hyperagents 1.2.3rc5.post3__py3-none-any.whl

hyperclaw/team/watchers.py

@@ -0,0 +1,112 @@
+"""
+Watchers (``agent_start``), owner-only.
+
+Watchers are ON again in rc5, inside one constraint (Vaughn's spec):
+
+- they only ever message their OWNER (the owner Telegram chat(s) from
+  ``chat_scope.owner_ids``; never TELEGRAM_CHAT_ID from the environment, never
+  anyone else);
+- in ONE fixed format, one line per alert: ``<who>: <what> - <one line>``
+  (``format_alert``). Markdown, line breaks and every web address are
+  removed, link previews are off: a watcher alert never opens a link and
+  never makes Telegram open one;
+- they never act: anything other than this one-line alert to the owner
+  (a reply, a forward, a post, a fetch of something they saw) is a normal
+  request that waits in the approval queue for Send.
+
+Starting them is itself an ``ask``-tier tool call: the card says exactly what
+the watchers will do (``START_CARD``) and nothing runs until the owner
+presses Send. Because every later message has this fixed shape and goes only
+to the owner, what they would send CAN be shown up front, which is why
+agent_start is no longer tier "never" (tools/catalog.py).
+"""
+from __future__ import annotations
+
+import logging
+import re
+from typing import Callable, Dict, Iterable, List, Optional
+
+log = logging.getLogger("hyperclaw.team.watchers")
+
+LINE_MAX = 160
+_URL = re.compile(r"(?i)\b(?:https?://|ftp://|www\.)\S+|\b[\w.-]+\.(?:com|net|org|io|co|ai|app|"
+                  r"dev|ly|gl|me|info|biz|us|uk)(?:/\S*)?\b")
+_MARK = re.compile(r"[*_`~<>#\[\]()|]+")
+_SPACE = re.compile(r"\s+")
+
+START_CARD = ("Start background watchers. They read only what they watch (unread mail "
+              "subjects and senders, prices, news headlines), and they only ever message YOU, "
+              "one line each: who, what, one line. They never open links and never reply, "
+              "post or act; anything else waits for your Send.")
+
+WHO = {"email_monitor": "Email watcher", "market_monitor": "Market watcher",
+       "news_monitor": "News watcher"}
+
+
+def clean(text: str, limit: int = LINE_MAX) -> str:
+    """One plain line: no addresses, no markdown, no line breaks."""
+    t = _URL.sub("\x00", str(text or ""))
+    t = _MARK.sub(" ", t).replace("\x00", "[link removed]")
+    t = _SPACE.sub(" ", t).strip()
+    if len(t) > limit:
+        t = t[:limit - 1].rstrip() + "…"
+    return t
+
+
+def format_alert(who: str, what: str, line: str) -> str:
+    """The one fixed format: '<who>: <what> - <one line>'."""
+    return f"{clean(who, 40)}: {clean(what, 40)} - {clean(line)}"
+
+
+def alert_lines(agent_name: str, result: dict) -> List[str]:
+    """The fixed-format lines for one watcher result (at most 3)."""
+    who = WHO.get(agent_name, agent_name.replace("_", " ").capitalize())
+    out: List[str] = []
+    for e in (result.get("emails") or [])[:3]:
+        out.append(format_alert(who, "important email",
+                                f"from {e.get('sender', '?')}: {e.get('subject', '')}"))
+    for m in (result.get("moves") or [])[:3]:
+        out.append(format_alert(who, f"{m.get('symbol', '?')} moved",
+                                f"{m.get('move', '')} to {m.get('price', '')}"))
+    for n in (result.get("news") or [])[:3]:
+        out.append(format_alert(who, "news", n.get("title", "")))
+    if not out:
+        out.append(format_alert(who, "alert", "something needs your attention (no detail)"))
+    return out
+
+
+def owner_chats() -> List[int]:
+    from hyperclaw.chat_scope import owner_ids
+    out = []
+    for c in sorted(owner_ids("telegram")):
+        try:
+            out.append(int(c))
+        except (TypeError, ValueError):
+            continue
+    return out
+
+
+def send_owner_alert(agent_name: str, result: dict, *,
+                     send: Optional[Callable[[int, str], bool]] = None,
+                     chats: Optional[Iterable[int]] = None) -> List[int]:
+    """Send the fixed-format lines to the owner chat(s) only. Returns the
+    chats reached. Plain text, link previews off (brief.service.telegram_send)."""
+    if send is None:
+        from hyperclaw.brief.service import telegram_send as send
+    text = "\n".join(alert_lines(agent_name, result))
+    reached = []
+    for chat in (owner_chats() if chats is None else list(chats)):
+        try:
+            if send(int(chat), text):
+                reached.append(int(chat))
+        except Exception as e:
+            log.warning("watcher alert not delivered (%s)", type(e).__name__)
+    if not reached:
+        log.info("watcher alert: no owner chat reached")
+    return reached
+
+
+async def owner_alert_callback(agent_name: str, result: Dict) -> None:
+    """The AgentManager alert callback (agents/background_monitor.py)."""
+    import asyncio
+    await asyncio.to_thread(send_owner_alert, agent_name, result)

