
+// ── Remote Access ──────────────────────────────────────────────────
+export const REMOTE_ACCESS_CONFIG = path.join(BASE_DIR, 'remote-access.json');
+// ── Source Self-Edit Staging ─────────────────────────────────────────
+export const STAGING_DIR = path.join(BASE_DIR, 'staging');
+// ── API ──────────────────────────────────────────────────────────────
+// Long-lived OAuth token from `clementine login` / `claude setup-token`.
+// Takes priority over ANTHROPIC_API_KEY in the SDK subprocess env.
+export const CLAUDE_CODE_OAUTH_TOKEN = getSecret('CLAUDE_CODE_OAUTH_TOKEN');
+export const ANTHROPIC_API_KEY = getSecret('ANTHROPIC_API_KEY');
+//# sourceMappingURL=config.js.map

package/dist/events/bus.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Clementine TypeScript — Event Bus.
+ *
+ * Typed pub/sub system for decoupling gateway lifecycle events from consumers.
+ * Plugins, logging, metrics, and UI can subscribe without modifying core code.
+ *
+ * Events are fire-and-forget (async handlers don't block the emitter).
+ * "before" events return a boolean — false cancels the operation.
+ */
+export type EventHandler<T = unknown> = (payload: T) => void | Promise<void>;
+export type BeforeHandler<T = unknown> = (payload: T) => boolean | Promise<boolean>;
+declare class EventBus {
+    private listeners;
+    private beforeHandlers;
+    /**
+     * Subscribe to an event. Handler is called asynchronously (fire-and-forget).
+     * Returns an unsubscribe function.
+     */
+    on<T = unknown>(event: string, handler: EventHandler<T>): () => void;
+    /** Subscribe to an event, but only fire once. */
+    once<T = unknown>(event: string, handler: EventHandler<T>): () => void;
+    /**
+     * Register a "before" handler that can cancel an operation.
+     * If any before handler returns false, the operation is cancelled.
+     */
+    before<T = unknown>(event: string, handler: BeforeHandler<T>): () => void;
+    /**
+     * Emit an event asynchronously. Handlers run in parallel, errors are logged but don't propagate.
+     */
+    emit<T = unknown>(event: string, payload: T): void;
+    /**
+     * Run "before" handlers sequentially. Returns true if all pass, false if any cancels.
+     */
+    emitBefore<T = unknown>(event: string, payload: T): Promise<boolean>;
+    /** Remove all listeners for an event, or all events if no event specified. */
+    clear(event?: string): void;
+    /** Get count of listeners for an event (useful for debugging). */
+    listenerCount(event: string): number;
+}
+/** Singleton event bus — shared across the entire process. */
+export declare const events: EventBus;
+export {};
+//# sourceMappingURL=bus.d.ts.map