osborn 0.9.223 → 0.9.224

package/dist/boot-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * boot-secrets.ts — side-effect module that hydrates user secrets from the Fly
+ * volume into process.env at the EARLIEST possible point.
+ *
+ * Why a separate module instead of a call in index.ts: ES module imports are
+ * hoisted and their bodies run in source order BEFORE any statement in the
+ * importing module. Some consumers read their keys at module-load time
+ * (recall-client.ts reads RECALL_REGION into a top-level const; claude-auth is
+ * called later but still expects env present). Importing THIS module
+ * immediately after `dotenv/config` — and before every other agent import —
+ * guarantees hydrateSecretsIntoEnv() runs before those bodies evaluate, so the
+ * volume-persisted user keys win over machine-env defaults.
+ *
+ * Keep this import positioned second in index.ts (right after dotenv/config).
+ */
+export {};

package/dist/boot-secrets.js

@@ -0,0 +1,17 @@
+/**
+ * boot-secrets.ts — side-effect module that hydrates user secrets from the Fly
+ * volume into process.env at the EARLIEST possible point.
+ *
+ * Why a separate module instead of a call in index.ts: ES module imports are
+ * hoisted and their bodies run in source order BEFORE any statement in the
+ * importing module. Some consumers read their keys at module-load time
+ * (recall-client.ts reads RECALL_REGION into a top-level const; claude-auth is
+ * called later but still expects env present). Importing THIS module
+ * immediately after `dotenv/config` — and before every other agent import —
+ * guarantees hydrateSecretsIntoEnv() runs before those bodies evaluate, so the
+ * volume-persisted user keys win over machine-env defaults.
+ *
+ * Keep this import positioned second in index.ts (right after dotenv/config).
+ */
+import { hydrateSecretsIntoEnv } from './secrets-store.js';
+hydrateSecretsIntoEnv();

package/dist/env-keys.d.ts

@@ -25,3 +25,16 @@ export declare const AGENT_ENV_KEYS: AgentEnvKey[];
 export declare const REQUIRED_AGENT_ENV_KEYS: string[];
 /** Return the required keys that are missing from the given env (default process.env). */
 export declare function missingRequiredEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * Keys a user may add/rotate live (mid-session, no reboot) via the /secrets
+ * endpoint. These are read by osborn's OWN code (not baked into a plugin SDK at
+ * import time), so writing process.env[KEY] + persisting to the volume takes
+ * effect on the next read — see secrets-store.ts. This is the allowlist: the
+ * /secrets endpoint rejects any key not in this set, so a user can never inject
+ * platform/infra keys (FLY_*, LIVEKIT_*, SMITHERY_API_KEY, tokens, etc.).
+ *
+ * Mirrors the scope:'user' entries in frontend/src/lib/platform-env.ts.
+ */
+export declare const USER_SECRET_KEYS: string[];
+/** True if `key` is a user-manageable secret (allowlisted for /secrets writes). */
+export declare function isUserSecretKey(key: string): boolean;

package/dist/env-keys.js

@@ -45,3 +45,23 @@ export const REQUIRED_AGENT_ENV_KEYS = AGENT_ENV_KEYS
 export function missingRequiredEnv(env = process.env) {
     return REQUIRED_AGENT_ENV_KEYS.filter((k) => !env[k]);
 }
+/**
+ * Keys a user may add/rotate live (mid-session, no reboot) via the /secrets
+ * endpoint. These are read by osborn's OWN code (not baked into a plugin SDK at
+ * import time), so writing process.env[KEY] + persisting to the volume takes
+ * effect on the next read — see secrets-store.ts. This is the allowlist: the
+ * /secrets endpoint rejects any key not in this set, so a user can never inject
+ * platform/infra keys (FLY_*, LIVEKIT_*, SMITHERY_API_KEY, tokens, etc.).
+ *
+ * Mirrors the scope:'user' entries in frontend/src/lib/platform-env.ts.
+ */
+export const USER_SECRET_KEYS = [
+    'ANTHROPIC_API_KEY',
+    'OPENROUTER_API_KEY',
+    'RECALL_API_KEY',
+    'RECALL_REGION',
+];
+/** True if `key` is a user-manageable secret (allowlisted for /secrets writes). */
+export function isUserSecretKey(key) {
+    return USER_SECRET_KEYS.includes(key);
+}

package/dist/index.d.ts

@@ -1 +1,2 @@
 import 'dotenv/config';
+import './boot-secrets.js';

