hyperclaw 4.0.1 → 4.0.2

package/dist/cost-tracker-pVE15Yq4.js

@@ -0,0 +1,103 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+
+//#region src/infra/cost-tracker.ts
+/** Rough cost per 1M tokens by provider/model (Claude Sonnet ballpark). */
+const DEFAULT_COST_PER_1M_INPUT = 3;
+const DEFAULT_COST_PER_1M_OUTPUT = 15;
+function estimateCost(usage, model) {
+	if (!usage) return 0;
+	const inp = (usage.input || 0) + (usage.cacheRead || 0);
+	const inputCost = inp / 1e6 * DEFAULT_COST_PER_1M_INPUT;
+	const outputCost = (usage.output || 0) / 1e6 * DEFAULT_COST_PER_1M_OUTPUT;
+	return inputCost + outputCost;
+}
+/** Path to cost log file for a session. */
+function getCostLogPath(baseDir, sessionId) {
+	return path.default.join(baseDir, "costs", `session-${sessionId}.jsonl`);
+}
+/** Append a cost entry for a session. */
+async function recordUsage(baseDir, sessionId, usage, opts) {
+	const costUsd = estimateCost(usage, opts?.model);
+	const entry = {
+		sessionId,
+		source: opts?.source,
+		tenantId: opts?.tenantId,
+		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+		usage,
+		costUsd,
+		model: opts?.model
+	};
+	const dir = path.default.join(baseDir, "costs");
+	await fs_extra.default.ensureDir(dir);
+	const fp = getCostLogPath(baseDir, sessionId);
+	await fs_extra.default.appendFile(fp, JSON.stringify(entry) + "\n");
+}
+/** Read and aggregate all entries for a session. */
+async function getSessionSummary(baseDir, sessionId) {
+	const fp = getCostLogPath(baseDir, sessionId);
+	if (!await fs_extra.default.pathExists(fp)) return {
+		input: 0,
+		output: 0,
+		cacheRead: 0,
+		costUsd: 0,
+		runs: 0
+	};
+	const lines = (await fs_extra.default.readFile(fp, "utf8")).trim().split("\n").filter(Boolean);
+	let input = 0, output = 0, cacheRead = 0, costUsd = 0;
+	for (const line of lines) try {
+		const e = JSON.parse(line);
+		input += e.usage.input || 0;
+		output += e.usage.output || 0;
+		cacheRead += e.usage.cacheRead || 0;
+		costUsd += e.costUsd || 0;
+	} catch {}
+	return {
+		input,
+		output,
+		cacheRead,
+		costUsd,
+		runs: lines.length
+	};
+}
+/** Get global summary across all sessions. */
+async function getGlobalSummary(baseDir) {
+	const dir = path.default.join(baseDir, "costs");
+	if (!await fs_extra.default.pathExists(dir)) return {
+		sessions: 0,
+		totalInput: 0,
+		totalOutput: 0,
+		totalCacheRead: 0,
+		totalCostUsd: 0,
+		totalRuns: 0
+	};
+	const files = (await fs_extra.default.readdir(dir)).filter((f) => f.startsWith("session-") && f.endsWith(".jsonl"));
+	let totalInput = 0, totalOutput = 0, totalCacheRead = 0, totalCostUsd = 0, totalRuns = 0;
+	for (const f of files) {
+		const fp = path.default.join(dir, f);
+		const content = await fs_extra.default.readFile(fp, "utf8").catch(() => "");
+		for (const line of content.trim().split("\n").filter(Boolean)) try {
+			const e = JSON.parse(line);
+			totalInput += e.usage.input || 0;
+			totalOutput += e.usage.output || 0;
+			totalCacheRead += e.usage.cacheRead || 0;
+			totalCostUsd += e.costUsd || 0;
+			totalRuns++;
+		} catch {}
+	}
+	return {
+		sessions: files.length,
+		totalInput,
+		totalOutput,
+		totalCacheRead,
+		totalCostUsd,
+		totalRuns
+	};
+}
+
+//#endregion
+exports.estimateCost = estimateCost;
+exports.getGlobalSummary = getGlobalSummary;
+exports.getSessionSummary = getSessionSummary;
+exports.recordUsage = recordUsage;

package/dist/credentials-store-BvnMPJwi.js

@@ -0,0 +1,4 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const require_credentials_store = require('./credentials-store-sb-TRLwR.js');
+
+exports.CredentialsStore = require_credentials_store.CredentialsStore;

package/dist/credentials-store-sb-TRLwR.js

@@ -0,0 +1,77 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const chalk = require_chunk.__toESM(require("chalk"));
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+
+//#region src/secrets/credentials-store.ts
+var CredentialsStore = class {
+	credsDir;
+	constructor(baseDir) {
+		this.credsDir = path.default.join(baseDir || path.default.join(os.default.homedir(), ".hyperclaw"), "credentials");
+	}
+	filePath(providerId) {
+		const safe = providerId.replace(/[^a-zA-Z0-9_-]/g, "_");
+		return path.default.join(this.credsDir, `${safe}.json`);
+	}
+	async set(providerId, creds) {
+		await fs_extra.default.ensureDir(this.credsDir);
+		await fs_extra.default.chmod(this.credsDir, 448);
+		const record = {
+			...creds,
+			providerId,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const fpath = this.filePath(providerId);
+		await fs_extra.default.writeJson(fpath, record, { spaces: 2 });
+		await fs_extra.default.chmod(fpath, 384);
+	}
+	async get(providerId) {
+		const fpath = this.filePath(providerId);
+		if (!await fs_extra.default.pathExists(fpath)) return null;
+		const stat = await fs_extra.default.stat(fpath);
+		if ((stat.mode & 63) !== 0) {
+			console.log(chalk.default.yellow(`  ⚠  Unsafe permissions on credentials/${providerId}.json — fixing...`));
+			await fs_extra.default.chmod(fpath, 384);
+		}
+		return fs_extra.default.readJson(fpath);
+	}
+	async remove(providerId) {
+		const fpath = this.filePath(providerId);
+		await fs_extra.default.remove(fpath);
+		console.log(chalk.default.green(`  ✔  Credentials removed: ${providerId}`));
+	}
+	async list() {
+		if (!await fs_extra.default.pathExists(this.credsDir)) return [];
+		const files = await fs_extra.default.readdir(this.credsDir);
+		return files.filter((f) => f.endsWith(".json")).map((f) => f.replace(".json", ""));
+	}
+	async showList() {
+		const providers = await this.list();
+		console.log(chalk.default.bold.cyan("\n  🔐 CREDENTIALS\n"));
+		if (providers.length === 0) {
+			console.log(chalk.default.gray("  No credentials stored.\n"));
+			console.log(chalk.default.gray("  Add with: hyperclaw auth add <service_id>   (for any API key)\n"));
+			console.log(chalk.default.gray("  Or:       hyperclaw secrets set KEY=value   (for .env vars)\n"));
+			return;
+		}
+		for (const p of providers) {
+			const cred = await this.get(p);
+			const hasKey = !!cred?.apiKey;
+			const hasRefresh = !!cred?.refreshToken;
+			const expiry = cred?.expiresAt ? new Date(cred.expiresAt) > /* @__PURE__ */ new Date() ? chalk.default.green("valid") : chalk.default.red("expired") : chalk.default.gray("no expiry");
+			console.log(`  ${chalk.default.green("●")} ${chalk.default.white(p.padEnd(20))} ${hasKey ? chalk.default.cyan("api_key") : ""}${hasRefresh ? chalk.default.yellow(" refresh_token") : ""} ${expiry}`);
+			console.log(`     ${chalk.default.gray(`Updated: ${cred?.updatedAt ? new Date(cred.updatedAt).toLocaleString() : "unknown"}`)}`);
+			console.log();
+		}
+		console.log(chalk.default.gray("  credentials/ — stored at ~/.hyperclaw/credentials/*.json (mode 0600)\n"));
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'CredentialsStore', {
+  enumerable: true,
+  get: function () {
+    return CredentialsStore;
+  }
+});

package/dist/cron-tasks-BvDFNyiE.js

@@ -0,0 +1,82 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+
+//#region src/services/cron-tasks.ts
+const CRON_TASKS_FILE = path.default.join(os.default.homedir(), ".hyperclaw", "cron-tasks.json");
+let tasks = [];
+async function loadCronTasks() {
+	try {
+		tasks = await fs_extra.default.readJson(CRON_TASKS_FILE);
+	} catch {
+		tasks = [];
+	}
+	return tasks;
+}
+async function saveCronTasks() {
+	await fs_extra.default.ensureDir(path.default.dirname(CRON_TASKS_FILE));
+	await fs_extra.default.writeJson(CRON_TASKS_FILE, tasks, { spaces: 2 });
+}
+function addCronTask(schedule, prompt, name) {
+	const id = `task-${Date.now().toString(36)}`;
+	const task = {
+		id,
+		schedule,
+		prompt,
+		name,
+		enabled: true,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	tasks.push(task);
+	return task;
+}
+function removeCronTask(id) {
+	const i = tasks.findIndex((t) => t.id === id);
+	if (i >= 0) {
+		tasks.splice(i, 1);
+		return true;
+	}
+	return false;
+}
+async function runCronTask(task, port = 18789) {
+	const http = await import("http");
+	return new Promise((resolve, reject) => {
+		const payload = JSON.stringify({ message: task.prompt });
+		const req = http.request({
+			hostname: "127.0.0.1",
+			port,
+			path: "/api/webhook/inbound",
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"Content-Length": Buffer.byteLength(payload)
+			}
+		}, (res) => {
+			let data = "";
+			res.on("data", (c) => data += c);
+			res.on("end", async () => {
+				task.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
+				await saveCronTasks().catch(() => {});
+				resolve();
+			});
+		});
+		req.on("error", (e) => {
+			console.error(`[cron] task ${task.id} failed:`, e.message);
+			resolve();
+		});
+		req.setTimeout(6e4, () => {
+			req.destroy();
+			resolve();
+		});
+		req.write(payload);
+		req.end();
+	});
+}
+
+//#endregion
+exports.addCronTask = addCronTask;
+exports.loadCronTasks = loadCronTasks;
+exports.removeCronTask = removeCronTask;
+exports.runCronTask = runCronTask;
+exports.saveCronTasks = saveCronTasks;

package/dist/delivery-D5Z98EVq.js

@@ -0,0 +1,95 @@
+
+//#region src/channels/delivery.ts
+/**
+
+* src/channels/delivery.ts
+
+* Delivery pipeline: queue retry, per-channel chunking, media handling.
+
+*/
+const CHANNEL_MAX_LENGTH = {
+	telegram: 4096,
+	discord: 2e3,
+	whatsapp: 4096,
+	"whatsapp-baileys": 4096,
+	slack: 4e4,
+	googlechat: 4096,
+	msteams: 28e3,
+	matrix: 32768,
+	irc: 512,
+	mattermost: 16383,
+	signal: 4096,
+	line: 2e3,
+	twitch: 490,
+	viber: 7e3,
+	default: 4e3
+};
+function chunkForChannel(text, channelId) {
+	const max = CHANNEL_MAX_LENGTH[channelId] ?? CHANNEL_MAX_LENGTH.default;
+	if (text.length <= max) return [text];
+	const chunks = [];
+	let i = 0;
+	while (i < text.length) {
+		let end = Math.min(i + max, text.length);
+		if (end < text.length) {
+			const nl = text.lastIndexOf("\n", end);
+			if (nl > i) end = nl + 1;
+		}
+		chunks.push(text.slice(i, end));
+		i = end;
+	}
+	return chunks;
+}
+const DEFAULT_RETRIES = 3;
+const DEFAULT_BACKOFF_MS = 1e3;
+async function withRetry(fn, opts) {
+	const retries = opts?.retries ?? DEFAULT_RETRIES;
+	const backoff = opts?.backoffMs ?? DEFAULT_BACKOFF_MS;
+	let lastErr = null;
+	for (let i = 0; i <= retries; i++) try {
+		return await fn();
+	} catch (e) {
+		lastErr = e;
+		opts?.onRetry?.(i + 1, lastErr);
+		if (i < retries) await new Promise((r) => setTimeout(r, backoff * Math.pow(2, i)));
+	}
+	throw lastErr;
+}
+/** Enrich message text from voice note (transcribe if audioPath provided). */
+async function enrichVoiceNote(msg) {
+	if (!msg.audioPath) return msg.text;
+	if (msg.text && msg.text !== "[voice note]") return msg.text;
+	try {
+		const { transcribeVoiceNote } = await Promise.resolve().then(() => require("./voice-transcription-CgWq54hn.js"));
+		const text = await transcribeVoiceNote(msg.audioPath);
+		return text || msg.text;
+	} catch (e) {
+		return `[Voice note — transcription failed: ${e.message}]`;
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'CHANNEL_MAX_LENGTH', {
+  enumerable: true,
+  get: function () {
+    return CHANNEL_MAX_LENGTH;
+  }
+});
+Object.defineProperty(exports, 'chunkForChannel', {
+  enumerable: true,
+  get: function () {
+    return chunkForChannel;
+  }
+});
+Object.defineProperty(exports, 'enrichVoiceNote', {
+  enumerable: true,
+  get: function () {
+    return enrichVoiceNote;
+  }
+});
+Object.defineProperty(exports, 'withRetry', {
+  enumerable: true,
+  get: function () {
+    return withRetry;
+  }
+});

package/dist/delivery-DCOXhXEO.js

@@ -0,0 +1,5 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const require_delivery = require('./delivery-D5Z98EVq.js');
+
+exports.enrichVoiceNote = require_delivery.enrichVoiceNote;
+exports.withRetry = require_delivery.withRetry;

package/dist/destructive-gate-m-dWqUFg.js

@@ -0,0 +1,101 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+
+//#region src/infra/destructive-gate.ts
+function isDangerousShellCommand(cmd) {
+	const c = (cmd || "").trim();
+	for (const re of DANGEROUS_SHELL_PATTERNS) if (re.test(c)) return true;
+	return false;
+}
+/**
+
+* Wrap tools so destructive ones are gated. When sessionId set, stores pending for confirm flow.
+
+*/
+function applyDestructiveGate(tools, opts) {
+	const { elevated, source, sessionId } = opts;
+	const fromChannel = source && CHANNEL_SOURCES.has(source);
+	if (!fromChannel || elevated) return tools;
+	return tools.map((t) => {
+		if (DESTRUCTIVE_TOOLS.includes(t.name)) {
+			const orig = t.handler;
+			return {
+				...t,
+				handler: async (input) => {
+					if (sessionId) {
+						const { setPending } = await Promise.resolve().then(() => require("./pending-approval-DIHvwwWS.js"));
+						setPending(sessionId, {
+							toolName: t.name,
+							input,
+							execute: () => orig(input)
+						});
+						return PENDING_MSG;
+					}
+					return BLOCKED_MSG;
+				}
+			};
+		}
+		if (t.name === "run_shell") {
+			const orig = t.handler;
+			return {
+				...t,
+				handler: async (input) => {
+					const cmd = input.command || "";
+					if (isDangerousShellCommand(cmd)) {
+						if (sessionId) {
+							const { setPending } = await Promise.resolve().then(() => require("./pending-approval-DIHvwwWS.js"));
+							setPending(sessionId, {
+								toolName: "run_shell",
+								input,
+								execute: () => orig(input)
+							});
+							return PENDING_MSG;
+						}
+						return BLOCKED_MSG;
+					}
+					return orig(input);
+				}
+			};
+		}
+		return t;
+	});
+}
+var DESTRUCTIVE_TOOLS, DANGEROUS_SHELL_PATTERNS, CHANNEL_SOURCES, BLOCKED_MSG, PENDING_MSG;
+var init_destructive_gate = require_chunk.__esm({ "src/infra/destructive-gate.ts"() {
+	DESTRUCTIVE_TOOLS = ["delete_file", "kill_process"];
+	DANGEROUS_SHELL_PATTERNS = [
+		/\brm\s+-[rf]\b|\brm\s+--recursive|\brm\s+-rf\b/,
+		/\bmkfs\.|format\s+/i,
+		/\bdd\s+if=/,
+		/\b>\/dev\/sd[a-z]/,
+		/\bshutdown\s+-/,
+		/\breboot\b/i,
+		/\b:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}/,
+		/\bcurl\s+.*\s*\|\s*sh\b/,
+		/\bwget\s+.*\s*\|\s*(bash|sh)\b/
+	];
+	CHANNEL_SOURCES = new Set([
+		"telegram",
+		"discord",
+		"whatsapp",
+		"slack",
+		"signal",
+		"matrix",
+		"line",
+		"nostr",
+		"feishu",
+		"msteams",
+		"teams",
+		"instagram",
+		"messenger",
+		"twitter",
+		"viber",
+		"zalo",
+		"webhook:inbound"
+	]);
+	BLOCKED_MSG = "Blocked: destructive action requires elevated session. Use \"elevate\" or run from CLI with full access.";
+	PENDING_MSG = "This action requires confirmation. Ask the user to reply \"confirm\" to proceed.";
+} });
+
+//#endregion
+init_destructive_gate();
+exports.applyDestructiveGate = applyDestructiveGate;

package/dist/developer-keys-JaJK3T27.js

@@ -0,0 +1,127 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const require_paths = require('./paths-AIyBxIzm.js');
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const crypto = require_chunk.__toESM(require("crypto"));
+
+//#region src/infra/developer-keys.ts
+require_paths.init_paths();
+const KEYS_FILE = "developer-keys.json";
+function getKeysPath(baseDir) {
+	const root = baseDir ?? require_paths.getHyperClawDir();
+	return path.default.join(root, KEYS_FILE);
+}
+function hashKey(key) {
+	return crypto.default.createHash("sha256").update(key, "utf8").digest("hex");
+}
+function generateKey() {
+	return `hc_${crypto.default.randomBytes(24).toString("base64url")}`;
+}
+async function loadKeys(baseDir) {
+	const fp = getKeysPath(baseDir);
+	if (!await fs_extra.default.pathExists(fp)) return [];
+	try {
+		const data = await fs_extra.default.readJson(fp);
+		return Array.isArray(data.keys) ? data.keys : [];
+	} catch {
+		return [];
+	}
+}
+async function saveKeys(keys, baseDir) {
+	const fp = getKeysPath(baseDir);
+	const dir = path.default.dirname(fp);
+	await fs_extra.default.ensureDir(dir);
+	await fs_extra.default.writeJson(fp, {
+		keys,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, { spaces: 2 });
+}
+/** Create a new developer key. Returns the raw key (show once). Optional tenantId for multi-tenant. */
+async function createDeveloperKey(name, opts) {
+	const rawKey = generateKey();
+	const keyHash = hashKey(rawKey);
+	const id = `key_${crypto.default.randomBytes(8).toString("hex")}`;
+	const entry = {
+		id,
+		name: name || "Unnamed",
+		keyHash,
+		tenantId: opts?.tenantId,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const keys = await loadKeys(opts?.baseDir);
+	keys.push(entry);
+	await saveKeys(keys, opts?.baseDir);
+	return {
+		id,
+		key: rawKey,
+		name: entry.name,
+		tenantId: entry.tenantId
+	};
+}
+/** List developer keys (without raw keys). Optional tenantId filter. */
+async function listDeveloperKeys(opts) {
+	let keys = await loadKeys(opts?.baseDir);
+	if (opts?.tenantId) keys = keys.filter((k) => k.tenantId === opts.tenantId);
+	return keys.map((k) => ({
+		id: k.id,
+		name: k.name,
+		tenantId: k.tenantId,
+		createdAt: k.createdAt,
+		lastUsedAt: k.lastUsedAt
+	}));
+}
+/** Revoke a developer key by id. */
+async function revokeDeveloperKey(id) {
+	const keys = await loadKeys();
+	const before = keys.length;
+	const filtered = keys.filter((k) => k.id !== id);
+	if (filtered.length === before) return false;
+	await saveKeys(filtered);
+	return true;
+}
+/**
+
+* Validate a Bearer token. Returns { valid: true, tenantId?: string } or { valid: false }.
+
+* Use with gateway token check: valid = gatewayToken OR result.valid.
+
+*/
+async function validateDeveloperKey(bearer, opts) {
+	if (!bearer || bearer.length < 20) return { valid: false };
+	const keys = await loadKeys(opts?.baseDir);
+	const hash = hashKey(bearer);
+	const idx = keys.findIndex((k) => k.keyHash === hash);
+	if (idx < 0) return { valid: false };
+	keys[idx].lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+	await saveKeys(keys, opts?.baseDir).catch(() => {});
+	return {
+		valid: true,
+		tenantId: keys[idx].tenantId
+	};
+}
+
+//#endregion
+Object.defineProperty(exports, 'createDeveloperKey', {
+  enumerable: true,
+  get: function () {
+    return createDeveloperKey;
+  }
+});
+Object.defineProperty(exports, 'listDeveloperKeys', {
+  enumerable: true,
+  get: function () {
+    return listDeveloperKeys;
+  }
+});
+Object.defineProperty(exports, 'revokeDeveloperKey', {
+  enumerable: true,
+  get: function () {
+    return revokeDeveloperKey;
+  }
+});
+Object.defineProperty(exports, 'validateDeveloperKey', {
+  enumerable: true,
+  get: function () {
+    return validateDeveloperKey;
+  }
+});

package/dist/developer-keys-kyqmtWK3.js

@@ -0,0 +1,8 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+require('./paths-AIyBxIzm.js');
+const require_developer_keys = require('./developer-keys-JaJK3T27.js');
+
+exports.createDeveloperKey = require_developer_keys.createDeveloperKey;
+exports.listDeveloperKeys = require_developer_keys.listDeveloperKeys;
+exports.revokeDeveloperKey = require_developer_keys.revokeDeveloperKey;
+exports.validateDeveloperKey = require_developer_keys.validateDeveloperKey;