wispy-cli 0.3.0 → 0.3.2

package/lib/wispy-repl.mjs

@@ -724,6 +724,20 @@ const TOOL_DEFINITIONS = [
       required: ["url"],
     },
   },
+  {
+    name: "keychain",
+    description: "Manage macOS Keychain secrets. Read (masked), store, or delete credentials. Values are never shown in full — only first 4 + last 4 chars.",
+    parameters: {
+      type: "object",
+      properties: {
+        action: { type: "string", enum: ["get", "set", "delete", "list"], description: "get: read secret (masked), set: store secret, delete: remove, list: search" },
+        service: { type: "string", description: "Service name (e.g., 'google-ai-key', 'my-api-token')" },
+        account: { type: "string", description: "Account name (default: 'wispy')" },
+        value: { type: "string", description: "Secret value (only for 'set' action)" },
+      },
+      required: ["action", "service"],
+    },
+  },
   {
     name: "clipboard",
     description: "Copy text to clipboard (macOS/Linux) or read current clipboard contents.",
@@ -923,6 +937,10 @@ async function executeTool(name, args) {
       }
 
       case "run_command": {
+        // Block direct keychain password reads via run_command — use keychain tool instead
+        if (/security\s+find-generic-password.*-w/i.test(args.command)) {
+          return { success: false, error: "Use the 'keychain' tool instead of run_command for secrets. It masks sensitive values." };
+        }
         console.log(dim(`  $ ${args.command}`));
         const { stdout, stderr } = await execAsync("/bin/bash", ["-c", args.command], {
           timeout: 30_000,
@@ -1068,6 +1086,73 @@ async function executeTool(name, args) {
         }
       }
 
+      case "keychain": {
+        const { promisify: prom } = await import("node:util");
+        const { execFile: ef2 } = await import("node:child_process");
+        const exec2 = prom(ef2);
+        const account = args.account ?? "wispy";
+
+        if (process.platform !== "darwin") {
+          return { success: false, error: "Keychain is only supported on macOS" };
+        }
+
+        if (args.action === "get") {
+          try {
+            const { stdout } = await exec2("security", [
+              "find-generic-password", "-s", args.service, "-a", account, "-w"
+            ], { timeout: 5000 });
+            const val = stdout.trim();
+            // NEVER expose full secret — mask middle
+            const masked = val.length > 8
+              ? `${val.slice(0, 4)}${"*".repeat(Math.min(val.length - 8, 20))}${val.slice(-4)}`
+              : "****";
+            return { success: true, service: args.service, account, value_masked: masked, length: val.length };
+          } catch {
+            return { success: false, error: `No keychain entry found for service="${args.service}" account="${account}"` };
+          }
+        }
+
+        if (args.action === "set") {
+          if (!args.value) return { success: false, error: "value is required for set action" };
+          try {
+            // Delete existing first (ignore error if not found)
+            await exec2("security", [
+              "delete-generic-password", "-s", args.service, "-a", account
+            ]).catch(() => {});
+            await exec2("security", [
+              "add-generic-password", "-s", args.service, "-a", account, "-w", args.value
+            ], { timeout: 5000 });
+            return { success: true, message: `Stored secret for service="${args.service}" account="${account}"` };
+          } catch (err) {
+            return { success: false, error: err.message };
+          }
+        }
+
+        if (args.action === "delete") {
+          try {
+            await exec2("security", [
+              "delete-generic-password", "-s", args.service, "-a", account
+            ], { timeout: 5000 });
+            return { success: true, message: `Deleted keychain entry for service="${args.service}"` };
+          } catch {
+            return { success: false, error: `No entry found for service="${args.service}"` };
+          }
+        }
+
+        if (args.action === "list") {
+          try {
+            const { stdout } = await exec2("/bin/bash", ["-c",
+              `security dump-keychain 2>/dev/null | grep -A 4 "\"svce\"" | grep -E "svce|acct" | head -20`
+            ], { timeout: 5000 });
+            return { success: true, entries: stdout.trim() || "No entries found" };
+          } catch {
+            return { success: true, entries: "No entries found" };
+          }
+        }
+
+        return { success: false, error: "action must be get, set, delete, or list" };
+      }
+
       case "clipboard": {
         const { promisify: prom } = await import("node:util");
         const { execFile: ef2 } = await import("node:child_process");
@@ -1379,8 +1464,20 @@ Be concise. Your output feeds into the next stage.`;
         return { success: true, iterations: MAX_ITERATIONS, result: lastResult, verified: false, message: "Max iterations reached" };
       }
 
