mercury-agent 0.8.4 → 0.8.6

package/examples/extensions/napkin/index.ts

@@ -11,7 +11,10 @@ import {
 import { createRequire } from "node:module";
 import { homedir, tmpdir } from "node:os";
 import { delimiter, dirname, join } from "node:path";
-import { getApiKeyFromPiAuthFile } from "mercury-agent/storage/pi-auth";
+import {
+  getPiAuthCredential,
+  parseOAuthTokenEnv,
+} from "mercury-agent/storage/pi-auth";
 
 const KNOWLEDGE_DIR = "knowledge";
 const VAULT_DIRS = ["people", "projects", "references", "daily", "episodes", "weekly", "monthly", "templates"];
@@ -407,32 +410,70 @@ export default function (mercury: {
   // LLM credential resolution for host-side pi spawns
   // ---------------------------------------------------------------------------
 
+  type PiAuthEnvResult =
+    | { ok: true; env: Record<string, string> }
+    | { ok: false; reason: string };
+
   async function resolvePiAuthEnv(config: {
     authPath?: string;
     globalDir: string;
     modelProvider: string;
-  }): Promise<Record<string, string>> {
+  }): Promise<PiAuthEnvResult> {
     const env: Record<string, string> = {};
 
     // 1. Explicit env vars (strip MERCURY_ prefix, matching container-runner)
     if (process.env.MERCURY_ANTHROPIC_API_KEY) {
       env.ANTHROPIC_API_KEY = process.env.MERCURY_ANTHROPIC_API_KEY;
     }
+    // Console-provisioned agents carry a JSON credential blob here, not a bare
+    // token — same handling as container-runner, via the shared parser.
+    let oauthBlobCorrupt = false;
     if (process.env.MERCURY_ANTHROPIC_OAUTH_TOKEN) {
-      env.ANTHROPIC_API_KEY = process.env.MERCURY_ANTHROPIC_OAUTH_TOKEN;
+      const parsed = parseOAuthTokenEnv(
+        process.env.MERCURY_ANTHROPIC_OAUTH_TOKEN,
+      );
+      if (parsed.status === "token") {
+        env.ANTHROPIC_API_KEY = parsed.token;
+      } else if (parsed.status === "blob") {
+        env.ANTHROPIC_OAUTH_TOKEN = parsed.access;
+      } else if (parsed.status === "corrupt-blob") {
+        oauthBlobCorrupt = true;
+      }
+      // "empty" — whitespace-only value, treat as unset and fall through
+    }
+    if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_OAUTH_TOKEN) {
+      return { ok: true, env };
+    }
+
+    // Spawned pi inherits process.env, so an unprefixed host key also works.
+    if (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_OAUTH_TOKEN) {
+      return { ok: true, env };
     }
 
     // 2. Fall back to Mercury's auth.json (OAuth token refresh)
-    if (!env.ANTHROPIC_API_KEY) {
-      const authPath = config.authPath ?? join(config.globalDir, "auth.json");
-      const key = await getApiKeyFromPiAuthFile({
-        provider: config.modelProvider,
-        authPath,
-      });
-      if (key) env.ANTHROPIC_API_KEY = key;
+    const authPath = config.authPath ?? join(config.globalDir, "auth.json");
+    const cred = await getPiAuthCredential({
+      provider: config.modelProvider,
+      authPath,
+    });
+    if (cred.status === "ok") {
+      env.ANTHROPIC_API_KEY = cred.apiKey;
+      return { ok: true, env };
     }
 
-    return env;
+    // Non-anthropic providers aren't resolvable here — let pi use its own auth.
+    if (config.modelProvider !== "anthropic") {
+      return { ok: true, env };
+    }
+
+    // Fail fast, mirroring the container-runner guard: without a credential
+    // every pi spawn exits 1, one per space per pending date, every run.
+    const reason = oauthBlobCorrupt
+      ? "MERCURY_ANTHROPIC_OAUTH_TOKEN holds a corrupt credential blob — re-provision it or set MERCURY_ANTHROPIC_API_KEY"
+      : cred.status === "refresh-failed"
+        ? `Anthropic OAuth refresh failed for ${authPath} — re-authenticate on the host (run mercury auth login from the project directory that owns that file) or set MERCURY_ANTHROPIC_API_KEY`
+        : `no Anthropic credential configured (checked ${authPath}) — run mercury auth login or set MERCURY_ANTHROPIC_API_KEY / MERCURY_ANTHROPIC_OAUTH_TOKEN`;
+    return { ok: false, reason };
   }
 
   // ---------------------------------------------------------------------------
@@ -453,7 +494,18 @@ export default function (mercury: {
           return;
         }
 
-        const piAuthEnv = await resolvePiAuthEnv(ctx.config);
+        const piAuth = await resolvePiAuthEnv(ctx.config);
+        if (!piAuth.ok) {
+          // One clear host-level error instead of a failed pi spawn per
+          // space per pending date; dates stay pending for the next run.
+          ctx.log.error("Skipping distillation: no Anthropic credential", {
+            reason: piAuth.reason,
+          });
+          mercury.store.set("last-distill", new Date().toISOString());
+          mercury.store.set("last-distill-status", "skipped: no credential");
+          return;
+        }
+        const piAuthEnv = piAuth.env;
 
         const db = new Database(dbPath, { readonly: true });
 
@@ -681,7 +733,14 @@ export default function (mercury: {
         const dbPath = join(ctx.config.dataDir, "state.db");
         if (!existsSync(dbPath)) return;
 
-        const piAuthEnv = await resolvePiAuthEnv(ctx.config);
+        const piAuth = await resolvePiAuthEnv(ctx.config);
+        if (!piAuth.ok) {
+          ctx.log.error("Skipping consolidation: no Anthropic credential", {
+            reason: piAuth.reason,
+          });
+          return;
+        }
+        const piAuthEnv = piAuth.env;
 
         const db = new Database(dbPath, { readonly: true });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/adapters/whatsapp-console-filter.ts

@@ -0,0 +1,90 @@
+/**
+ * Runtime console hygiene for the libsignal dependency (transitive via Baileys).
+ *
+ * libsignal writes directly to the global console — bypassing the silenced
+ * Baileys logger — and several of those calls dump entire SessionEntry objects,
+ * including ratchet private keys and root keys, into the service log
+ * (session_record.js: "Opening session:", "Closing session:", ...).
+ *
+ * Mercury is a published package, so patching node_modules (bun patch /
+ * patch-package) would not reach installed copies. Instead we wrap the global
+ * console methods libsignal uses with two deterministic layers:
+ *
+ * 1. Prefix suppression — calls whose first argument is a known libsignal
+ *    session message are dropped entirely.
+ * 2. Shape redaction — any argument that structurally looks like a Signal
+ *    SessionEntry/SessionRecord is replaced with a placeholder, as a backstop
+ *    for call sites we don't know about.
+ *
+ * All other console traffic passes through untouched.
+ */
+
+/** Known libsignal messages (session_record.js / session_builder.js). */
+const SUPPRESSED_PREFIXES = [
+  "Opening session:",
+  "Closing session:",
+  "Session already open",
+  "Session already closed",
+  "Removing old closed session:",
+  "Migrating session to:",
+  "Closing open session in favor of incoming prekey bundle",
+  "Closing stale open session for new outgoing prekey bundle",
+];
+
+const REDACTED = "[libsignal session redacted]";
+
+function isSessionLike(value: unknown): boolean {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value as Record<string, unknown>;
+  // SessionEntry: currentRatchet + indexInfo (+ _chains); SessionRecord: sessions map + version.
+  if ("currentRatchet" in obj && "indexInfo" in obj) return true;
+  if ("_chains" in obj && "registrationId" in obj) return true;
+  if ("sessions" in obj && "version" in obj && "haveOpenSession" in obj)
+    return true;
+  return false;
+}
+
+export function filterConsoleArgs(args: unknown[]): unknown[] | null {
+  const first = args[0];
+  if (
+    typeof first === "string" &&
+    SUPPRESSED_PREFIXES.some((p) => first.startsWith(p))
+  ) {
+    return null;
+  }
+  let changed = false;
+  const out = args.map((arg) => {
+    if (isSessionLike(arg)) {
+      changed = true;
+      return REDACTED;
+    }
+    return arg;
+  });
+  return changed ? out : args;
+}
+
+type ConsoleMethod = (...args: unknown[]) => void;
+
+// Tracks wrapper functions so install is idempotent per method: a method whose
+// current function is already one of our wrappers is left alone, while a
+// method that was replaced (e.g. restored in a test) gets re-wrapped.
+const wrappers = new WeakSet<ConsoleMethod>();
+
+/**
+ * Wrap the global console methods libsignal writes to. Idempotent; call
+ * before creating the WhatsApp socket.
+ */
+export function installLibsignalConsoleFilter(): void {
+  for (const method of ["debug", "log", "info", "warn", "error"] as const) {
+    const current: ConsoleMethod = console[method];
+    if (wrappers.has(current)) continue;
+    const original = current.bind(console);
+    const wrapper: ConsoleMethod = (...args: unknown[]) => {
+      const filtered = filterConsoleArgs(args);
+      if (filtered === null) return;
+      original(...filtered);
+    };
+    wrappers.add(wrapper);
+    console[method] = wrapper;
+  }
+}

