dexterm-cli 0.1.6 → 0.1.7

package/dist/packages/autotrade/src/chat/notify.js

@@ -0,0 +1,292 @@
+// dexterm autotrade chat — tier 1, notify (task-1527, AUTOTRADE-SPEC §8.4, §8.6).
+//
+// The bus reads the run ledger as it is written (every event the runner already records) and the runner's state,
+// and turns them into short plain-text messages, each led by its badge (PAPER / DEVNET / LIVE):
+//   candidate found      a digest every 15 minutes (default), each one, or off
+//   entry / exit         side, size ($ and % of the book), price, profile, exit reason, the agent's reason (inert)
+//   trade closed         the PnL card image (when the host can render it) + one line
+//   halts and guards     state, reason, what clears it (kill, stop, flatten, pause, breaker, stuck bag, guard)
+//   spend / allowance    once a day each, at 80 % of the day's model spend cap or of a usage window
+//   daily summary        at dailySummaryAt local: trades, wins/losses, day P/L %, open positions, spend, state,
+//                        approvals (tapped / skipped / expired)
+// Shown: badge, symbol (inert), short mint, strategy id/version/short hash, the trade's size and % of the book, P/L
+// in % (and $ per trade), day P/L in %. Hidden: keys, the token, wallet addresses, the absolute book (opt-in for
+// paper only), file paths, RPC URLs.
+// Rate: above 20 messages a minute the bus switches to digests (notify-only lines wait for the next flush); quiet
+// hours hold notify-only lines too. Halts always go. The engine never waits on any of this.
+import { localDay as localDayOf } from "./audit.js";
+import { inQuietHours } from "./config.js";
+import { inert, pct, price, shortMint, usdShort } from "./format.js";
+export const DIGEST_EVERY_MS = 15 * 60_000;
+export const DIGEST_ABOVE_PER_MIN = 20;
+const HALT_CLEARS = {
+    'kill-switch': 'the panic switch is on: only `dexterm wallet resume` on your computer lifts it',
+    stop: 'this run takes no new entries and ends once nothing is held; start a new run on your computer',
+    flatten: 'every position sells at its next tick, then this run ends',
+    'control-unreadable': 'the control file cannot be read: look at it on your computer',
+    'runner-stopped': 'stopped on your computer',
+    'daily-loss': 'the daily loss limit: entries stay off for the rest of the day; it clears locally',
+    drawdown: 'the drawdown limit: entries stay off; it clears locally',
+};
+export class NotifyBus {
+    o;
+    now;
+    symbols = new Map();
+    reasons = new Map();
+    profiles = new Map();
+    fillsByPosition = new Map();
+    candidates = [];
+    digest = [];
+    lastDigestAt;
+    sentAt = [];
+    queue = Promise.resolve();
+    state = null;
+    strategyLine = '';
+    /** task-1532: the run's strategy carries the HIGH RISK label (the yolo preset): every entry and the start say so. */
+    highRisk = false;
+    day = '';
+    dayStats = { closed: 0, wins: 0, losses: 0, pnlUsd: 0 };
+    warned = new Set();
+    summarySentFor = '';
+    dayStart;
+    constructor(o) {
+        this.o = o;
+        this.now = o.now ?? Date.now;
+        this.lastDigestAt = this.now();
+        this.dayStart = () => { const d = new Date(this.now()); d.setHours(0, 0, 0, 0); return d.getTime(); };
+    }
+    /** Every run ledger event, as it is written. Never throws, never blocks the runner. */
+    onEvent(e) {
+        try {
+            this.handle(e);
+        }
+        catch { /* a notify failure never reaches the engine */ }
+    }
+    onState(st) {
+        this.state = st;
+        this.strategyLine = `${this.highRisk ? '⚠ HIGH RISK · ' : ''}${inert(st.strategy.id, 32)} v${inert(st.strategy.version, 12)} (${st.strategy.hash.slice(0, 8)})`;
