myaiforone 1.0.0

package/src/gym/index.ts

@@ -0,0 +1,19 @@
+/**
+ * AI Gym — Module barrel
+ *
+ * All gym-specific code is centralized here. Platform files (web-ui.ts, etc.)
+ * import from this module only at registration points.
+ * When `gymEnabled: false`, nothing in this module runs.
+ */
+
+export { createGymRouter } from "./gym-router.js";
+export { startActivityDigest, stopActivityDigest, runActivityDigest } from "./activity-digest.js";
+export {
+  scoreAllDimensions,
+  computeTrends,
+  scoreApplication,
+  scoreCommunication,
+  scoreKnowledge,
+  scoreOrchestration,
+  scoreCraft,
+} from "./dimension-scorer.js";

package/src/heartbeat.ts

@@ -0,0 +1,220 @@
+import { readFileSync, appendFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import type { AppConfig, McpServerConfig } from "./config.js";
+import type { InboundMessage } from "./channels/types.js";
+import type { ResolvedRoute } from "./router.js";
+import { executeAgent } from "./executor.js";
+import { log } from "./logger.js";
+
+export interface HeartbeatResult {
+  id: string;
+  agentId: string;
+  triggeredBy: string;  // "manual" | "cron" | "goal"
+  triggeredAt: string;
+  completedAt: string;
+  durationMs: number;
+  summary: string;
+  status: "success" | "error" | "timeout";
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────
+
+function todayKey(): string {
+  return new Date().toISOString().split("T")[0]; // YYYY-MM-DD
+}
+
+// ─── Task loading (inlined from executor.ts) ─────────────────────────
+
+interface TaskData {
+  agentId: string;
+  projects: Array<{ id: string; name: string; color: string }>;
+  tasks: Array<{
+    id: string; title: string; description: string; project: string;
+    priority: string; status: string; owner: string; assignedBy: string;
+    assignmentType: string; dueDate: string | null; context: string;
+    result: string; createdAt: string; updatedAt: string;
+    source?: string;
+    assignedTo?: string;
+  }>;
+}
+
+function loadTasksFromAgent(agentHome: string, agentId: string): TaskData {
+  const p = join(agentHome, "tasks.json");
+  if (existsSync(p)) {
+    try { return JSON.parse(readFileSync(p, "utf-8")); } catch { /* ignore */ }
+  }
+  return { agentId, projects: [{ id: "general", name: "General", color: "#6b7280" }], tasks: [] };
+}
+
+// ─── Heartbeat prompt builder ────────────────────────────────────────
+
+export function buildHeartbeatPrompt(agentHome: string, agentId: string): string {
+  const data = loadTasksFromAgent(agentHome, agentId);
+  const activeStatuses = ["proposed", "approved", "in_progress", "review"];
+  const active = data.tasks.filter(t => activeStatuses.includes(t.status));
+
+  // Sort by priority: high > medium > low
+  const priorityOrder: Record<string, number> = { high: 0, medium: 1, low: 2 };
+  active.sort((a, b) => (priorityOrder[a.priority] ?? 99) - (priorityOrder[b.priority] ?? 99));
+
+  // Check for custom heartbeat.md — use it if present, else default
+  const heartbeatMdPath = join(agentHome, "heartbeat.md");
+  let customInstructions = "";
+  if (existsSync(heartbeatMdPath)) {
+    try {
+      const raw = readFileSync(heartbeatMdPath, "utf-8");
+      // Strip YAML frontmatter if present
+      customInstructions = raw.replace(/^---[\s\S]*?---\s*/, "").trim();
+    } catch { /* ignore */ }
+  }
+
+  const lines: string[] = [
+    "[HEARTBEAT]",
+  ];
+
+  if (customInstructions) {
+    lines.push(customInstructions);
+  } else {
+    lines.push("You are being activated for a heartbeat check. Review your assigned tasks and work on the highest priority one.");
+  }
+
+  lines.push("");
+  lines.push("Active Tasks:");
+
+  if (active.length > 0) {
+    for (const t of active) {
+      lines.push(`- ${t.id}: ${t.title} (${t.status}, ${t.priority} priority)`);
+    }
+  } else {
+    lines.push("(none)");
+  }
+
+  if (!customInstructions) {
+    lines.push("");
+    lines.push("Instructions:");
+    lines.push("1. Pick the highest priority task");