package/dist/index.js

@@ -1,5 +1,9 @@
 // Load environment variables FIRST before any other imports
 import 'dotenv/config';
+// Then hydrate volume-persisted user secrets into process.env, BEFORE any
+// module that reads its keys at load time (recall-client's RECALL_REGION const,
+// claude-auth fallback). Side-effect import — must stay right after dotenv.
+import './boot-secrets.js';
 import { voice, initializeLogger } from '@livekit/agents';
 import { CloudTurnDetector } from './turn-detector-shim.js';
 import { Room, RoomEvent, } from '@livekit/rtc-node';
@@ -41,6 +45,7 @@ import { MCP_CATALOG } from './config.js';
 import { getRecallClient } from './recall-client.js';
 import { MeetingTranscriptPoller } from './meeting-transcript-poller.js';
 import { missingRequiredEnv } from './env-keys.js';
+import { listSecretStatus, setSecrets, deleteSecret } from './secrets-store.js';
 import { llm } from '@livekit/agents';
 // ============================================================
 // PIPELINE MODE: STT (Deepgram) → Claude Agent SDK → TTS
@@ -304,6 +309,7 @@ const AGENT_ROUTE_PREFIXES = [
     '/canvas-stream', '/events', '/room-code', '/connect-room', '/leave-room',
     '/report-bug', '/restart', '/tts', '/webhook', '/sessions/export',
     '/sessions/import', '/sessions/manifest',
+    '/secrets',
     '/editor',
 ];
 // Set true when code-server is confirmed ready; false when stopped/not running.
@@ -1519,6 +1525,65 @@ function startApiServer(workingDir, port) {
             }
             return;
         }
+        // ── /secrets ── user-manageable API keys (live, no reboot) ───────────────
+        // GET  → status of each user key (set?/masked/source) — NEVER raw values.
+        // POST → { KEY: value, ... } set/rotate; empty string deletes. Allowlist-
+        //        filtered (USER_SECRET_KEYS); writes the volume store + process.env.
+        // DELETE ?key=KEY → remove one key.
+        // Auth is REQUIRED here (unlike the soft export/import gate): if the machine
+        // has no OSBORN_SYNC_TOKEN we refuse rather than expose an open write path.
+        if (url.pathname === '/secrets') {
+            if (!syncToken) {
+                res.writeHead(503, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Secrets endpoint unavailable: no sync token configured' }));
+                return;
+            }
+            const authHeader = req.headers['authorization'] ?? '';
+            if (authHeader !== `Bearer ${syncToken}`) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized' }));
+                return;
+            }
+            if (req.method === 'GET') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ secrets: listSecretStatus() }));
+                return;
+            }
+            if (req.method === 'POST') {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk.toString(); });
+                req.on('end', () => {
+                    try {
+                        const parsed = JSON.parse(body || '{}');
+                        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Body must be a JSON object of { KEY: value }' }));
+                            return;
+                        }
+                        const result = setSecrets(parsed);
+                        console.log(`🔑 /secrets POST — set:[${result.set.join(',')}] deleted:[${result.deleted.join(',')}] rejected:[${result.rejected.join(',')}]`);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ...result, secrets: listSecretStatus() }));
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+                    }
+                });
+                return;
+            }
+            if (req.method === 'DELETE') {
+                const key = url.searchParams.get('key') ?? '';
+                const existed = deleteSecret(key);
+                console.log(`🔑 /secrets DELETE ${key} — ${existed ? 'removed' : 'not present / not allowed'}`);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ deleted: existed, key, secrets: listSecretStatus() }));
+                return;
+            }
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
         // ── /editor entry point ──────────────────────────────────────────────────
         // Explicit door into the IDE. When code-server is ready this route mints the
         // osborn_ide session cookie and 302s to / (where the proxy then forwards). If