+        this.spendWarnings(st);
+    }
+    prefs() { return this.o.config().notify; }
+    rollDay() {
+        const d = localDayOf(this.now());
+        if (d !== this.day) {
+            this.day = d;
+            this.dayStats = { closed: 0, wins: 0, losses: 0, pnlUsd: 0 };
+            this.warned = new Set();
+        }
+    }
+    emit(template, lines, urgent = false) {
+        this.post(template, { kind: 'text', badge: this.o.badge, lines }, urgent);
+    }
+    post(template, msg, urgent) {
+        const now = this.now();
+        while (this.sentAt.length && now - this.sentAt[0] > 60_000)
+            this.sentAt.shift();
+        const quiet = inQuietHours(this.o.config().quietHours, now);
+        if (!urgent && (quiet || this.sentAt.length >= DIGEST_ABOVE_PER_MIN)) {
+            this.digest.push(msg.kind === 'card' ? msg.caption : msg.lines.join(' · '));
+            return;
+        }
+        this.sentAt.push(now);
+        this.queue = this.queue.then(() => this.o.send(msg, { urgent, template })).catch(() => { });
+    }
+    /** Book share of a size, as text ("2.0% of book"). The absolute book only when opted in (paper). */
+    ofBook(usd) {
+        const eq = this.state?.book.equityUsd ?? 0;
+        const share = eq > 0 ? `${((usd / eq) * 100).toFixed(1)}% of book` : '% of book unknown';
+        return this.o.config().showAbsoluteBook && this.o.badge === 'PAPER' && eq > 0 ? `${share}, book ${usdShort(eq)}` : share;
+    }
+    sym(mint, fallback) { return `"${inert(this.symbols.get(mint) ?? fallback ?? '?', 20)}" ${shortMint(mint)}`; }
+    handle(e) {
+        this.rollDay();
+        const p = this.prefs();
+        const mint = typeof e.mint === 'string' ? e.mint : '';
+        switch (e.kind) {
+            case 'run_start': {
+                this.highRisk = e.highRisk === true;
+                this.strategyLine = `${this.highRisk ? '⚠ HIGH RISK · ' : ''}${inert(e.strategy, 32)} v${inert(e.version, 12)} (${String(e.strategyHash ?? '').slice(0, 8)})`;
+                this.emit('run_start', [`RUNNER STARTED · ${this.strategyLine}`, ...(this.highRisk ? ['full-port strategy: one entry can be the whole stake, and one rug can zero it. Experimental; not financial advice.'] : []), `entries: ${e.decide === 'agent+approve' || e.approvals === 'required' ? 'each one waits for your tap' : String(e.decide) === 'auto' ? 'mechanical' : 'your agent decides'} · /status /pause /kill /help`], true);
+                return;
+            }
+            case 'candidate': {
+                this.symbols.set(mint, String(e.symbol ?? '?'));
+                if (p.candidates === 'off')
+                    return;
+                const line = `${this.sym(mint, e.symbol)} matched ${Array.isArray(e.matched) ? e.matched.map((m) => inert(m, 24)).join(', ') : '?'}`;
+                if (p.candidates === 'each')
+                    this.emit('candidate', [`CANDIDATE · ${line}`]);
+                else
+                    this.candidates.push(line);
+                return;
+            }
+            case 'reply': {
+                const d = e.decision;
+                if (mint && d?.ok && d.decision?.reason)
+                    this.reasons.set(mint, d.decision.reason);
+                return;
+            }
+            case 'fill': {
+                const side = e.side === 'buy' ? 'buy' : 'sell';
+                if (typeof e.positionId === 'string') {
+                    const fs = this.fillsByPosition.get(e.positionId) ?? [];
+                    fs.push({ t: e.t, side, usd: Number(e.usd), tokens: Number(e.tokens) });
+                    this.fillsByPosition.set(e.positionId, fs);
+                }
+                if (side === 'buy') {