+    lines.push("2. Work on it");
+    lines.push('3. Use /task done <taskId> "what you did" when complete');
+    lines.push("4. Report a brief summary");
+    lines.push("");
+    lines.push("If no tasks are assigned, report that you have no pending work.");
+  }
+
+  lines.push("[/HEARTBEAT]");
+
+  return lines.join("\n");
+}
+
+// ─── Save / Load heartbeat history ───────────────────────────────────
+
+export function saveHeartbeatResult(agentHome: string, result: HeartbeatResult): void {
+  const dir = join(agentHome, "heartbeats");
+  mkdirSync(dir, { recursive: true });
+  const logFile = join(dir, `log-${todayKey()}.jsonl`);
+  try {
+    appendFileSync(logFile, JSON.stringify(result) + "\n");
+  } catch { /* ignore */ }
+}
+
+export function loadHeartbeatHistory(agentHome: string, limit: number = 20): HeartbeatResult[] {
+  const dir = join(agentHome, "heartbeats");
+  if (!existsSync(dir)) return [];
+
+  const files = readdirSync(dir)
+    .filter(f => f.startsWith("log-") && f.endsWith(".jsonl"))
+    .sort()
+    .reverse();
+
+  const results: HeartbeatResult[] = [];
+
+  for (const file of files) {
+    if (results.length >= limit) break;
+    try {
+      const content = readFileSync(join(dir, file), "utf-8");
+      const lines = content.trim().split("\n").filter(Boolean);
+      for (const line of lines) {
+        try {
+          results.push(JSON.parse(line) as HeartbeatResult);
+        } catch { /* skip malformed lines */ }
+      }
+    } catch { /* skip unreadable files */ }
+  }
+
+  // Sort by triggeredAt descending
+  results.sort((a, b) => b.triggeredAt.localeCompare(a.triggeredAt));
+
+  return results.slice(0, limit);
+}
+
+// ─── Execute a heartbeat ─────────────────────────────────────────────
+
+export async function executeHeartbeat(
+  agentId: string,
+  agent: AppConfig["agents"][string],
+  baseDir: string,
+  mcpRegistry?: Record<string, McpServerConfig>,
+  claudeAccounts?: Record<string, string>,
+  globalDefaults?: { skills?: string[]; mcps?: string[]; prompts?: string[]; promptTrigger?: string },
+  triggeredBy: string = "manual",
+): Promise<HeartbeatResult> {
+  const agentHome = agent.agentHome || resolve(baseDir, agent.memoryDir, "..");
+
+  // Build heartbeat prompt
+  const prompt = buildHeartbeatPrompt(agentHome, agentId);
+
+  // Build synthetic message
+  const syntheticMsg: InboundMessage = {
+    id: `heartbeat-${agentId}-${Date.now()}`,
+    channel: "heartbeat",
+    chatId: `heartbeat-${agentId}`,
+    chatType: "group",
+    sender: "heartbeat-runner",
+    senderName: "Heartbeat",
+    text: prompt,
+    timestamp: Date.now(),
+    isFromMe: false,
+    isGroup: true,
+    raw: { type: "heartbeat", agentId },
+  };
+
+  const route: ResolvedRoute = {
+    agentId,
+    agentConfig: agent,
+    route: agent.routes[0],
+  };
+
+  const startTime = Date.now();
+  const triggeredAt = new Date(startTime).toISOString();
+  let status: HeartbeatResult["status"] = "success";
+  let summary = "";
+
+  try {
+    const response = await executeAgent(route, syntheticMsg, baseDir, mcpRegistry, claudeAccounts, globalDefaults);
+    summary = response;
+  } catch (err) {
+    status = "error";
+    summary = String(err);
+    log.error(`Heartbeat execution failed for ${agentId}: ${err}`);
+  }
+
+  const endTime = Date.now();
+  const completedAt = new Date(endTime).toISOString();
+  const durationMs = endTime - startTime;
+
+  const result: HeartbeatResult = {
+    id: `hb-${agentId}-${startTime}`,
+    agentId,
+    triggeredBy,
+    triggeredAt,
+    completedAt,
+    durationMs,
+    summary,
+    status,
+  };
+
+  // Persist
+  saveHeartbeatResult(agentHome, result);
+
+  log.info(`Heartbeat completed: ${agentId} (${durationMs}ms, ${status})`);
+  return result;
+}

package/src/index.ts

@@ -0,0 +1,275 @@
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadConfig } from "./config.js";
+import { configureLogger, log } from "./logger.js";
