openbot 0.5.4 → 0.5.5

package/src/plugins/storage/service.ts

@@ -1,7 +1,7 @@
 import { ORCHESTRATOR_AGENT_ID, STATE_AGENT_ID } from '../../app/agent-ids.js';
 import {
   assertCloudSystemAgentPluginsMutable,
-  CLOUD_SYSTEM_MODEL,
+  DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
   isCloudMode,
 } from '../../app/cloud-mode.js';
 import {
@@ -31,7 +31,7 @@ import {
   ThreadState,
 } from '../../services/plugins/domain.js';
 import type { PluginRef } from '../../services/plugins/types.js';
-import { openbotPlugin } from '../openbot/index.js';
+import { OPENBOT_PLUGIN_ID } from '../../app/openbot-plugin.js';
 import { listBuiltInPlugins, parsePluginModule } from '../../services/plugins/registry.js';
 import {
   enrichOpenbotPluginDescriptor,
@@ -122,34 +122,32 @@ const SYSTEM_AGENT_ID = ORCHESTRATOR_AGENT_ID;
 
 const SYSTEM_DEFAULT_PLUGINS: PluginRef[] = [
   {
-    id: 'openbot',
+    id: OPENBOT_PLUGIN_ID,
     config: {
       model: 'openai/gpt-5.4-mini',
-      approval: {
-        actions: ['action:shell_exec', 'action:create_channel', 'action:delete_channel'],
-      },
     },
   },
 ];
 
-const CLOUD_SYSTEM_DEFAULT_PLUGINS: PluginRef[] = [
-  {
-    id: 'openbot',
-    config: {
-      model: CLOUD_SYSTEM_MODEL,
-      approval: {
-        actions: ['action:shell_exec', 'action:create_channel', 'action:delete_channel'],
+function getCloudSystemDefaultPlugins(): PluginRef[] {
+  return SYSTEM_DEFAULT_PLUGINS.map((ref) => {
+    if (ref.id !== OPENBOT_PLUGIN_ID) return ref;
+    return {
+      ...ref,
+      config: {
+        ...ref.config,
+        authMode: DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
       },
-    },
-  },
-];
+    };
+  });
+}
 
 function mergeCloudSystemPluginRefs(
   defaults: PluginRef[],
   diskRefs: PluginRef[],
 ): PluginRef[] {
-  const defaultOpenbot = defaults.find((ref) => ref.id === 'openbot');
-  const diskOpenbot = diskRefs.find((ref) => ref.id === 'openbot');
+  const defaultOpenbot = defaults.find((ref) => ref.id === OPENBOT_PLUGIN_ID);
+  const diskOpenbot = diskRefs.find((ref) => ref.id === OPENBOT_PLUGIN_ID);
 
   if (!defaultOpenbot) return defaults;
 
@@ -174,7 +172,7 @@ const STATE_AGENT_INSTRUCTIONS =
   'Built-in infra agent for deterministic state reads. No conversational model is attached; handle storage, approvals, memory, and plugin marketplace events.';
 
 function getSystemAgentDetails(overrides?: Partial<AgentDetails>): AgentDetails {
-  const defaultPlugins = isCloudMode() ? CLOUD_SYSTEM_DEFAULT_PLUGINS : SYSTEM_DEFAULT_PLUGINS;
+  const defaultPlugins = isCloudMode() ? getCloudSystemDefaultPlugins() : SYSTEM_DEFAULT_PLUGINS;
   const defaults: AgentDetails = {
     id: SYSTEM_AGENT_ID,
     name: 'OpenBot',
@@ -277,9 +275,6 @@ const agentSummaryFromDetails = (details: AgentDetails): Agent => ({
   updatedAt: details.updatedAt,
 });
 