+                    if (typeof e.profile === 'string')
+                        this.profiles.set(mint, e.profile);
+                    if (!p.entries)
+                        return;
+                    const why = this.reasons.get(mint);
+                    this.emit('entry', [
+                        `${e.reason === 'ladder-add' ? 'ADD' : 'ENTRY'} · ${this.strategyLine}`,
+                        `${this.sym(mint)} · ${usdShort(Number(e.usd))} (${this.ofBook(Number(e.usd))}) @ ${price(Number(e.price))}${e.impactPct !== undefined ? ` · impact ${Number(e.impactPct).toFixed(2)}%` : ''}${e.partial ? ' · PARTIAL' : ''}`,
+                        ...(typeof e.profile === 'string' ? [`profile ${inert(e.profile, 32)}`] : []),
+                        ...(why && e.reason !== 'ladder-add' ? [`why (the agent's words): "${inert(why, 280, 'agent')}"`] : []),
+                    ]);
+                }
+                else {
+                    if (!p.entries)
+                        return;
+                    this.emit('exit', [`${e.reason === 'cost-recovery' ? 'COST RECOVERED' : 'EXIT'} · ${this.sym(mint)}`, `sold ${usdShort(Number(e.usd))} @ ${price(Number(e.price))} · ${inert(e.reason, 40)}${typeof e.detail === 'string' ? ` · ${inert(e.detail, 120)}` : ''}`]);
+                }
+                return;
+            }
+            case 'trade_closed': {
+                const t0 = e.trade;
+                if (!t0)
+                    return;
+                const t = { ...t0, fills: this.fillsByPosition.get(t0.id) ?? [] };
+                this.fillsByPosition.delete(t0.id);
+                this.dayStats.closed++;
+                this.dayStats.pnlUsd += t.pnlUsd;
+                if (t.pnlUsd >= 0)
+                    this.dayStats.wins++;
+                else
+                    this.dayStats.losses++;
+                this.symbols.delete(t.mint);
+                this.reasons.delete(t.mint);
+                if (!p.closes)
+                    return;
+                const caption = `CLOSED · "${inert(t.symbol, 20)}" ${shortMint(t.mint)} · ${pct(t.pnlPct)} (${t.pnlUsd >= 0 ? '+' : ''}${usdShort(t.pnlUsd)}) by ${inert(t.exitReason, 40)} · held ${Math.max(1, Math.round((t.closedAt - t.openedAt) / 60_000))} min`;
+                const card = this.o.card;
+                if (!card) {
+                    this.emit('closed', [caption]);
+                    return;
+                }
+                void card(t).then((png) => {
+                    if (png)
+                        this.post('closed_card', { kind: 'card', badge: this.o.badge, png, caption }, false);
+                    else
+                        this.emit('closed', [caption]);
+                }, () => this.emit('closed', [caption]));
+                return;
+            }
+            case 'halt': {
+                if (!p.halts)
+                    return;
+                const r = String(e.reason ?? '?');
+                this.emit('halt', [`HALT · ${inert(r, 40)}`, HALT_CLEARS[r] ?? 'clears locally', `open positions keep their exits${typeof e.openPositions === 'number' ? ` (${e.openPositions} open)` : ''}`], true);
+                return;
+            }
+            case 'flatten': {
+                const n = Array.isArray(e.positions) ? e.positions.length : 0;
+                this.emit('flatten', [`FLATTEN · ${n} position${n === 1 ? '' : 's'} sell at the next tick`], true);
+                return;
+            }
+            case 'entries_paused':
+                if (p.halts)
+                    this.emit('paused', [`PAUSED · no new entries (${inert(e.reason, 40)})`, 'exits keep running · /resume lifts a pause'], true);
+                return;