+import { resolveRoute, isPairingAttempt, pairSender } from "./router.js";
+import { executeAgent, executeAgentStreaming, setAppConfig } from "./executor.js";
+import { SlackDriver } from "./channels/slack.js";
+import { WhatsAppDriver } from "./channels/whatsapp.js";
+import { TelegramDriver } from "./channels/telegram.js";
+import { DiscordDriver } from "./channels/discord.js";
+import { startWebUI } from "./web-ui.js";
+import { startCronJobs, stopCronJobs } from "./cron.js";
+import { startGoals, stopGoals } from "./goals.js";
+import { startWikiSync, stopWikiSync } from "./wiki-sync.js";
+import type { ChannelDriver, InboundMessage } from "./channels/types.js";
+
+const isMac = process.platform === "darwin";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const baseDir = resolve(__dirname, "..");
+
+async function main(): Promise<void> {
+  const configPath = resolve(baseDir, "config.json");
+  const config = loadConfig(configPath);
+  setAppConfig(config);
+
+  configureLogger(config.service.logLevel, config.service.logFile);
+
+  log.info("channelToAgentToClaude starting...");
+
+  const drivers: ChannelDriver[] = [];
+  const driverMap = new Map<string, ChannelDriver>();
+
+  // Initialize enabled channel drivers
+  for (const [channelId, channelCfg] of Object.entries(config.channels)) {
+    if (!channelCfg.enabled) {
+      log.debug(`Channel "${channelId}" disabled, skipping`);
+      continue;
+    }
+
+    let driver: ChannelDriver;
+
+    switch (channelCfg.driver) {
+      case "imessage":
+        if (!isMac) {
+          log.warn("iMessage channel is macOS-only and has been disabled on this platform. Use Telegram, Slack, or Discord instead.");
+          continue;
+        }
+        // Dynamic import — imsg CLI only exists on macOS
+        const { IMessageDriver } = await import("./channels/imessage.js");
+        driver = new IMessageDriver(channelCfg.config);
+        break;
+      case "slack":
+        driver = new SlackDriver(channelCfg.config);
+        break;
+      case "whatsapp":
+        driver = new WhatsAppDriver(channelCfg.config);
+        break;
+      case "telegram":
+        driver = new TelegramDriver(channelCfg.config);
+        break;
+      case "discord":
+        driver = new DiscordDriver(channelCfg.config);
+        break;
+      default:
+        log.warn(`Unknown channel driver "${channelCfg.driver}" for "${channelId}", skipping`);
+        continue;
+    }
+
+    // Track recent bot-sent messages to prevent echo loops
+    const recentBotMessages = new Set<string>();
+
+    // Wire up message handling
+    driver.onMessage(async (msg: InboundMessage) => {
+      // Anti-echo: ignore bot's own messages and echo loops
+      if (msg.isFromMe) return;
+      if (msg.text === "On it..." || msg.text?.startsWith("Paired successfully") || msg.text?.startsWith("Still working...")) return;
+      const msgKey = `${msg.chatId}:${msg.text?.slice(0, 50)}`;
+      if (recentBotMessages.has(msgKey)) {
+        recentBotMessages.delete(msgKey);
+        return;
+      }
+
+      // Feature 4: DM pairing gate
+      if (isPairingAttempt(msg, config, baseDir)) {
+        pairSender(msg, baseDir);
+        try {
+          await driver.send({
+            text: "Paired successfully. You can now message my agents.",
+            chatId: msg.chatId,
+          });
+        } catch { /* ignore */ }
+        return;
+      }
+
+      // Route to agent
+      const match = resolveRoute(msg, config, baseDir);
+      if (!match) return;
+
+      log.info(`${match.agentId} <- ${msg.sender}: ${msg.text.slice(0, 80)}`);
+
+      // Feature 2: Typing indicator
+      if (driver.sendTyping) {
+        driver.sendTyping(msg.chatId).catch(() => {});
+      }
+
+      // Send thinking indicator
+      if (driver.sendTyping) {
+        driver.sendTyping(msg.chatId).catch(() => {});
+      }
+      try {
+        recentBotMessages.add(`${msg.chatId}:On it...`);
+        await driver.send({ text: "On it...", chatId: msg.chatId });
