lyra-ai-agent 0.1.0

package/src/util/sui-runtime.ts

@@ -0,0 +1,74 @@
+/**
+ * Sui runtime construction for the CLI.
+ *
+ * Lyra on Sui keys the agent off a single env secret (`LYRA_AGENT_KEY`, a
+ * `suiprivkey1…` bech32 string). That one Ed25519 keypair signs every PTB and
+ * pays gas; the deterministic policy (mirrored on-chain by the `lyra::policy`
+ * Move package) bounds what it may do. There is no operator wallet, keystore
+ * decrypt, or a Sui wallet dance — the agent IS the signer.
+ *
+ * `buildOnchainContext` assembles the `OnchainRuntimeContext` the
+ * lyra-plugin-onchain tools read via `(ctx as any).onchain`.
+ */
+
+import {
+  type OnchainRuntimeContext,
+  type SuiNetwork,
+  keypairFromSecret,
+  makeSuiClient,
+  policyFromEnv,
+} from 'lyra-plugin-onchain'
+
+/** Env var holding the agent's Sui secret key (`suiprivkey1…` or base64 seed). */
+export const AGENT_KEY_ENV = 'LYRA_AGENT_KEY'
+
+export interface SuiAgent {
+  keypair: ReturnType<typeof keypairFromSecret>
+  /** `keypair.toSuiAddress()` — 0x + 64 hex. */
+  address: string
+}
+
+/**
+ * Resolve the agent keypair from `LYRA_AGENT_KEY`. Returns null when the env
+ * var is unset so callers can print a friendly "run lyra init" message instead
+ * of throwing a raw decode error.
+ */
+export function loadAgentFromEnv(): SuiAgent | null {
+  const secret = process.env[AGENT_KEY_ENV]
+  if (!secret || secret.trim().length === 0) return null
+  const keypair = keypairFromSecret(secret)
+  return { keypair, address: keypair.toSuiAddress() }
+}
+
+export interface BuildOnchainOpts {
+  agent: SuiAgent
+  network: SuiNetwork
+  agentDir: string
+  packageId?: string | null
+  policyObjectId?: string | null
+  brainProvider?: string | null
+  brainModel?: string | null
+}
+
+/**
+ * Build the side-band `OnchainRuntimeContext` consumed by lyra-plugin-onchain.
+ * `packageId` / `policyObjectId` default to the env values the Move deploy
+ * wrote (`LYRA_PACKAGE_ID` / `LYRA_POLICY_OBJECT_ID`); the off-chain policy
+ * mirror comes from `policyFromEnv()` (the `LYRA_POLICY_*` vars).
+ */
+export function buildOnchainContext(opts: BuildOnchainOpts): OnchainRuntimeContext {
+  const packageId = opts.packageId ?? process.env.LYRA_PACKAGE_ID ?? undefined
+  const policyObjectId = opts.policyObjectId ?? process.env.LYRA_POLICY_OBJECT_ID ?? undefined
+  return {
+    client: makeSuiClient(opts.network),
+    keypair: opts.agent.keypair,
+    agentAddress: opts.agent.address,
+    network: opts.network,
+    policy: policyFromEnv(),
+    packageId: packageId || undefined,
+    policyObjectId: policyObjectId || undefined,
+    agentDir: opts.agentDir,
+    brainProvider: opts.brainProvider ?? null,
+    brainModel: opts.brainModel ?? null,
+  }
+}