+            case 'entries_resumed':
+                if (p.halts)
+                    this.emit('resumed', ['RESUMED · new entries allowed again'], true);
+                return;
+            case 'guard':
+                if (p.halts)
+                    this.emit('guard', [`GUARD · ${inert(e.state, 40)}`, inert(e.effect, 160)], true);
+                return;
+            case 'stuck':
+                if (p.halts)
+                    this.emit('stuck', [`STUCK · ${this.sym(mint)} cannot sell (${inert(e.why, 60)})`, 'retried every tick'], true);
+                return;
+            case 'stopped_flat':
+                this.emit('stopped', ['RUNNER STOPPED · nothing held'], true);
+                return;
+            case 'run_end':
+                this.emit('run_end', [`RUNNER ENDED · ${Number(e.trades ?? 0)} closed, ${Number(e.openAtEnd ?? 0)} open`], true);
+                return;
+            default: return;
+        }
+    }
+    spendWarnings(st) {
+        if (!this.prefs().spend)
+            return;
+        this.rollDay();
+        const s = st.spend;
+        if (Number.isFinite(s.dayCapUsd) && s.dayCapUsd > 0 && s.todayUsd >= 0.8 * s.dayCapUsd && !this.warned.has('spend')) {
+            this.warned.add('spend');
+            this.emit('spend', [`SPEND · model spend today ${Math.round((s.todayUsd / s.dayCapUsd) * 100)}% of the day cap`, 'new sessions stop at the cap; exits keep running'], true);
+        }
+        for (const [k, v] of [['five-hour', s.allowance?.fiveHour], ['seven-day', s.allowance?.sevenDay]]) {
+            if (typeof v === 'number' && v >= 0.8 && !this.warned.has(k)) {
+                this.warned.add(k);
+                this.emit('allowance', [`USAGE · your ${k} Claude window is at ${Math.round(v * 100)}%`], true);
+            }
+        }
+    }
+    /** Digests, the daily summary. The host calls it every few seconds; tests call it with a moved clock. */
+    async tick() {
+        const now = this.now();
+        this.rollDay();
+        if (this.candidates.length && now - this.lastDigestAt >= DIGEST_EVERY_MS) {
+            const n = this.candidates.length;
+            const lines = this.candidates.splice(0, n);
+            this.emit('candidate_digest', [`CANDIDATES · ${n} in the last ${Math.round((now - this.lastDigestAt) / 60_000)} min`, ...lines.slice(0, 10), ...(n > 10 ? [`…and ${n - 10} more`] : [])]);
+            this.lastDigestAt = now;
+        }
+        else if (!this.candidates.length && now - this.lastDigestAt >= DIGEST_EVERY_MS)
+            this.lastDigestAt = now;
+        const quiet = inQuietHours(this.o.config().quietHours, now);
+        while (this.sentAt.length && now - this.sentAt[0] > 60_000)
+            this.sentAt.shift();
+        if (this.digest.length && !quiet && this.sentAt.length < DIGEST_ABOVE_PER_MIN / 2) {
+            const lines = this.digest.splice(0);
+            this.post('digest', { kind: 'text', badge: this.o.badge, lines: [`DIGEST · ${lines.length} update${lines.length === 1 ? '' : 's'}`, ...lines.slice(-25)] }, true);
+        }
+        this.maybeSummary(now);
+        await this.queue;
+    }
+    maybeSummary(now) {
+        const at = this.o.config().dailySummaryAt;
+        if (!at || !this.prefs().daily)
+            return;
+        const [h, m] = at.split(':').map(Number);
+        const d = new Date(now);
+        if (d.getHours() * 60 + d.getMinutes() < h * 60 + m)
+            return;
+        const day = localDayOf(now);
+        if (this.summarySentFor === day)
+            return;
+        this.summarySentFor = day;
+        this.post('daily', { kind: 'text', badge: this.o.badge, lines: this.summaryLines() }, true);
+    }
+    summaryLines() {
+        const st = this.state;