-// Suppress unused warning until system agent customization re-uses openbotPlugin metadata.
-void openbotPlugin;
-
 /** Built-in agents may persist optional `agents/<id>/AGENT.md` overlays; read path merges them with defaults. */
 const isBuiltinOverlayAgentId = (agentId: string): boolean =>
   agentId === SYSTEM_AGENT_ID || agentId === STATE_AGENT_ID;

package/src/services/plugins/host.ts

@@ -0,0 +1,36 @@
+import {
+  DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
+  isCloudMode,
+  isCloudSystemAgent,
+  parseOpenbotAuthMode,
+  type OpenbotAuthMode,
+} from '../../app/cloud-mode.js';
+import { ORCHESTRATOR_AGENT_ID } from '../../app/agent-ids.js';
+import { OPENBOT_PLUGIN_ID } from '../../app/openbot-plugin.js';
+import { getBaseDir, resolvePath, saveConfig } from '../../app/config.js';
+import {
+  listApiKeyProvidersFromRegistry,
+  resolveModelRegistry,
+} from './model-registry.js';
+import type { PluginHost, RunAgentHostOptions } from './types.js';
+
+export function createPluginHost(
+  runAgent: (options: RunAgentHostOptions) => Promise<void>,
+): PluginHost {
+  return {
+    runAgent,
+    isCloudSystemAgent,
+    isCloudMode,
+    parseOpenbotAuthMode,
+    resolveModelRegistry,
+    listApiKeyProvidersFromRegistry,
+    saveConfig,
+    getBaseDir,
+    resolvePath,
+    orchestratorAgentId: ORCHESTRATOR_AGENT_ID,
+    openbotPluginId: OPENBOT_PLUGIN_ID,
+    defaultCloudAuthMode: DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
+  };
+}
+
+export type { OpenbotAuthMode };

package/src/services/plugins/model-registry.ts

@@ -2,7 +2,11 @@ import {
   DEFAULT_MARKETPLACE_REGISTRY_URL,
   loadConfig,
 } from '../../app/config.js';
-import { isCloudMode } from '../../app/cloud-mode.js';
+import { OPENBOT_PLUGIN_ID } from '../../app/openbot-plugin.js';
+import {
+  DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
+  isCloudMode,
+} from '../../app/cloud-mode.js';
 import type { ConfigSchema, PluginDescriptor } from './domain.js';
 
 export type RegistryProviderCatalog = Record<
@@ -92,9 +96,7 @@ export function listApiKeyProvidersFromRegistry(
 function pickDefaultModelValue(options: RegistryModelOption[]): string | undefined {
   if (options.length === 0) return undefined;
   const values = options.map((option) => option.value);
-  const preferred = isCloudMode()
-    ? values.find((value) => value.startsWith('openbot/'))
-    : values.find((value) => value.startsWith('openai/'));
+  const preferred = values.find((value) => value.startsWith('openai/'));
   return preferred ?? values[0];
 }
 
@@ -102,7 +104,7 @@ export function enrichOpenbotPluginDescriptor(
   descriptor: PluginDescriptor,
   modelOptions: RegistryModelOption[],
 ): PluginDescriptor {
-  if (descriptor.id !== 'openbot' || !descriptor.configSchema) return descriptor;
+  if (descriptor.id !== OPENBOT_PLUGIN_ID || !descriptor.configSchema) return descriptor;
 
   const modelProperty = descriptor.configSchema.properties.model;
   if (!modelProperty) return descriptor;
@@ -133,14 +135,44 @@ export function enrichOpenbotPluginDescriptor(
     nextModelProperty.default = defaultModel;
   }
 