package/src/util/telegram-secrets.test.ts

@@ -0,0 +1,104 @@
+import { afterEach, describe, expect, it } from 'bun:test'
+import { looksLikeBotToken, parseAllowedUserIds, telegramSecretsFromEnv } from './telegram-secrets'
+
+describe('looksLikeBotToken', () => {
+  it('accepts a real-shaped token', () => {
+    expect(looksLikeBotToken('8776805236:AAGgfvp2AwYBvDc3COYfjC9m8w2s0e4t4hw')).toBe(true)
+  })
+
+  it('rejects empty / wrong delimiters', () => {
+    expect(looksLikeBotToken('')).toBe(false)
+    expect(looksLikeBotToken('8776805236-AAGgfvp2AwYBvDc3COYfjC9m8w2s0e4t4hw')).toBe(false)
+    expect(looksLikeBotToken('AAGgfvp2AwYBvDc3COYfjC9m8w2s0e4t4hw')).toBe(false)
+  })
+
+  it('rejects too-short secret half', () => {
+    expect(looksLikeBotToken('1234567890:short')).toBe(false)
+  })
+
+  it('trims surrounding whitespace before checking', () => {
+    expect(looksLikeBotToken('  8731160904:AAH8FQ3CLrE8-WAfZtDeOTqmpVgOFLg8GyU\n')).toBe(true)
+  })
+})
+
+describe('parseAllowedUserIds', () => {
+  it('returns empty list for blank input', () => {
+    const r = parseAllowedUserIds('')
+    expect(r.ok).toBe(true)
+    if (r.ok) expect(r.ids).toEqual([])
+  })
+
+  it('parses a comma-separated list', () => {
+    const r = parseAllowedUserIds('123, 456, 789')
+    expect(r.ok).toBe(true)
+    if (r.ok) expect(r.ids).toEqual([123, 456, 789])
+  })
+
+  it('parses whitespace-only delimiters', () => {
+    const r = parseAllowedUserIds('123  456\t789')
+    expect(r.ok).toBe(true)
+    if (r.ok) expect(r.ids).toEqual([123, 456, 789])
+  })
+
+  it('dedupes preserving first-seen order', () => {
+    const r = parseAllowedUserIds('123, 456, 123')
+    expect(r.ok).toBe(true)
+    if (r.ok) expect(r.ids).toEqual([123, 456])
+  })
+
+  it('rejects non-numeric ids', () => {
+    const r = parseAllowedUserIds('123, abc')
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.reason).toContain('abc')
+  })
+
+  it('rejects negative ids', () => {
+    const r = parseAllowedUserIds('-123')
+    expect(r.ok).toBe(false)
+  })
+
+  it('rejects zero', () => {
+    const r = parseAllowedUserIds('0')
+    expect(r.ok).toBe(false)
+  })
+})
+
+describe('telegramSecretsFromEnv', () => {
+  const keys = ['TELEGRAM_BOT_TOKEN', 'TELEGRAM_CHAT_ID', 'TELEGRAM_USERNAME'] as const
+  const saved: Record<string, string | undefined> = {}
+  for (const k of keys) saved[k] = process.env[k]
+
+  afterEach(() => {
+    for (const k of keys) {
+      if (saved[k] === undefined) Reflect.deleteProperty(process.env, k)
+      else process.env[k] = saved[k]
+    }
+  })
+
+  it('returns null when no token is set', () => {
+    Reflect.deleteProperty(process.env, 'TELEGRAM_BOT_TOKEN')
+    expect(telegramSecretsFromEnv()).toBeNull()
+  })
+
+  it('parses token + chat id + username', () => {
+    process.env.TELEGRAM_BOT_TOKEN = '8731160904:AAH8FQ3CLrE8-WAfZtDeOTqmpVgOFLg8GyU'
+    process.env.TELEGRAM_CHAT_ID = '1140813034'
+    process.env.TELEGRAM_USERNAME = 'lyra_test_bot'
+    expect(telegramSecretsFromEnv()).toEqual({
+      botToken: '8731160904:AAH8FQ3CLrE8-WAfZtDeOTqmpVgOFLg8GyU',
+      botUsername: 'lyra_test_bot',
+      allowedUserIds: [1140813034],
+    })
+  })
+
+  it('open access (empty allowlist) when no chat id', () => {
+    process.env.TELEGRAM_BOT_TOKEN = '8731160904:AAH8FQ3CLrE8-WAfZtDeOTqmpVgOFLg8GyU'
+    Reflect.deleteProperty(process.env, 'TELEGRAM_CHAT_ID')
+    Reflect.deleteProperty(process.env, 'TELEGRAM_USERNAME')
+    expect(telegramSecretsFromEnv()).toEqual({
+      botToken: '8731160904:AAH8FQ3CLrE8-WAfZtDeOTqmpVgOFLg8GyU',
+      botUsername: undefined,
+      allowedUserIds: [],
+    })
+  })
+})

package/src/util/telegram-secrets.ts

@@ -0,0 +1,99 @@
+/**
+ * Telegram bot helpers for the Sui CLI.
+ *
+ * On Sui, telegram is configured purely via environment variables — there is
+ * no operator wallet to sign-derive an encryption key, so the previous
+ * on-disk encrypted-blob flow is gone. The agent reads:
+ *
+ *   TELEGRAM_BOT_TOKEN   — from @BotFather (required to enable the gateway)
+ *   TELEGRAM_CHAT_ID     — optional sole allowed DM user (blank = open access)
+ *   TELEGRAM_USERNAME    — optional cached bot @username for nicer status output
+ *
+ * This module keeps the pure token/allowlist validators plus the Telegram
+ * `getMe` probe used by `lyra telegram setup` / `status`.
+ */
+
+export interface TelegramEnvSecrets {
+  botToken: string
+  botUsername?: string
+  allowedUserIds: number[]
+}
+
+/**
+ * Resolve telegram config from the environment, or null when no token is set.
+ */
+export function telegramSecretsFromEnv(): TelegramEnvSecrets | null {
+  const botToken = process.env.TELEGRAM_BOT_TOKEN
+  if (!botToken) return null
+  const chatId = process.env.TELEGRAM_CHAT_ID
+  return {
+    botToken,
+    botUsername: process.env.TELEGRAM_USERNAME,
+    allowedUserIds: chatId ? [Number(chatId)] : [],
+  }
+}
+
+const BOT_TOKEN_RE = /^\d{6,15}:[A-Za-z0-9_-]{30,}$/
+
+export function looksLikeBotToken(s: string): boolean {
+  return BOT_TOKEN_RE.test(s.trim())
+}
+
+export interface ValidatedBotInfo {
+  id: number
+  username: string
+  firstName: string
+}
+
+/**
+ * Telegram Bot API getMe — cheap, free, no message side-effect. Used by
+ * `lyra telegram setup` to validate the token before persisting it AND by
+ * `lyra telegram status` to confirm the stored token still works.
+ *
+ * Throws on non-200 / `ok: false` with a clean error message; caller wraps
+ * the throw in a clack spinner.stop().
+ */
+export async function fetchBotInfo(
+  botToken: string,
+  opts?: { signal?: AbortSignal },
+): Promise<ValidatedBotInfo> {
+  const url = `https://api.telegram.org/bot${encodeURIComponent(botToken)}/getMe`
+  const res = await fetch(url, { signal: opts?.signal })
+  if (!res.ok) {
+    throw new Error(`getMe HTTP ${res.status}: ${(await res.text()).slice(0, 200)}`)
+  }
+  const body = (await res.json()) as {
+    ok: boolean
+    description?: string
+    result?: { id: number; username?: string; first_name?: string }
+  }
+  if (!body.ok || !body.result) {
+    throw new Error(`getMe rejected: ${body.description ?? 'unknown error'}`)
+  }
+  if (!body.result.username) throw new Error('bot has no username; create one in @BotFather')
+  return {
+    id: body.result.id,
+    username: body.result.username,
+    firstName: body.result.first_name ?? body.result.username,
+  }
+}
+
+export function parseAllowedUserIds(
+  input: string,
+): { ok: true; ids: number[] } | { ok: false; reason: string } {
+  const trimmed = input.trim()
+  if (trimmed.length === 0) return { ok: true, ids: [] }
+  const parts = trimmed
+    .split(/[,\s]+/)
+    .map(p => p.trim())
+    .filter(p => p.length > 0)
+  const ids: number[] = []
+  for (const p of parts) {
+    if (!/^\d+$/.test(p)) return { ok: false, reason: `not a numeric id: "${p}"` }
+    const n = Number(p)
+    if (!Number.isFinite(n) || n <= 0) return { ok: false, reason: `not a positive id: "${p}"` }
+    ids.push(n)
+  }
+  // Dedupe, preserve first-seen order.
+  return { ok: true, ids: [...new Set(ids)] }
+}