+        const ds = this.dayStats;
+        const start = st ? st.book.equityUsd - st.book.realizedTodayUsd : 0;
+        const dayPct = st && start > 0 ? (st.book.realizedTodayUsd / start) * 100 : null;
+        const ap = this.o.approvalCounts?.(this.dayStart()) ?? null;
+        const apLine = ap && Object.keys(ap).length ? `approvals: ${Object.entries(ap).map(([k, v]) => `${v} ${k.toLowerCase()}`).join(', ')}` : null;
+        return [
+            `DAILY SUMMARY · ${this.strategyLine || 'no run'}`,
+            `trades closed ${ds.closed} (${ds.wins} won, ${ds.losses} lost) · day P/L ${pct(dayPct)}`,
+            `open positions ${st?.positions.length ?? 0} · state ${st ? `${st.state}${st.haltReason ? ` (${inert(st.haltReason, 40)})` : ''}` : 'unknown'}`,
+            `model spend today ${st ? `$${st.spend.todayUsd.toFixed(2)}${Number.isFinite(st.spend.dayCapUsd) ? ` of $${st.spend.dayCapUsd}` : ''}` : '?'}`,
+            ...(apLine ? [apLine] : []),
+        ];
+    }
+    /** Wait for everything queued (end of the host). */
+    async flush() { await this.queue; }
+}

package/dist/packages/autotrade/src/chat/pairing.js

@@ -0,0 +1,46 @@
+// dexterm autotrade chat — pairing by a local code (task-1527, AUTOTRADE-SPEC §8.3).
+//
+// `dexterm telegram pair` shows a 6-digit code on the local screen that lives 5 minutes. The user sends
+// `/pair <code>` to their bot from their own account in a PRIVATE chat. The code travels through Telegram, so a
+// token holder with a competing poll can read it (and swallow the user's message): a correct code is therefore not
+// enough. Pairing refuses while a webhook or a 409 conflict is seen, and the account that sent the code (its
+// @username and id) is shown on the local screen for a y/N before that sender id + chat id go on the allowlist
+// (telegram-cmd.ts). The code is single use, compared in constant time, and five wrong tries end the window.
+import { randomInt, timingSafeEqual } from 'node:crypto';
+export const PAIR_TTL_MS = 5 * 60_000;
+export const PAIR_MAX_TRIES = 5;
+export class PairingWindow {
+    code;
+    expiresAt;
+    tries = 0;
+    done = false;
+    now;
+    constructor(o = {}) {
+        this.now = o.now ?? Date.now;
+        this.code = o.code ?? String(randomInt(0, 1_000_000)).padStart(6, '0');
+        this.expiresAt = this.now() + (o.ttlMs ?? PAIR_TTL_MS);
+    }
+    get open() { return !this.done && this.tries < PAIR_MAX_TRIES && this.now() < this.expiresAt; }
+    /** Close the window for good (someone else holds the token): the code never pairs anyone after this. */
+    abort() { this.done = true; return { ok: false, why: 'conflict' }; }
+    attempt(senderId, chatId, chatKind, args) {
+        if (this.done)
+            return { ok: false, why: 'used' };
+        if (this.tries >= PAIR_MAX_TRIES)
+            return { ok: false, why: 'locked' };
+        if (this.now() >= this.expiresAt)
+            return { ok: false, why: 'expired' };
+        if (chatKind !== 'private')
+            return { ok: false, why: 'group-chat' };
+        const given = (args[0] ?? '').replace(/\D/g, '');
+        if (!given)
+            return { ok: false, why: 'no-code' };
+        this.tries++;
+        const a = Buffer.from(given.padStart(6, '0').slice(-6));
+        const b = Buffer.from(this.code);
+        if (given.length !== 6 || !timingSafeEqual(a, b))
+            return { ok: false, why: this.tries >= PAIR_MAX_TRIES ? 'locked' : 'wrong-code' };
+        this.done = true;
+        return { ok: true, senderId, chatId };
+    }
+}

package/dist/packages/autotrade/src/chat/redact.js

@@ -0,0 +1,48 @@
+// dexterm autotrade chat — the token redactor (task-1527, AUTOTRADE-SPEC §8.3).