+  const { model: _model, authMode: _authMode, ...otherProperties } =
+    descriptor.configSchema.properties;
+
+  const cloudAuthModeProperty: ConfigSchema['properties'][string] = {
+    type: 'string',
+    description: 'Credits uses OpenBot platform billing. BYOK uses your own API keys.',
+    enum: ['credits', 'byok'],
+    default: DEFAULT_CLOUD_OPENBOT_AUTH_MODE,
+    options: [
+      {
+        label: 'Credits',
+        value: 'credits',
+        description: 'Use OpenBot platform credits.',
+      },
+      {
+        label: 'Bring your own key',
+        value: 'byok',
+        description: 'Use your own provider API keys.',
+      },
+    ],
+  };
+
+  const nextProperties: ConfigSchema['properties'] = isCloudMode()
+    ? {
+        authMode: cloudAuthModeProperty,
+        model: nextModelProperty,
+        ...otherProperties,
+      }
+    : {
+        model: nextModelProperty,
+        ...otherProperties,
+      };
+
   return {
     ...descriptor,
     configSchema: {
       ...descriptor.configSchema,
-      properties: {
-        ...descriptor.configSchema.properties,
-        model: nextModelProperty,
-      },
+      properties: nextProperties,
     },
   };
 }

package/src/services/plugins/registry.ts

@@ -1,17 +1,10 @@
-import fs from 'node:fs';
+import fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import type { Plugin } from './types.js';
-import { openbotPlugin } from '../../plugins/openbot/index.js';
-import { bashPlugin } from '../../plugins/bash/index.js';
 import { storagePlugin } from '../../plugins/storage/index.js';
-import { approvalPlugin } from '../../plugins/approval/index.js';
-import { memoryPlugin } from '../../plugins/memory/index.js';
-import { todoPlugin } from '../../plugins/todo/index.js';
-import { delegationPlugin } from '../../plugins/delegation/index.js';
-import { uiPlugin } from '../../plugins/ui/index.js';
 import { pluginManagerPlugin } from '../../plugins/plugin-manager/index.js';
-import { previewPlugin } from '../../plugins/preview/index.js';
 import { DEFAULT_PLUGINS_DIR, getBaseDir } from '../../app/config.js';
 import {
   invalidatePlugin as clearResolvedPluginEntry,
@@ -22,16 +15,8 @@ import {
 let pluginsDir: string | null = null;
 
 const BUILT_IN: Record<string, Plugin> = {
-  [openbotPlugin.id]: openbotPlugin,
-  [bashPlugin.id]: bashPlugin,
   [storagePlugin.id]: storagePlugin,
-  [approvalPlugin.id]: approvalPlugin,
-  [memoryPlugin.id]: memoryPlugin,
-  [todoPlugin.id]: todoPlugin,
-  [delegationPlugin.id]: delegationPlugin,
-  [uiPlugin.id]: uiPlugin,
   [pluginManagerPlugin.id]: pluginManagerPlugin,
-  [previewPlugin.id]: previewPlugin,
 };
 
 /**
@@ -81,16 +66,12 @@ export function initPlugins(dir?: string) {
 
 /**
  * Resolve a Plugin by id. The id is either:
- *   - a built-in id (e.g. "openbot", "bash"), or
- *   - an npm package name (e.g. "openbot-plugin-foo" or "@scope/foo"),
+ *   - a built-in id (e.g. "storage", "plugin-manager"), or
+ *   - an npm package name (e.g. "@meetopenbot/openbot"),
  *     in which case the folder layout is `plugins/<id>/dist/index.js`.
  */
 export async function resolvePlugin(id: string): Promise<Plugin | null> {
   if (resolvedPluginCache.has(id)) return resolvedPluginCache.get(id)!;
-  if (BUILT_IN[id]) {
-    resolvedPluginCache.set(id, BUILT_IN[id]);
-    return BUILT_IN[id];
-  }
 
   if (!pluginsDir) {
     initPlugins();
@@ -99,29 +80,33 @@ export async function resolvePlugin(id: string): Promise<Plugin | null> {
 
   const distPath = path.join(pluginsDir, id, 'dist', 'index.js');
 
-  if (!fs.existsSync(distPath)) {
-    console.warn(`[plugins] Plugin "${id}" not found at ${distPath}.`);
-    return null;
+  if (existsSync(distPath)) {
+    try {
+      const module = await import(pathToFileURL(distPath).href);
+      const parsed = parsePluginModule(module as Record<string, unknown>);
+      if (!parsed) {
+        console.warn(`[plugins] Plugin "${id}" at ${distPath} has no recognizable export.`);
+      } else {
+        const plugin: Plugin = { id, ...parsed, name: parsed.name || id };
+        resolvedPluginCache.set(id, plugin);
+        if (!loadedCommunityPlugins.has(id)) {
+          console.log(`[plugins] Loaded plugin "${id}" from ${distPath}`);
+          loadedCommunityPlugins.add(id);
+        }
+        return plugin;
+      }
+    } catch (e) {
+      console.warn(`[plugins] Failed to load plugin "${id}" from ${distPath}:`, e);
+    }
   }
 
-  try {
-    const module = await import(pathToFileURL(distPath).href);
-    const parsed = parsePluginModule(module as Record<string, unknown>);
-    if (!parsed) {
-      console.warn(`[plugins] Plugin "${id}" at ${distPath} has no recognizable export.`);
-      return null;
-    }
-    const plugin: Plugin = { id, ...parsed, name: parsed.name || id };
-    resolvedPluginCache.set(id, plugin);
-    if (!loadedCommunityPlugins.has(id)) {
-      console.log(`[plugins] Loaded community plugin "${id}" from ${distPath}`);
-      loadedCommunityPlugins.add(id);
-    }
-    return plugin;
-  } catch (e) {
-    console.warn(`[plugins] Failed to load plugin "${id}" from ${distPath}:`, e);
-    return null;
+  if (BUILT_IN[id]) {
+    resolvedPluginCache.set(id, BUILT_IN[id]);
+    return BUILT_IN[id];
   }
+
+  console.warn(`[plugins] Plugin "${id}" not found at ${distPath}.`);
+  return null;
 }
 
 /** Drop a single id from the in-memory cache (e.g. after fresh install). */

package/src/services/plugins/service.ts

@@ -104,7 +104,9 @@ export function parseMarketplaceRegistryJson(data: unknown): MarketplaceRegistry
       if (!Array.isArray(pluginsRaw)) throw new Error(`agents[${i}].plugins must be an array`);
       const plugins: PluginRef[] = pluginsRaw.map((p, j) => {
         if (!isRecord(p) || typeof p.id !== 'string' || !p.id) {
-          throw new Error(`agents[${i}].plugins[${j}]: expected { "id": string, "config"?: object }`);
+          throw new Error(
+            `agents[${i}].plugins[${j}]: expected { "id": string, "config"?: object }`,
+          );
         }
         const ref: PluginRef = { id: p.id };
         if (p.config !== undefined) {
@@ -263,17 +265,13 @@ export const pluginService = {
         console.warn(`[plugins] Failed to run npm install in ${finalPath}:`, e);
       }
 
-      const pkgJson = JSON.parse(
-        await fs.readFile(path.join(finalPath, 'package.json'), 'utf-8'),
-      );
+      const pkgJson = JSON.parse(await fs.readFile(path.join(finalPath, 'package.json'), 'utf-8'));
 
       invalidatePlugin(packageName);
       return { name: pkgJson.name, version: pkgJson.version };
     } catch (error) {
       console.error(`[plugins] Failed to install ${packageName}:`, error);
-      throw new Error(
-        `Failed to install plugin ${packageName}: ${(error as Error).message}`,
-      );
+      throw new Error(`Failed to install plugin ${packageName}: ${(error as Error).message}`);
     } finally {
       await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
     }
@@ -299,10 +297,7 @@ export const pluginService = {
       }
     } catch (error) {
       console.error(`[plugins] Failed to uninstall ${packageName}:`, error);
-      throw new Error(
-        `Failed to uninstall plugin ${packageName}: ${(error as Error).message}`,
-      );
+      throw new Error(`Failed to uninstall plugin ${packageName}: ${(error as Error).message}`);
     }
   },
 };
-

package/src/services/plugins/types.ts

@@ -5,8 +5,8 @@ import { AgentDetails, ConfigSchema, Storage } from './domain.js';
 /**
  * Reference to a plugin from an agent's AGENT.md frontmatter.
  *
- * The `id` is either a built-in plugin id (e.g. `openbot`, `bash`) or an npm
- * package name (e.g. `openbot-plugin-codex`, `@scope/openbot-plugin-foo`).
+ * The `id` is either a built-in plugin id (e.g. `storage`, `plugin-manager`) or
+ * an npm package name (e.g. `@meetopenbot/openbot`, `openbot-plugin-foo`).
  * Each entry may carry plugin-specific `config`.
  */
 export interface PluginRef {
@@ -20,6 +20,38 @@ export interface ToolDefinition {
   inputSchema: unknown;
 }
 
+/** Options for delegated / nested agent runs via PluginHost.runAgent. */
+export interface RunAgentHostOptions {
+  runId: string;
+  agentId: string;
+  event: OpenBotEvent;
+  channelId: string;
+  threadId?: string;
+  persistEvents?: boolean;
+  publicBaseUrl?: string;
+  onEvent: (event: OpenBotEvent, state?: OpenBotState) => Promise<void>;
+}
+
+/** Host capabilities exposed to community / external agent runtime plugins. */
+export interface PluginHost {
+  runAgent: (options: RunAgentHostOptions) => Promise<void>;
+  isCloudSystemAgent: (agentId: string) => boolean;
+  isCloudMode: () => boolean;
+  parseOpenbotAuthMode: (value: unknown) => 'credits' | 'byok';
+  resolveModelRegistry: () => ReturnType<
+    typeof import('./model-registry.js').resolveModelRegistry
+  >;
+  listApiKeyProvidersFromRegistry: (
+    registry: Awaited<ReturnType<PluginHost['resolveModelRegistry']>>,
+  ) => Array<{ id: string; label: string }>;
+  saveConfig: (patch: Record<string, unknown>) => void;
+  getBaseDir: () => string;
+  resolvePath: (p: string) => string;
+  orchestratorAgentId: string;
+  openbotPluginId: string;
+  defaultCloudAuthMode: 'credits' | 'byok';
+}
+
 /**
  * Context passed to a Plugin factory at runtime.
  *
@@ -37,6 +69,8 @@ export interface PluginContext {
   publicBaseUrl: string;
   /** Signal that fires when this run is stopped; runtimes should pass it to long-running calls. */
   abortSignal?: AbortSignal;
+  /** Platform hooks for external runtime plugins (delegation, cloud auth, config). */
+  host: PluginHost;
 }
 
 /**

package/src/services/todo/types.ts

@@ -0,0 +1,12 @@
+export type TodoStatus = 'pending' | 'in_progress' | 'completed' | 'cancelled';
+
+export type TodoItem = {
+  id: string;
+  content: string;
+  status: TodoStatus;
+};
+
+export type TodoList = {
+  items: TodoItem[];
+  updatedAt: string;
+};