package/dist/secrets-store.d.ts

@@ -0,0 +1,61 @@
+/**
+ * secrets-store.ts — volume-persisted store for user-manageable API keys.
+ *
+ * Osborn's platform keys (LiveKit, Deepgram, Smithery, Fly infra) are injected
+ * as machine env by the frontend and only change on reboot — fine, they rarely
+ * rotate. But a *user* adding their own Anthropic / OpenRouter / Recall key
+ * mid-conversation must take effect WITHOUT a reboot (the OS can't hot-inject
+ * env into a running process). So those keys live here instead of in machine
+ * env: a JSON file on the Fly volume (`~/.osborn/secrets.json` →
+ * `/workspace/.osborn/secrets.json`, survives restart AND recreate) that we
+ * ALSO mirror into process.env so osborn's own code (which reads process.env)
+ * picks them up on the next read.
+ *
+ * Security:
+ *   • Writes are allowlist-filtered by USER_SECRET_KEYS — a user can never set
+ *     a platform/infra key (FLY_*, LIVEKIT_*, tokens…) through this path.
+ *   • File is written mode 0600.
+ *   • Secret VALUES are never returned by listSecretStatus() — status only.
+ *
+ * Keep the allowlist in sync with env-keys.ts (USER_SECRET_KEYS) and the
+ * frontend platform-env.ts scope:'user' entries.
+ */
+export interface SecretStatus {
+    key: string;
+    /** true if a non-empty value is currently set (in the store or process.env). */
+    set: boolean;
+    /** true if this key holds a credential (masked); false = plain config (e.g. region). */
+    secret: boolean;
+    /** masked preview — never the raw value; empty string when unset. */
+    masked: string;
+    /** where the current value came from, for the UI. */
+    source: 'store' | 'env' | 'none';
+}
+export interface SetSecretsResult {
+    set: string[];
+    deleted: string[];
+    rejected: string[];
+}
+/** Return the current store (allowlist-filtered), without touching env. */
+export declare function loadSecrets(): Record<string, string>;
+/**
+ * Copy stored user secrets into process.env so osborn's own code sees them.
+ * Call ONCE at bootstrap, BEFORE applyAuthFallback() and before recall-client
+ * is imported (both read these keys at module/boot time). Store values win over
+ * pre-existing machine env only when non-empty. Returns the keys hydrated.
+ */
+export declare function hydrateSecretsIntoEnv(): string[];
+/**
+ * Set (or delete) user secrets. An empty-string value deletes the key.
+ * Writes the volume file AND mirrors into process.env for live effect.
+ * Keys not in USER_SECRET_KEYS are rejected (never written).
+ */
+export declare function setSecrets(entries: Record<string, unknown>): SetSecretsResult;
+/** Delete a single user secret. */
+export declare function deleteSecret(key: string): boolean;
+/**
+ * Report which user keys are set — WITHOUT returning raw values. Considers both
+ * the store and the live process.env (so a key injected as machine env still
+ * shows as "set", sourced 'env'). Values are masked.
+ */
+export declare function listSecretStatus(): SecretStatus[];