+//
+// A bot token is `<digits>:<35 url-safe chars>`, and the Bot API URL carries it (`/bot<token>/sendMessage`): the
+// classic leak is an error message that quotes the URL. Every log line, audit line, ledger field, health string
+// and thrown error from the chat layer passes through redact(). Tests throw a fetch error carrying the URL and
+// look for the token in every sink.
+// The colon may arrive as `:`, `%3A` (a URL inside a URL) or `:` (JSON-escaped).
+const COLON = '(?::|%3[Aa]|\\\\u003[Aa])';
+const URL_FORM = new RegExp(`bot\\d{3,}${COLON}[A-Za-z0-9_-]{20,}`, 'g');
+const BARE_FORM = new RegExp(`\\b\\d{3,}${COLON}[A-Za-z0-9_-]{30,}`, 'g');
+export const REDACTED = 'bot<redacted>';
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * The text with every bot token (in a URL or bare) replaced. With the known token (always pass it when you have it)
+ * also: the token URL-encoded, the secret half alone, the bot id followed by any part of the secret (a truncated
+ * echo), and the first 12 characters of the secret anywhere.
+ */
+export function redact(text, known) {
+    let s = typeof text === 'string' ? text : text instanceof Error ? `${text.name}: ${text.message}` : String(text);
+    if (known && known.length >= 8) {
+        for (const form of [known, encodeURIComponent(known)])
+            s = s.split(form).join('<redacted>');
+        const i = known.indexOf(':');
+        const id = i > 0 ? known.slice(0, i) : '';
+        const half = i > 0 ? known.slice(i + 1) : '';
+        if (half.length >= 16) {
+            s = s.split(half).join('<redacted>');
+            if (/^\d+$/.test(id))
+                s = s.replace(new RegExp(`${id}${COLON}[A-Za-z0-9_-]+`, 'g'), '<redacted>');
+            s = s.replace(new RegExp(`${escapeRe(half.slice(0, 12))}[A-Za-z0-9_-]*`, 'g'), '<redacted>');
+        }
+    }
+    return s.replace(URL_FORM, REDACTED).replace(BARE_FORM, '<redacted>');
+}
+/** True when the string looks like a bot token (the setup prompt's check). */
+export const looksLikeBotToken = (s) => /^\d{6,}:[A-Za-z0-9_-]{30,}$/.test(s.trim());
+/** An Error whose message (and cause chain) has been redacted; the original is dropped, never attached. */
+export function redactedError(e, known) {
+    const parts = [];
+    let cur = e;
+    for (let i = 0; cur && i < 3; i++) {
+        parts.push(redact(cur instanceof Error ? cur.message : cur, known));
+        cur = cur instanceof Error ? cur.cause : null;
+    }
+    const out = new Error(parts.join(' <- ').slice(0, 300));
+    out.name = 'ChatTransportError';
+    return out;
+}

package/dist/packages/autotrade/src/chat/secrets.js

@@ -0,0 +1,99 @@
+// dexterm autotrade chat — where the bot token lives (task-1527, AUTOTRADE-SPEC §8.3).
+//
+// The token never goes in connectors.json, a log, argv or the environment. Stores, best first:
+//   keychain   macOS: the login keychain through `security`. The token goes in on STDIN (`security -i` reads the
+//              add command from a pipe), never on the command line, so `ps` cannot see it.
+//   libsecret  Linux: `secret-tool store` reads the secret from stdin.
+//   file       a 0600 file under $DEXTERM_HOME/secrets/ (directory 0700), outside every repo, as with the Helius key.
+// The item is named per dexterm home (a hash of its path), so a test home or a second profile never reads or
+// replaces the real one. `DEXTERM_SECRET_STORE=file` forces the file store (CI, containers, tests).