-      default:
-        return { success: false, error: `Unknown tool: ${name}` };
+      default: {
+        // Unknown tool — try to execute as a skill via run_command
+        // This handles cases where the AI hallucinates tools from skill descriptions
+        const skills = await loadSkills();
+        const matchedSkill = skills.find(s => s.name.toLowerCase() === name.toLowerCase());
+        if (matchedSkill) {
+          return {
+            success: false,
+            error: `"${name}" is a skill, not a tool. Use run_command to execute commands from the ${name} skill guide. Example from the skill: look for curl/bash commands in the skill description.`,
+            skill_hint: matchedSkill.body.slice(0, 500),
+          };
+        }
+        return { success: false, error: `Unknown tool: ${name}. Available: read_file, write_file, file_edit, file_search, run_command, list_directory, git, web_search, web_fetch, keychain, clipboard, spawn_agent, spawn_async_agent, pipeline, ralph_loop, update_plan, list_agents, get_agent_result` };
+      }
     }
   } catch (err) {
     return { success: false, error: err.message };
@@ -1408,6 +1505,69 @@ async function loadWorkMd() {
   return null;
 }
 
+// ---------------------------------------------------------------------------
+// Skill loader — loads SKILL.md files from multiple sources
+// Compatible with OpenClaw and Claude Code skill formats
+// ---------------------------------------------------------------------------
+
+async function loadSkills() {
+  const skillDirs = [
+    // OpenClaw built-in skills
+    "/opt/homebrew/lib/node_modules/openclaw/skills",
+    // OpenClaw user skills
+    path.join(os.homedir(), ".openclaw", "workspace", "skills"),
+    // Wispy skills
+    path.join(WISPY_DIR, "skills"),
+    // Project-local skills
+    path.resolve(".wispy", "skills"),
+    // Claude Code skills (if installed)
+    path.join(os.homedir(), ".claude", "skills"),
+  ];
+
+  const skills = [];
+  const { readdir: rd, stat: st } = await import("node:fs/promises");
+
+  for (const dir of skillDirs) {
+    try {
+      const entries = await rd(dir);
+      for (const entry of entries) {
+        const skillMdPath = path.join(dir, entry, "SKILL.md");
+        try {
+          const content = await readFile(skillMdPath, "utf8");
+          // Parse frontmatter
+          const fmMatch = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+          let name = entry;
+          let description = "";
+          let body = content;
+
+          if (fmMatch) {
+            const fm = fmMatch[1];
+            body = fmMatch[2];
+            const nameMatch = fm.match(/name:\s*["']?(.+?)["']?\s*$/m);
+            const descMatch = fm.match(/description:\s*["'](.+?)["']\s*$/m);
+            if (nameMatch) name = nameMatch[1].trim();
+            if (descMatch) description = descMatch[1].trim();
+          }
+
+          skills.push({ name, description, body: body.trim(), path: skillMdPath, source: dir });
+        } catch { /* no SKILL.md */ }
+      }
+    } catch { /* dir doesn't exist */ }
+  }
+
+  return skills;
+}
+
+function matchSkills(prompt, skills) {
+  const lower = prompt.toLowerCase();
+  return skills.filter(skill => {
+    const nameMatch = lower.includes(skill.name.toLowerCase());
+    const descWords = skill.description.toLowerCase().split(/\s+/);
+    const descMatch = descWords.some(w => w.length > 4 && lower.includes(w));
+    return nameMatch || descMatch;
+  });
+}
+
 async function buildSystemPrompt(messages = []) {
   // Detect user's language from last message for system prompt hint
   const lastUserMsg = messages?.find ? [...messages].reverse().find(m => m.role === "user")?.content ?? "" : "";
@@ -1439,12 +1599,14 @@ async function buildSystemPrompt(messages = []) {
     "  - NEVER reply in Korean when the user wrote in English.",
     "",
     "## Tools",
-    "You have these tools: read_file, write_file, file_edit, file_search, run_command, list_directory, git, web_search, web_fetch, clipboard, spawn_agent, spawn_async_agent, pipeline, ralph_loop, update_plan, list_agents, get_agent_result.",
+    "You have 18 tools: read_file, write_file, file_edit, file_search, run_command, list_directory, git, web_search, web_fetch, keychain, clipboard, spawn_agent, spawn_async_agent, pipeline, ralph_loop, update_plan, list_agents, get_agent_result.",
     "- file_edit: for targeted text replacement (prefer over write_file for edits)",
     "- file_search: grep across codebase",
     "- git: any git command",
     "- web_fetch: read URL content",
+    "- keychain: macOS Keychain secrets (ALWAYS use this for secrets, NEVER run_command)",
     "- clipboard: copy/paste system clipboard",
+    "- SECURITY: Never show full API keys or secrets. Always use keychain tool which masks values.",
     "Use them proactively. Briefly mention what you're doing.",
     "",
   ];
@@ -1471,6 +1633,25 @@ async function buildSystemPrompt(messages = []) {
     parts.push("");
   }
 
+  // Load and inject matching skills
+  const allSkills = await loadSkills();
+  if (allSkills.length > 0 && lastUserMsg) {
+    const matched = matchSkills(lastUserMsg, allSkills);
+    if (matched.length > 0) {
+      parts.push("## Active Skills (instructions — use run_command/web_fetch to execute)");
+    parts.push("Skills are NOT tools — they are guides. Use run_command to execute the commands described in them.");
+      for (const skill of matched.slice(0, 3)) { // Max 3 skills per turn
+        parts.push(`### ${skill.name}`);
+        parts.push(skill.body.slice(0, 5000));
+        parts.push("");
+      }
+    }
+    // Always list available skills
+    parts.push(`## Available Skills (${allSkills.length} installed)`);
+    parts.push(allSkills.map(s => `- ${s.name}: ${s.description.slice(0, 60)}`).join("\n"));
+    parts.push("");
+  }
+
   return parts.join("\n");
 }
 
@@ -2044,6 +2225,30 @@ ${bold("Wispy Commands:")}
     return true;
   }
 
+  if (cmd === "/skills") {
+    const skills = await loadSkills();
+    if (skills.length === 0) {
+      console.log(dim("No skills installed."));
+      console.log(dim("Add skills to ~/.wispy/skills/ or install OpenClaw skills."));
+    } else {
+      console.log(bold(`\n🧩 Skills (${skills.length} installed):\n`));
+      const bySource = {};
+      for (const s of skills) {
+        const src = s.source.includes("openclaw") ? "OpenClaw" : s.source.includes(".wispy") ? "Wispy" : s.source.includes(".claude") ? "Claude" : "Project";
+        if (!bySource[src]) bySource[src] = [];
+        bySource[src].push(s);
+      }
+      for (const [src, sks] of Object.entries(bySource)) {
+        console.log(`  ${bold(src)} (${sks.length}):`);
+        for (const s of sks) {
+          console.log(`    ${green(s.name.padEnd(20))} ${dim(s.description.slice(0, 50))}`);
+        }
+        console.log("");
+      }
+    }
+    return true;
+  }
+
   if (cmd === "/sessions" || cmd === "/ls") {
     const wsList = await listWorkstreams();
     if (wsList.length === 0) {
@@ -2498,6 +2703,7 @@ ${bold("In-session commands:")}
   /workstreams              List all workstreams
   /overview                 Director view — all workstreams at a glance
   /search <keyword>         Search across all workstreams
+  /skills                   List installed skills (OpenClaw/Claude compatible)
   /sessions                 List all sessions
   /delete <name>            Delete a session
   /export [md|clipboard]    Export conversation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wispy-cli",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "🌿 Wispy — AI workspace assistant with multi-agent orchestration",
   "license": "Apache-2.0",
   "author": "Minseo & Poropo",