package/src/plugins/approval/index.ts

@@ -1,147 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import type { Plugin } from '../../services/plugins/types.js';
-import { OpenBotEvent } from '../../app/types.js';
-
-/**
- * `approval` — gates protected tool calls behind a UI confirmation widget.
- * 
- * This is a simplified version that intercepts specified actions (default: bash)
- * and requires user approval before they are allowed to proceed.
- */
-
-// In-memory tracking for pending approval IDs with TTL (shared across plugin instances)
-const pendingApprovals = new Map<string, number>();
-const TTL_MS = 4 * 60 * 60 * 1000; // 4 hours
-
-export const approvalPlugin: Plugin = {
-  id: 'approval',
-  name: 'Approval',
-  description: 'Gate protected tool calls behind a UI confirmation widget.',
-  factory: ({ config, storage }) => (builder) => {
-    // Actions that require approval. Defaults to bash.
-    const actionsToApprove = (config.actions as string[]) || ['action:shell_exec'];
-
-    for (const action of actionsToApprove) {
-      builder.intercept(action as OpenBotEvent['type'], (event, context) => {
-        // If already approved in this flow, let it pass to the actual handler
-        if (event.meta?.approvalStatus === 'approved') return event;
-
-        // Otherwise, intercept and ask for approval via a UI widget
-        const displayData = JSON.stringify((event as any)?.data) || '';
-
-        const widgetId = randomUUID();
-        pendingApprovals.set(widgetId, Date.now());
-
-        return {
-          type: 'client:ui:widget',
-          data: {
-            widgetId,
-            kind: 'message',
-            title: `The agent wants to perform \`${action}\``,
-            body: displayData,
-            metadata: {
-              type: 'approval:request',
-              originalEvent: event,
-            },
-            actions: [
-              { id: 'approve', label: 'Approve', variant: 'primary' },
-              { id: 'deny', label: 'Deny', variant: 'danger' },
-            ],
-          },
-          meta: { agentId: context.state.agentId, threadId: context.state.threadId },
-        } as OpenBotEvent;
-      });
-    }
-
-    // Handle the user's response from the UI widget
-    builder.on('client:ui:widget:response', async function* (event, context) {
-      const { widgetId, actionId } = event.data;
-      const metadata = event.data?.metadata;
-      if (metadata?.type !== 'approval:request') return;
-
-      // Verify the widget is still pending and hasn't expired
-      if (!widgetId || !pendingApprovals.has(widgetId)) {
-        console.warn(`[approval] Received response for unknown or already handled widget: ${widgetId}`);
-        return;
-      }
-
-      const timestamp = pendingApprovals.get(widgetId)!;
-      if (Date.now() - timestamp > TTL_MS) {
-        pendingApprovals.delete(widgetId);
-        console.warn(`[approval] Received response for expired widget: ${widgetId}`);
-        return;
-      }
-
-      // Mark as handled
-      pendingApprovals.delete(widgetId);
-
-      const originalEvent = metadata.originalEvent as OpenBotEvent;
-      const approved = actionId === 'approve';
-
-      const displayData = JSON.stringify((event as any)?.data) || '';
-
-      // Yield a "responded" widget update to the UI
-      yield {
-        type: 'client:ui:widget',
-        data: {
-          widgetId,
-          kind: 'message',
-          title: `Action ${approved ? 'Approved' : 'Denied'}`,
-          body: displayData,
-          state: approved ? 'submitted' : 'cancelled',
-          display: 'collapsed',
-          disabled: true,
-          actions: [], // Clear actions to disable buttons in UI
-        },
-        meta: { agentId: context.state.agentId, threadId: context.state.threadId },
-      } as OpenBotEvent;
-
-      if (approved) {
-        // Re-emit the original event with approved status so the actual handler can run
-        yield {
-          ...originalEvent,
-          meta: {
-            ...(originalEvent.meta || {}),
-            approvalStatus: 'approved',
-          },
-        };
-      } else {
-        // Manually store the original event with denied status so it's recorded in history
-        // but NOT re-emitted to the pipeline (to avoid actual execution).
-        if (storage) {
-          await storage.storeEvent({
-            channelId: context.state.channelId,
-            threadId: context.state.threadId,
-            event: {
-              ...originalEvent,
-              meta: {
-                ...(originalEvent.meta || {}),
-                approvalStatus: 'denied',
-              },
-            },
-          });
-        }
-
-        // Emit a failure result event for the denied action to clear the pending tool batch
-        yield {
-          type: `${originalEvent.type}:result` as OpenBotEvent['type'],
-          data: {
-            success: false,
-            error: 'Action denied by user.',
-            stderr: 'Action denied by user.',
-            output: 'Action denied by user.',
-          },
-          meta: originalEvent.meta,
-        } as OpenBotEvent;
-
-        yield {
-          type: 'agent:output',
-          data: { content: `Action \`${originalEvent.type}\` was denied.` },
-          meta: { agentId: context.state.agentId },
-        } as OpenBotEvent;
-      }
-    });
-  },
-};
-
-export default approvalPlugin;