package/src/adapters/whatsapp.ts

@@ -30,6 +30,7 @@ import {
 import { logger } from "../logger.js";
 import { normalizeChatMarkdown } from "../text/markdown.js";
 import { applyRtlDirection } from "../text/rtl.js";
+import { installLibsignalConsoleFilter } from "./whatsapp-console-filter.js";
 import {
   canonicalizeJidSync,
   resolveKeyIdentities,
@@ -220,6 +221,10 @@ export class WhatsAppBaileysAdapter
   }
 
   private async connect(): Promise<void> {
+    // libsignal (transitive via Baileys) writes session dumps — including
+    // private key material — straight to the global console, bypassing the
+    // silenced waLogger below. Filter before the socket exists.
+    installLibsignalConsoleFilter();
     fs.mkdirSync(this.authDir, { recursive: true });
     const { state, saveCreds } = await useMultiFileAuthState(this.authDir);
     const { version } = await fetchLatestWaWebVersion({}).catch(() => ({
@@ -537,8 +542,8 @@ export class WhatsAppBaileysAdapter
     const sender = identities.sender.canonical;
     if (identities.sender.changed || identities.chat.changed) {
       logger.debug("WhatsApp identity canonicalized", {
-        sender: identities.sender,
-        chat: identities.chat,
+        sender: `${identities.sender.original} -> ${identities.sender.canonical}`,
+        chat: `${identities.chat.original} -> ${identities.chat.canonical}`,
       });
     }
     const senderName = msg.pushName || sender.split("@")[0] || "unknown";

package/src/storage/pi-auth.ts

@@ -33,6 +33,34 @@ function writeAuthFile(authPath: string, auth: AuthFile): void {
   fs.chmodSync(authPath, 0o600);
 }
 
+export type OAuthTokenEnvValue =
+  | { status: "token"; token: string }
+  | { status: "blob"; access: string }
+  | { status: "corrupt-blob" }
+  /** Whitespace-only value — treat the variable as unset. */
+  | { status: "empty" };
+
+/**
+ * Interpret the raw value of MERCURY_ANTHROPIC_OAUTH_TOKEN. Console-provisioned
+ * agents receive a full credential blob ({"access":"...","refresh":"...",
+ * "expires":...}) rather than a bare token, so any code spawning pi on the host
+ * must extract the access token instead of passing the value through verbatim.
+ */
+export function parseOAuthTokenEnv(raw: string): OAuthTokenEnvValue {
+  const trimmed = raw.trim();
+  if (!trimmed) return { status: "empty" };
+  if (!trimmed.startsWith("{")) return { status: "token", token: trimmed };
+  try {
+    const blob = JSON.parse(trimmed) as { access?: unknown };
+    if (typeof blob.access === "string" && blob.access) {
+      return { status: "blob", access: blob.access };
+    }
+  } catch {
+    // fall through to corrupt-blob
+  }
+  return { status: "corrupt-blob" };
+}
+
 export type PiAuthCredential =
   | { status: "ok"; apiKey: string }
   /** No usable oauth entry (or an env override takes precedence). */