package/dist/secrets-store.js

@@ -0,0 +1,168 @@
+/**
+ * secrets-store.ts — volume-persisted store for user-manageable API keys.
+ *
+ * Osborn's platform keys (LiveKit, Deepgram, Smithery, Fly infra) are injected
+ * as machine env by the frontend and only change on reboot — fine, they rarely
+ * rotate. But a *user* adding their own Anthropic / OpenRouter / Recall key
+ * mid-conversation must take effect WITHOUT a reboot (the OS can't hot-inject
+ * env into a running process). So those keys live here instead of in machine
+ * env: a JSON file on the Fly volume (`~/.osborn/secrets.json` →
+ * `/workspace/.osborn/secrets.json`, survives restart AND recreate) that we
+ * ALSO mirror into process.env so osborn's own code (which reads process.env)
+ * picks them up on the next read.
+ *
+ * Security:
+ *   • Writes are allowlist-filtered by USER_SECRET_KEYS — a user can never set
+ *     a platform/infra key (FLY_*, LIVEKIT_*, tokens…) through this path.
+ *   • File is written mode 0600.
+ *   • Secret VALUES are never returned by listSecretStatus() — status only.
+ *
+ * Keep the allowlist in sync with env-keys.ts (USER_SECRET_KEYS) and the
+ * frontend platform-env.ts scope:'user' entries.
+ */
+import { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { USER_SECRET_KEYS, isUserSecretKey } from './env-keys.js';
+const SECRETS_DIR = join(homedir(), '.osborn');
+const SECRETS_FILE = join(SECRETS_DIR, 'secrets.json');
+/** Keys whose values must be masked in any status readout (all except RECALL_REGION). */
+const NON_SECRET_KEYS = new Set(['RECALL_REGION']);
+/** Read the on-disk store. Returns {} if missing/unreadable. */
+function readStore() {
+    if (!existsSync(SECRETS_FILE))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(SECRETS_FILE, 'utf-8'));
+        if (parsed && typeof parsed === 'object')
+            return parsed;
+        return {};
+    }
+    catch (err) {
+        console.error(`❌ Failed to read secrets store: ${err.message}`);
+        return {};
+    }
+}
+/** Write the store atomically-ish with 0600 perms. */
+function writeStore(store) {
+    if (!existsSync(SECRETS_DIR)) {
+        mkdirSync(SECRETS_DIR, { recursive: true });
+    }
+    writeFileSync(SECRETS_FILE, JSON.stringify(store, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(SECRETS_FILE, 0o600);
+    }
+    catch {
+        // best-effort; some filesystems ignore chmod
+    }
+}
+/** Return the current store (allowlist-filtered), without touching env. */
+export function loadSecrets() {
+    const store = readStore();
+    const clean = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            clean[k] = v;
+    }
+    return clean;
+}
+/**
+ * Copy stored user secrets into process.env so osborn's own code sees them.
+ * Call ONCE at bootstrap, BEFORE applyAuthFallback() and before recall-client
+ * is imported (both read these keys at module/boot time). Store values win over
+ * pre-existing machine env only when non-empty. Returns the keys hydrated.
+ */
+export function hydrateSecretsIntoEnv() {
+    const store = loadSecrets();
+    const applied = [];
+    for (const [k, v] of Object.entries(store)) {
+        process.env[k] = v;
+        applied.push(k);
+    }
+    if (applied.length > 0) {
+        console.log(`🔑 Hydrated ${applied.length} user secret(s) from volume: ${applied.join(', ')}`);
+    }
+    return applied;
+}
+/**
+ * Set (or delete) user secrets. An empty-string value deletes the key.
+ * Writes the volume file AND mirrors into process.env for live effect.
+ * Keys not in USER_SECRET_KEYS are rejected (never written).
+ */
+export function setSecrets(entries) {
+    const store = readStore();
+    const result = { set: [], deleted: [], rejected: [] };
+    for (const [rawKey, rawVal] of Object.entries(entries)) {
+        const key = rawKey.trim();
+        if (!isUserSecretKey(key)) {
+            result.rejected.push(key);
+            continue;
+        }
+        const val = typeof rawVal === 'string' ? rawVal.trim() : '';
+        if (val.length === 0) {
+            // delete
+            delete store[key];
+            delete process.env[key];
+            result.deleted.push(key);
+        }
+        else {
+            store[key] = val;
+            process.env[key] = val;
+            result.set.push(key);
+        }
+    }
+    // Only persist allowlisted keys (drop any stale non-allowlisted entries too).
+    const persisted = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            persisted[k] = v;
+    }
+    writeStore(persisted);
+    return result;
+}
+/** Delete a single user secret. */
+export function deleteSecret(key) {
+    if (!isUserSecretKey(key))
+        return false;
+    const store = readStore();
+    const existed = key in store;
+    delete store[key];
+    delete process.env[key];
+    const persisted = {};
+    for (const [k, v] of Object.entries(store)) {
+        if (isUserSecretKey(k) && typeof v === 'string' && v.length > 0)
+            persisted[k] = v;
+    }
+    writeStore(persisted);
+    return existed;
+}
+function mask(value) {
+    if (!value)
+        return '';
+    if (value.length <= 8)
+        return '••••';
+    return `${value.slice(0, 4)}••••${value.slice(-4)}`;
+}
+/**
+ * Report which user keys are set — WITHOUT returning raw values. Considers both
+ * the store and the live process.env (so a key injected as machine env still
+ * shows as "set", sourced 'env'). Values are masked.
+ */
+export function listSecretStatus() {
+    const store = readStore();
+    return USER_SECRET_KEYS.map((key) => {
+        const inStore = typeof store[key] === 'string' && store[key].length > 0;
+        const envVal = process.env[key];
+        const inEnv = typeof envVal === 'string' && envVal.length > 0;
+        const value = inStore ? store[key] : inEnv ? envVal : '';
+        const isSecret = !NON_SECRET_KEYS.has(key);
+        return {
+            key,
+            set: inStore || inEnv,
+            secret: isSecret,
+            // Non-secret config (region) can be shown in full; credentials are masked.
+            masked: value ? (isSecret ? mask(value) : value) : '',
+            source: inStore ? 'store' : inEnv ? 'env' : 'none',
+        };
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.223",
+  "version": "0.9.224",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {