verybot 0.1.3

package/dist/config/store.js

@@ -0,0 +1,143 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { logger } from "../logger.js";
+/** Patterns that identify sensitive config keys by name. */
+const SENSITIVE_PATTERNS = [/token/i, /password/i, /secret/i, /api.?key/i];
+/** Check whether a config key name looks sensitive. */
+function isSensitiveKey(key) {
+    return SENSITIVE_PATTERNS.some((p) => p.test(key));
+}
+/** Minimum chars to show prefix/suffix in redaction. */
+const REDACT_MIN_LENGTH = 10;
+const REDACT_PREFIX = 6;
+const REDACT_SUFFIX = 4;
+const REDACT_MARKER = "...";
+/**
+ * Manages a single `config.json` file on disk.
+ * Handles reading, writing, patching, and redaction of secret values.
+ */
+export class ConfigStore {
+    filePath;
+    constructor(baseDir) {
+        this.filePath = join(baseDir, "config.json");
+    }
+    /** Read config from disk. Returns empty object if file doesn't exist. */
+    load() {
+        try {
+            if (!existsSync(this.filePath))
+                return {};
+            const raw = readFileSync(this.filePath, "utf-8");
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            logger.warn(`Failed to read config.json: ${err instanceof Error ? err.message : err}`);
+            return {};
+        }
+    }
+    /** Write full config to disk atomically (temp file → rename). */
+    save(data) {
+        const dir = dirname(this.filePath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const tmp = join(tmpdir(), `config-${randomUUID()}.json`);
+        writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", "utf-8");
+        renameSync(tmp, this.filePath);
+        logger.info(`Config saved to ${this.filePath}`);
+    }
+    /** Deep-merge a partial update into the existing config and save. */
+    patch(partial) {
+        const existing = this.load();
+        const merged = deepMerge(existing, partial);
+        this.save(merged);
+        return merged;
+    }
+    /** Return config with secret values redacted. */
+    getRedacted() {
+        const data = this.load();
+        return redactSecrets(data);
+    }
+    /**
+     * Given an incoming config (possibly with redacted values from the UI),
+     * restore redacted secrets from the existing disk values before saving.
+     */
+    patchFromUI(incoming) {
+        const existing = this.load();
+        const restored = restoreRedacted(incoming, existing);
+        return this.patch(restored);
+    }
+    /** Return file mtime in ms, or null if file doesn't exist. */
+    mtime() {
+        try {
+            return statSync(this.filePath).mtimeMs;
+        }
+        catch {
+            return null;
+        }
+    }
+    getFilePath() {
+        return this.filePath;
+    }
+}
+/** Redact secret values in a config object. */
+function redactSecrets(data) {
+    const result = { ...data };
+    for (const key of Object.keys(result)) {
+        if (isSensitiveKey(key) && typeof result[key] === "string") {
+            result[key] = redactValue(result[key]);
+        }
+    }
+    return result;
+}
+/** Mask a secret string: show prefix...suffix for long values, **** for short ones. */
+function redactValue(value) {
+    if (!value)
+        return "";
+    if (value.length < REDACT_MIN_LENGTH)
+        return "****";
+    return (value.slice(0, REDACT_PREFIX) + REDACT_MARKER + value.slice(-REDACT_SUFFIX));
+}
+/**
+ * If a value in `incoming` looks like it's still redacted (matches the pattern
+ * from `redactValue`), replace it with the original from `existing`.
+ */
+function restoreRedacted(incoming, existing) {
+    const result = { ...incoming };
+    for (const key of Object.keys(result)) {
+        if (!isSensitiveKey(key))
+            continue;
+        const inVal = result[key];
+        const exVal = existing[key];
+        if (typeof inVal !== "string" || typeof exVal !== "string")
+            continue;
+        // If the incoming value matches the redacted form of the existing value, keep existing
+        if (inVal === redactValue(exVal)) {
+            result[key] = exVal;
+        }
+    }
+    return result;
+}
+/** Keys that should be replaced wholesale instead of deep-merged. */
+const REPLACE_KEYS = new Set(["mcpServers"]);
+/** Simple deep merge: objects are merged recursively, primitives/arrays are overwritten. */
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const [key, val] of Object.entries(source)) {
+        if (REPLACE_KEYS.has(key)) {
+            result[key] = val;
+        }
+        else if (val !== null &&
+            typeof val === "object" &&
+            !Array.isArray(val) &&
+            typeof result[key] === "object" &&
+            result[key] !== null &&
+            !Array.isArray(result[key])) {
+            result[key] = deepMerge(result[key], val);
+        }
+        else {
+            result[key] = val;
+        }
+    }
+    return result;
+}

package/dist/config.d.ts

@@ -0,0 +1,103 @@
+import type { ConfigStore } from "./config/store.js";
+import type { MarkdownTableMode } from "./markdown/ir.js";
+export type BashSecurityMode = "deny" | "allowlist" | "full";
+export interface BashConfig {
+    security: BashSecurityMode;
+    safeBins: string[];
+    allowlist: string[];
+}
+interface SandboxConfig {
+    enabled: boolean;
+    image: string;
+    memoryLimit: string;
+    pidsLimit: number;
+    idleTimeoutMs: number;
+}
+interface DesktopConfig {
+    enabled: boolean;
+}
+export interface McpServerConfig {
+    /** Command to spawn (stdio transport — inferred when present). */
+    command?: string;
+    /** Arguments for the command (stdio only). */
+    args?: string[];
+    /** Extra environment variables for the subprocess (stdio only). */
+    env?: Record<string, string>;
+    /** Server URL (SSE transport — inferred when present). */
+    url?: string;
+}
+export interface Config {
+    gateway: {
+        port: number;
+        token: string;
+    };
+    model: {
+        provider: string;
+        id: string;
+        maxSteps: number;
+        contextWindow: number;
+    };
+    browserHeadless: boolean;
+    browserUserAgent: string;
+    language: string;
+    identity: string;
+    bash: BashConfig;
+    sandbox: SandboxConfig;
+    desktop: DesktopConfig;
+    memory: {
+        enabled: boolean;
+        maxResults: number;
+    };
+    channels: {
+        telegram?: {
+            token: string;
+            markdown?: {
+                tables?: MarkdownTableMode;
+            };
+        };
+        discord?: {
+            token: string;
+            markdown?: {
+                tables?: MarkdownTableMode;
+            };
+        };
+        slack?: {
+            botToken: string;
+            appToken: string;
+            markdown?: {
+                tables?: MarkdownTableMode;
+            };
+        };
+        whatsapp?: {
+            phoneId: string;
+            selfOnly?: boolean;
+            markdown?: {
+                tables?: MarkdownTableMode;
+            };
+        };
+    };
+    mcpServers: Record<string, McpServerConfig>;
+    tts: {
+        enabled: boolean;
+        voice: string;
+        replyMode: "text" | "voice" | "inbound";
+    };
+}
+/**
+ * Inject API keys from config.json into process.env so AI SDK providers work.
+ * Only sets values that are non-empty and not already set in the environment.
+ */
+export declare function injectSecretsIntoEnv(store: ConfigStore): void;
+/** Generate a cryptographically random gateway token (URL-safe base64, 32 bytes). */
+export declare function generateGatewayToken(): string;
+/**
+ * Create initial config.json with all configurable keys and defaults.
+ * Only runs when config.json doesn't exist yet.
+ */
+export declare function seedConfigStore(store: ConfigStore): void;
+/**
+ * Load config exclusively from config.json (via ConfigStore).
+ * No .env fallbacks — config.json is the sole source of truth.
+ */
+export declare function loadConfig(store: ConfigStore): Config;
+export {};

package/dist/config.js

@@ -0,0 +1,224 @@
+import { randomBytes } from "node:crypto";
+import { logger } from "./logger.js";
+function parseModel(raw) {
+    const [provider, ...rest] = raw.split(":");
+    return { provider, id: rest.join(":") };
+}
+function parseMcpServers(raw) {
+    if (!raw)
+        return {};
+    if (typeof raw === "object" && !Array.isArray(raw))
+        return raw;
+    if (typeof raw === "string") {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            return {};
+        }
+        catch {
+            return {};
+        }
+    }
+    return {};
+}
+/** Safely read a nested value with a fallback. */
+function get(val, fallback) {
+    return val !== undefined && val !== null ? val : fallback;
+}
+/**
+ * Secrets in config.json that must be injected into process.env
+ * so AI SDKs can find them. Key = config field, value = env var name.