+      } catch (err) {
+        log.warn(`Failed to send thinking indicator: ${err}`);
+      }
+
+      // Execute agent — streaming or regular
+      // Heartbeat: send "Still working..." every 4 minutes to keep channel alive
+      const HEARTBEAT_MS = 4 * 60 * 1000;
+      let heartbeatCount = 0;
+      const heartbeat = setInterval(() => {
+        heartbeatCount++;
+        const elapsed = heartbeatCount * 4;
+        const heartbeatMsg = `Still working... (${elapsed} min)`;
+        recentBotMessages.add(`${msg.chatId}:${heartbeatMsg}`);
+        driver.send({ text: heartbeatMsg, chatId: msg.chatId }).catch((err) => {
+          log.warn(`Heartbeat send failed: ${err}`);
+        });
+      }, HEARTBEAT_MS);
+
+      let response: string;
+      try {
+        if (match.agentConfig.streaming) {
+          // Streaming mode: send status updates to phone channel
+          let lastStatus = "";
+          let fullText = "";
+          for await (const event of executeAgentStreaming(match, msg, baseDir, config.mcps, config.service.claudeAccounts, undefined, { skills: config.defaultSkills, mcps: config.defaultMcps, prompts: config.defaultPrompts, promptTrigger: config.promptTrigger })) {
+            if (event.type === "status" && event.data !== lastStatus) {
+              lastStatus = event.data;
+              // Send status updates (throttle — only unique ones)
+              if (driver.sendTyping) {
+                driver.sendTyping(msg.chatId).catch(() => {});
+              }
+            } else if (event.type === "text") {
+              fullText += event.data;
+            } else if (event.type === "done") {
+              response = event.data || fullText;
+            } else if (event.type === "error") {
+              response = `Error: ${event.data}`;
+            }
+          }
+          response = response! || fullText || "No response from agent.";
+        } else {
+          response = await executeAgent(match, msg, baseDir, config.mcps, config.service.claudeAccounts, { skills: config.defaultSkills, mcps: config.defaultMcps, prompts: config.defaultPrompts, promptTrigger: config.promptTrigger });
+        }
+      } finally {
+        clearInterval(heartbeat);
+      }
+
+      // Reply via originating channel (retry once on failure)
+      recentBotMessages.add(`${msg.chatId}:${response.slice(0, 50)}`);
+      try {
+        await driver.send({ text: response, chatId: msg.chatId });
+      } catch (err) {
+        log.warn(`Send failed, retrying in 2s: ${err}`);
+        await new Promise((r) => setTimeout(r, 2000));
+        try {
+          await driver.send({ text: response, chatId: msg.chatId });
+        } catch (retryErr) {
+          log.error(`Send retry failed: ${retryErr}`);
+        }
+      }
+
+      log.info(`${match.agentId} -> ${msg.chatId}: ${response.slice(0, 80)}`);
+    });
+
+    drivers.push(driver);
+    driverMap.set(channelId, driver);
+  }
+
+  // ─── Feature 6 + 9: Web UI + Webhooks (start early so it's accessible even with no channels) ───
+  const webUI = config.service.webUI;
+  let cronMessageHandler: (agentId: string, message: string, channel: string, chatId: string) => Promise<void>;
+
+  if (webUI?.enabled) {
+    // cronMessageHandler is defined below — bind via closure so webUI can reference it
+    startWebUI({
+      config,
+      baseDir,
+      port: webUI.port || 8080,
+      webhookSecret: webUI.webhookSecret,
+      driverMap,
+      onWebhookMessage: async (agentId, text, channel, chatId) => {
+        if (cronMessageHandler) await cronMessageHandler(agentId, text, channel, chatId);
+      },
+    });
+  }
+
+  if (drivers.length === 0) {
+    log.warn("No channel drivers enabled — running in web-UI-only mode. Configure a channel to enable messaging.");
+  } else {
+    // Start all drivers
+    for (const driver of drivers) {
+      await driver.start();
+    }
+  }
+
+  // ─── Feature 7: Cron jobs ──────────────────────────────────────────
+  cronMessageHandler = async (agentId: string, message: string, channel: string, chatId: string) => {
+    const agent = config.agents[agentId];
+    if (!agent) return;
+
+    // Build a synthetic inbound message for the executor
+    const syntheticMsg: InboundMessage = {
+      id: `cron-${Date.now()}`,
+      channel,
+      chatId,
+      chatType: "group",
+      sender: "cron",
+      senderName: "Scheduled Task",
+      text: message,
+      timestamp: Date.now(),
+      isFromMe: false,
+      isGroup: true,
+      raw: { type: "cron" },
+    };
+
+    const route = { agentId, agentConfig: agent, route: agent.routes[0] };
+    const response = await executeAgent(route, syntheticMsg, baseDir, config.mcps, config.service.claudeAccounts, { skills: config.defaultSkills, mcps: config.defaultMcps, prompts: config.defaultPrompts, promptTrigger: config.promptTrigger });
+
+    // Send response to the configured channel
+    const driver = driverMap.get(channel);
+    if (driver) {
+      try {
+        await driver.send({ text: response, chatId });
+      } catch (err) {
+        log.error(`Cron response send failed for ${agentId}: ${err}`);
+      }
+    }
+  };
+
+  startCronJobs(config, cronMessageHandler);
+
+  // ─── Feature 8: Autonomous Goals ──────────────────────────────────
+  startGoals(config, driverMap, baseDir, config.mcps);
+
+  // ─── Feature: Wiki Sync ──────────────────────────────────────────
+  startWikiSync(config, baseDir, config.mcps);
+
+  const agentCount = Object.keys(config.agents).length;
+  log.info(
+    `channelToAgentToClaude running — ${agentCount} agent(s), ${drivers.length} channel(s)`
+  );
+
+  // Graceful shutdown
+  const shutdown = async (signal: string) => {
+    log.info(`Received ${signal}, shutting down...`);
+    stopCronJobs();
+    stopGoals();
+    stopWikiSync();
+    for (const driver of drivers) {
+      await driver.stop();
+    }
+    process.exit(0);
+  };
+
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+}
+
+main().catch((err) => {
+  console.error("Fatal error:", err);
+  process.exit(1);
+});

package/src/keystore.ts

@@ -0,0 +1,190 @@
+/**
+ * Keystore — encrypt/decrypt MCP API key files.
+ * Uses AES-256-GCM with a master password.
+ * Encrypted files have .env.enc extension, plain files have .env extension.
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { getPersonalAgentsDir } from "./config.js";
+import { log } from "./logger.js";
+
+const ALGORITHM = "aes-256-gcm";
+const SALT_LEN = 16;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const KEY_LEN = 32;
+const HEADER = "MYAGENT_ENC_V1"; // magic header to identify encrypted files
+
+function deriveKey(password: string, salt: Buffer): Buffer {
+  return scryptSync(password, salt, KEY_LEN);
+}
+
+export function encryptString(plaintext: string, password: string): Buffer {
+  const salt = randomBytes(SALT_LEN);
+  const iv = randomBytes(IV_LEN);
+  const key = deriveKey(password, salt);
+
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  // Format: HEADER + salt(16) + iv(12) + tag(16) + ciphertext
+  const headerBuf = Buffer.from(HEADER, "utf-8");
+  return Buffer.concat([headerBuf, salt, iv, tag, encrypted]);
+}
+
+export function decryptString(data: Buffer, password: string): string {
+  const headerBuf = Buffer.from(HEADER, "utf-8");
+  const headerLen = headerBuf.length;
+
+  // Verify header
+  if (data.subarray(0, headerLen).toString("utf-8") !== HEADER) {
+    throw new Error("Not an encrypted keystore file");
+  }
+
+  let offset = headerLen;
+  const salt = data.subarray(offset, offset + SALT_LEN); offset += SALT_LEN;
+  const iv = data.subarray(offset, offset + IV_LEN); offset += IV_LEN;
+  const tag = data.subarray(offset, offset + TAG_LEN); offset += TAG_LEN;
+  const ciphertext = data.subarray(offset);
+
+  const key = deriveKey(password, salt);
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString("utf-8");
+}
+
+export function isEncrypted(filePath: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    const data = readFileSync(filePath);
+    return data.subarray(0, Buffer.from(HEADER).length).toString("utf-8") === HEADER;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Encrypt all .env files in a directory → .env.enc
+ */
+export function encryptDir(dir: string, password: string): number {
+  if (!existsSync(dir)) return 0;
+  let count = 0;
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith(".env")) continue;
+    const plainPath = join(dir, file);
+    const encPath = plainPath + ".enc";
+    try {
+      const content = readFileSync(plainPath, "utf-8");
+      if (!content.trim()) continue; // skip empty files
+      const encrypted = encryptString(content, password);
+      writeFileSync(encPath, encrypted);
+      // Remove the plain file after encryption
+      writeFileSync(plainPath, `# Encrypted — see ${file}.enc\n`);
+      count++;
+    } catch (err) {
+      log.warn(`Failed to encrypt ${file}: ${err}`);
+    }
+  }
+  return count;
+}
+
+/**
+ * Decrypt all .env.enc files in a directory → .env
+ */
+export function decryptDir(dir: string, password: string): number {
+  if (!existsSync(dir)) return 0;
+  let count = 0;
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith(".env.enc")) continue;
+    const encPath = join(dir, file);
+    const plainPath = encPath.replace(".enc", "");
+    try {
+      const data = readFileSync(encPath);
+      const content = decryptString(data, password);
+      writeFileSync(plainPath, content);
+      count++;
+    } catch (err) {
+      log.warn(`Failed to decrypt ${file}: ${err}`);
+    }
+  }
+  return count;
+}
+
+/**
+ * Load env vars from a .env file, auto-decrypting if .env.enc exists.
+ * Priority: agent-level > shared
+ */
+export function loadMcpKeysWithDecryption(
+  gatewayDir: string,
+  agentMemoryDir: string | null,
+  mcpName: string,
+  masterPassword?: string,
+): Record<string, string> {
+  const vars: Record<string, string> = {};
+  const personalAgentsBase = getPersonalAgentsDir();
+
+  // Level 3: Gateway data/mcp-keys/ (last resort)
+  const gatewayVars = loadEnvFile(join(gatewayDir, `${mcpName}.env`), join(gatewayDir, `${mcpName}.env.enc`), masterPassword);
+  Object.assign(vars, gatewayVars);
+
+  // Level 2: Shared personalAgents/mcp-keys/ (overrides gateway)
+  const sharedKeysDir = join(personalAgentsBase, "mcp-keys");
+  const sharedVars = loadEnvFile(join(sharedKeysDir, `${mcpName}.env`), join(sharedKeysDir, `${mcpName}.env.enc`), masterPassword);
+  Object.assign(vars, sharedVars);
+
+  // Level 1: Agent-specific agent/mcp-keys/ (highest priority)
+  if (agentMemoryDir) {
+    const agentKeysDir = join(agentMemoryDir, "..", "mcp-keys");
+    const agentVars = loadEnvFile(join(agentKeysDir, `${mcpName}.env`), join(agentKeysDir, `${mcpName}.env.enc`), masterPassword);
+    Object.assign(vars, agentVars);
+  }
+
+  return vars;
+}
+
+function loadEnvFile(plainPath: string, encPath: string, password?: string): Record<string, string> {
+  const vars: Record<string, string> = {};
+
+  // Try encrypted file first
+  if (password && existsSync(encPath)) {
+    try {
+      const data = readFileSync(encPath);
+      if (isEncrypted(encPath)) {
+        const content = decryptString(data, password);
+        parseEnvContent(content, vars);
+        return vars;
+      }
+    } catch { /* fall through to plain */ }
+  }
+
+  // Try plain file
+  if (existsSync(plainPath)) {
+    try {
+      const content = readFileSync(plainPath, "utf-8");
+      // Skip stub files left after encryption
+      if (!content.includes("# Encrypted")) {
+        parseEnvContent(content, vars);
+      }
+    } catch { /* ignore */ }
+  }
+
+  return vars;
+}
+
+function parseEnvContent(content: string, vars: Record<string, string>): void {
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx < 1) continue;
+    const key = trimmed.slice(0, eqIdx).trim();
+    const val = trimmed.slice(eqIdx + 1).trim();
+    if (val) vars[key] = val;
+  }
+}