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+export const SECRET_SERVICE = 'xyz.dexterm.telegram';
+export const accountFor = (home) => `bot-token-${createHash('sha256').update(resolve(home)).digest('hex').slice(0, 12)}`;
+const has = (bin) => spawnSync('/usr/bin/env', ['which', bin], { stdio: 'ignore' }).status === 0;
+class KeychainStore {
+    kind = 'keychain';
+    account;
+    constructor(account) { this.account = account; }
+    get() {
+        const r = spawnSync('security', ['find-generic-password', '-a', this.account, '-s', SECRET_SERVICE, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const v = r.status === 0 ? r.stdout.trim() : '';
+        return v || null;
+    }
+    set(value) {
+        if (!/^[A-Za-z0-9:_-]+$/.test(value))
+            throw new Error('refusing to store a value with characters a bot token never has');
+        // The add command (with the value) goes through stdin; argv only says "-i".
+        const r = spawnSync('security', ['-i'], { input: `add-generic-password -U -a ${this.account} -s ${SECRET_SERVICE} -l "dexterm telegram bot" -w "${value}"\n`, encoding: 'utf8', stdio: ['pipe', 'ignore', 'pipe'] });
+        if (r.status !== 0 || this.get() !== value)
+            throw new Error('the macOS keychain did not store the token');
+    }
+    remove() { spawnSync('security', ['delete-generic-password', '-a', this.account, '-s', SECRET_SERVICE], { stdio: 'ignore' }); }
+}
+class LibsecretStore {
+    kind = 'libsecret';
+    account;
+    constructor(account) { this.account = account; }
+    get() {
+        const r = spawnSync('secret-tool', ['lookup', 'service', SECRET_SERVICE, 'account', this.account], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const v = r.status === 0 ? r.stdout.trim() : '';
+        return v || null;
+    }
+    set(value) {
+        const r = spawnSync('secret-tool', ['store', '--label=dexterm telegram bot', 'service', SECRET_SERVICE, 'account', this.account], { input: value, encoding: 'utf8', stdio: ['pipe', 'ignore', 'pipe'] });
+        if (r.status !== 0 || this.get() !== value)
+            throw new Error('libsecret did not store the token');
+    }
+    remove() { spawnSync('secret-tool', ['clear', 'service', SECRET_SERVICE, 'account', this.account], { stdio: 'ignore' }); }
+}
+class FileStore {
+    kind = 'file';
+    path;
+    constructor(home) { this.path = join(home, 'secrets', 'telegram-bot.token'); }
+    get() {
+        if (!existsSync(this.path))
+            return null;
+        const v = readFileSync(this.path, 'utf8').trim();
+        return v || null;
+    }
+    set(value) {
+        mkdirSync(join(this.path, '..'), { recursive: true, mode: 0o700 });
+        chmodSync(join(this.path, '..'), 0o700);
+        writeFileSync(this.path, `${value}\n`, { mode: 0o600 });
+        chmodSync(this.path, 0o600);
+    }
+    remove() { rmSync(this.path, { force: true }); }
+}
+/** In memory (tests). */
+export class MemoryStore {
+    kind = 'memory';
+    v;
+    constructor(v = null) { this.v = v; }
+    get() { return this.v; }
+    set(value) { this.v = value; }
+    remove() { this.v = null; }
+}
+/** The store a kind names (the one setup recorded), for this home. */
+export function secretStore(kind, home) {
+    if (kind === 'keychain')
+        return new KeychainStore(accountFor(home));
+    if (kind === 'libsecret')
+        return new LibsecretStore(accountFor(home));
+    if (kind === 'memory')
+        return new MemoryStore();
+    return new FileStore(home);
+}
+/** The best store on this machine: DEXTERM_SECRET_STORE wins, then the OS store, then the 0600 file. */
+export function chooseSecretStore(home, env = process.env, platform = process.platform) {
+    const want = env.DEXTERM_SECRET_STORE;
+    if (want === 'file' || want === 'keychain' || want === 'libsecret')
+        return secretStore(want, home);
+    if (platform === 'darwin' && has('security'))
+        return secretStore('keychain', home);
+    if (platform === 'linux' && has('secret-tool'))
+        return secretStore('libsecret', home);
+    return secretStore('file', home);
+}