+ */
+const ENV_SECRET_MAP = {
+    ANTHROPIC_API_KEY: "ANTHROPIC_API_KEY",
+    OPENAI_API_KEY: "OPENAI_API_KEY",
+    GOOGLE_GENERATIVE_AI_API_KEY: "GOOGLE_GENERATIVE_AI_API_KEY",
+    XAI_API_KEY: "XAI_API_KEY",
+    MISTRAL_API_KEY: "MISTRAL_API_KEY",
+    GROQ_API_KEY: "GROQ_API_KEY",
+    TOGETHER_AI_API_KEY: "TOGETHER_AI_API_KEY",
+    DEEPSEEK_API_KEY: "DEEPSEEK_API_KEY",
+    OPENROUTER_API_KEY: "OPENROUTER_API_KEY",
+    OLLAMA_BASE_URL: "OLLAMA_BASE_URL",
+};
+/**
+ * Inject API keys from config.json into process.env so AI SDK providers work.
+ * Only sets values that are non-empty and not already set in the environment.
+ */
+export function injectSecretsIntoEnv(store) {
+    const data = store.load();
+    for (const [configKey, envKey] of Object.entries(ENV_SECRET_MAP)) {
+        const val = data[configKey];
+        if (typeof val === "string" && val) {
+            process.env[envKey] = val;
+        }
+    }
+}
+const GATEWAY_TOKEN_BYTES = 32;
+/** Generate a cryptographically random gateway token (URL-safe base64, 32 bytes). */
+export function generateGatewayToken() {
+    return randomBytes(GATEWAY_TOKEN_BYTES).toString("base64url");
+}
+/**
+ * Create initial config.json with all configurable keys and defaults.
+ * Only runs when config.json doesn't exist yet.
+ */
+export function seedConfigStore(store) {
+    const existing = store.load();
+    if (Object.keys(existing).length > 0)
+        return;
+    const seed = {
+        // Model
+        model: "anthropic:claude-sonnet-4-5-20250929",
+        maxSteps: 20,
+        browserHeadless: true,
+        browserUserAgent: "",
+        // Agent
+        language: "auto",
+        identity: "You are a helpful personal assistant.",
+        // Gateway
+        gateway: { port: 28789 },
+        // Bash
+        bash: { security: "full", safeBins: [], allowlist: [] },
+        // Sandbox
+        sandbox: {
+            enabled: false,
+            image: "ubuntu:24.04",
+            memoryLimit: "256m",
+            pidsLimit: 64,
+            idleTimeoutMs: 300_000,
+        },
+        // Desktop
+        desktop: { enabled: false },
+        // Memory
+        memory: { enabled: true, maxResults: 5 },
+        // TTS
+        tts: { enabled: true, voice: "en-US-AriaNeural", replyMode: "inbound" },
+        // MCP servers
+        mcpServers: {},
+        // Secrets (empty — set via web UI)
+        ANTHROPIC_API_KEY: "",
+        OPENAI_API_KEY: "",
+        GOOGLE_GENERATIVE_AI_API_KEY: "",
+        XAI_API_KEY: "",
+        MISTRAL_API_KEY: "",
+        GROQ_API_KEY: "",
+        TOGETHER_AI_API_KEY: "",
+        DEEPSEEK_API_KEY: "",
+        OPENROUTER_API_KEY: "",
+        OLLAMA_BASE_URL: "",
+        GATEWAY_TOKEN: generateGatewayToken(),
+        TELEGRAM_BOT_TOKEN: "",
+        DISCORD_BOT_TOKEN: "",
+        SLACK_BOT_TOKEN: "",
+        SLACK_APP_TOKEN: "",
+        WHATSAPP_PHONE_ID: "",
+        TWITTER_BEARER_TOKEN: "",
+        TWITTER_API_KEY: "",
+        TWITTER_API_SECRET: "",
+        TWITTER_ACCESS_TOKEN: "",
+        TWITTER_ACCESS_SECRET: "",
+        GITHUB_TOKEN: "",
+        GITHUB_DEFAULT_OWNER: "",
+    };
+    store.save(seed);
+}
+/**
+ * Load config exclusively from config.json (via ConfigStore).
+ * No .env fallbacks — config.json is the sole source of truth.
+ */
+export function loadConfig(store) {
+    const s = store.load();
+    const modelRaw = get(s.model, "anthropic:claude-sonnet-4-5-20250929");
+    const gateway = (s.gateway ?? {});
+    const bash = (s.bash ?? {});
+    const sandbox = (s.sandbox ?? {});
+    const memory = (s.memory ?? {});
+    const tts = (s.tts ?? {});
+    const legacyMcp = s.mcp ?? {};
+    const identityStr = get(s.identity, "You are a helpful personal assistant.");
+    const telegramToken = get(s.TELEGRAM_BOT_TOKEN, "");
+    const discordToken = get(s.DISCORD_BOT_TOKEN, "");
+    const slackBotToken = get(s.SLACK_BOT_TOKEN, "");
+    const slackAppToken = get(s.SLACK_APP_TOKEN, "");
+    const whatsappPhoneId = get(s.WHATSAPP_PHONE_ID, "");
+    const channelsCfg = (s.channels ?? {});
+    // Auto-generate a gateway token if missing or empty
+    let gatewayToken = s.GATEWAY_TOKEN || "";
+    if (!gatewayToken) {
+        gatewayToken = generateGatewayToken();
+        store.patch({ GATEWAY_TOKEN: gatewayToken });
+        logger.info(`Generated new \x1b[36mGATEWAY_TOKEN\x1b[0m: \x1b[1m\x1b[33m${gatewayToken}\x1b[0m`);
+    }
+    logger.info(`\x1b[36mGATEWAY_TOKEN\x1b[0m: \x1b[1m\x1b[33m${gatewayToken}\x1b[0m`);
+    return {
+        gateway: {
+            port: Number(get(gateway.port, 28789)),
+            token: gatewayToken,
+        },
+        model: {
+            ...parseModel(modelRaw),
+            maxSteps: Number(get(s.maxSteps, 20)),
+            contextWindow: Number(get(s.contextWindow, 0)),
+        },
+        browserHeadless: get(s.browserHeadless, true),
+        browserUserAgent: get(s.browserUserAgent, ""),
+        language: get(s.language, "auto"),
+        identity: identityStr,
+        bash: {
+            security: get(bash.security, "full"),
+            safeBins: get(bash.safeBins, []),
+            allowlist: get(bash.allowlist, []),
+        },
+        sandbox: {
+            enabled: get(sandbox.enabled, false),
+            image: get(sandbox.image, "ubuntu:24.04"),
+            memoryLimit: get(sandbox.memoryLimit, "256m"),
+            pidsLimit: Number(get(sandbox.pidsLimit, 64)),
+            idleTimeoutMs: Number(get(sandbox.idleTimeoutMs, 300_000)),
+        },
+        desktop: {
+            enabled: get(s.desktop?.enabled, false),
+        },
+        memory: {
+            enabled: get(memory.enabled, true),
+            maxResults: Number(get(memory.maxResults, 5)),
+        },
+        channels: {
+            telegram: telegramToken
+                ? {
+                    token: telegramToken,
+                    markdown: channelsCfg.telegram?.markdown ?? undefined,
+                }
+                : undefined,
+            discord: discordToken
+                ? {
+                    token: discordToken,
+                    markdown: channelsCfg.discord?.markdown ?? undefined,
+                }
+                : undefined,
+            slack: slackBotToken && slackAppToken
+                ? {
+                    botToken: slackBotToken,
+                    appToken: slackAppToken,
+                    markdown: channelsCfg.slack?.markdown ?? undefined,
+                }
+                : undefined,
+            whatsapp: whatsappPhoneId
+                ? {
+                    phoneId: whatsappPhoneId,
+                    selfOnly: get(channelsCfg.whatsapp?.selfOnly, false),
+                    markdown: channelsCfg.whatsapp?.markdown ?? undefined,
+                }
+                : undefined,
+        },
+        mcpServers: parseMcpServers(s.mcpServers ?? legacyMcp.servers),
+        tts: {
+            enabled: get(tts.enabled, true),
+            voice: get(tts.voice, "en-US-AriaNeural"),
+            replyMode: get(tts.replyMode, "inbound"),
+        },
+    };
+}