hyperclaw/teamsetup/__init__.py

@@ -0,0 +1,17 @@
+"""Remote team onboarding (a team member setting up their own install;
+not the team of agents in hyperclaw.team) (docs/TEAM-ONBOARDING.md).
+
+A team member sets up HyperAgents alone, from one 1Password item:
+
+- ``item``      the versioned item format and its parser (a Hyper-signed team
+                profile plus their personal secrets);
+- ``secrets``   the OS secret store (macOS keychain, Linux Secret Service),
+                else an owner-only 0600 file;
+- ``profile``   the verified team profile on this install (read by
+                ``hyperclaw.managed_config`` as the install's managed settings);
+- ``slack_oauth`` / ``google`` / ``checks``  sign-ins and the minimal
+                authenticated call that proves each connection;
+- ``onboard``   the resumable step runner behind ``hyperclaw onboard --team``;
+- ``service``   the one background service at login (Telegram + scheduler);
+- ``selfcheck`` the redacted report for ``hyperclaw self-check``.
+"""

hyperclaw/teamsetup/checks.py

@@ -0,0 +1,208 @@
+"""One minimal authenticated call per connected piece, for the "✓ Connected"
+lines of ``hyperclaw onboard --team`` and for ``hyperclaw self-check``.
+
+Every check returns a ``Check`` with a plain line: ``✓ Connected: <piece> ...``
+or ``✗ <piece>: <reason>. Fix: <what to do>``. No line ever holds a key, a
+token, an email address or message text. Calls are read-only.
+
+- model: ``GET /v1/models/<id>`` on the Anthropic API (no tokens used);
+- Telegram: ``getMe`` (and the owner chat is paired);
+- Google: ``tokeninfo`` for the stored access (refreshed when needed);
+- Slack: ``auth.test`` (hyperclaw.teamsetup.slack_oauth);
+- GitLab: ``personal_access_tokens/self`` + ``user`` (hyperclaw.digest.gitlab).
+"""
+from __future__ import annotations
+
+import logging
+import os
+from dataclasses import dataclass
+from typing import Optional
+
+import httpx
+
+log = logging.getLogger("hyperclaw.teamsetup.checks")
+
+TIMEOUT = 15.0
+ANTHROPIC_API = "https://api.anthropic.com"
+ANTHROPIC_VERSION = "2023-06-01"
+GOOGLE_TOKENINFO = "https://oauth2.googleapis.com/tokeninfo"
+RERUN = "hyperclaw onboard --team --step {step}"
+
+
+@dataclass
+class Check:
+    piece: str
+    ok: bool
+    line: str
+    step: str = ""
+    code: str = ""
+
+
+def ok(piece: str, detail: str = "", step: str = "") -> Check:
+    return Check(piece, True, f"✓ Connected: {piece}" + (f" ({detail})" if detail else ""), step)
+
+
+def fail(piece: str, reason: str, fix: str, step: str = "", code: str = "") -> Check:
+    reason = reason[:1].upper() + reason[1:]
+    return Check(piece, False, f"✗ {piece}: {reason.rstrip('.')}. Fix: {fix}", step, code)
+
+
+def _client(http):
+    return http or httpx.Client(timeout=TIMEOUT, follow_redirects=False)
+
+
+# ── model ─────────────────────────────────────────────────────────────────
+
+def model_label(provider: str, model: str) -> str:
+    from hyperclaw.model_policy import pretty_model_name
+    from hyperclaw import managed_config
+    name = pretty_model_name(provider, model)
+    return f"{name}, via Hyper" if managed_config.hyper_issued(provider) else name
+
+
+def check_model(provider: str, model: str, key: str = "", *,
+                http: Optional[httpx.Client] = None) -> Check:
+    label = model_label(provider, model)
+    step = "item"
+    if provider != "anthropic":
+        return fail(label, "this install's model isn't one onboarding can check",
+                    "tell Vaughn", step, "unsupported")
+    key = key or os.environ.get("ANTHROPIC_API_KEY", "")
+    if not key:
+        return fail(label, "no model key is stored", RERUN.format(step="item"), step, "no_key")
+    base = (os.environ.get("ANTHROPIC_BASE_URL", "").strip() or ANTHROPIC_API).rstrip("/")
+    c = _client(http)
+    try:
+        r = c.get(f"{base}/v1/models/{model}",
+                  headers={"x-api-key": key, "anthropic-version": ANTHROPIC_VERSION})
+    except httpx.HTTPError as e:
+        log.warning("model check: network error (%s)", type(e).__name__)
+        return fail(label, "the model service couldn't be reached",
+                    "check your internet connection, then run hyperclaw self-check", step,
+                    "unreachable")
+    finally:
+        if http is None:
+            c.close()
+    if r.status_code == 200:
+        return ok(label, "", step)
+    log.warning("model check: HTTP %s", r.status_code)
+    if r.status_code in (401, 403):
+        return fail(label, "the model key in your 1Password item was not accepted",
+                    "tell Vaughn; he will send a new item", step, "auth")
+    if r.status_code == 404:
+        return fail(label, f"your key works, but {model} isn't available to it",
+                    "tell Vaughn", step, "model")
+    return fail(label, "the model service isn't available right now",
+                "try again in a few minutes with hyperclaw self-check", step, "unavailable")
+
+
+# ── Telegram ──────────────────────────────────────────────────────────────
+
+def check_telegram(*, client=None) -> Check:
+    from hyperclaw import telegram_pairing as tp
+    step = "telegram"
+    token = os.environ.get("TELEGRAM_BOT_TOKEN", "").strip()
+    owner = os.environ.get("TELEGRAM_OWNER_CHAT_ID", "").strip()
+    if not token:
+        return fail("Telegram", "no bot is connected", RERUN.format(step=step), step,
+                    "not_connected")
+    name = tp.bot_username(token, client=client)
+    if not name:
+        return fail("Telegram", "Telegram didn't accept the bot token (or couldn't be reached)",
+                    RERUN.format(step=step), step, "token")
+    if not owner:
+        return fail("Telegram", f"the bot @{name} works but isn't paired to your chat yet",
+                    RERUN.format(step=step), step, "unpaired")
+    return ok("Telegram", f"@{name}, paired to your chat", step)
+
+
+# ── Google ──────────────────────────────────────────────────────────────
+
+GOOGLE_NAMES = "Gmail, Calendar, Meet, Drive, Docs, Sheets and Slides"
+
+
+def check_google(*, http: Optional[httpx.Client] = None) -> Check:
+    """The Workspace sign-in (hyperclaw.google_workspace): refresh if needed,
+    then one tokeninfo call; the granted scopes must be ones we asked for."""
+    from hyperclaw.google_workspace import auth as ga
+    from hyperclaw.google_workspace.errors import GoogleError
+    step = "google"
+    if not ga.connected():
+        return fail("Google", "you haven't signed in to Google yet", RERUN.format(step=step),
+                    step, "not_connected")
+    try:
+        tok = ga.access_token(http=http)
+    except GoogleError as e:
+        return fail("Google", e.text.split(". ")[0], RERUN.format(step=step), step,
+                    e.reason.value)
+    c = _client(http)
+    try:
+        r = c.post(GOOGLE_TOKENINFO, data={"access_token": tok})
+    except httpx.HTTPError:
+        return fail("Google", "Google couldn't be reached",
+                    "check your internet connection, then run hyperclaw self-check", step,
+                    "unreachable")
+    finally:
+        if http is None:
+            c.close()
+    if r.status_code != 200:
+        return fail("Google", "Google didn't accept the stored sign-in",
+                    RERUN.format(step=step), step, "rejected")
+    try:
+        granted = ga.check_scopes(str((r.json() or {}).get("scope") or ""))
+    except (GoogleError, ValueError) as e:
+        return fail("Google", getattr(e, "text", "Google's answer couldn't be read").split(". ")[0],
+                    RERUN.format(step=step), step, "scopes")
+    missing = [s.rsplit("/", 1)[-1] for s in ga.SCOPES if s not in granted]
+    detail = GOOGLE_NAMES + ("; not granted: " + ", ".join(missing) if missing else "")
+    return ok("Google", detail, step)
+
+
+# ── Slack ─────────────────────────────────────────────────────────────────
+
+def check_slack(cfg: dict, *, http: Optional[httpx.Client] = None) -> Check:
+    from hyperclaw.teamsetup import slack_oauth as so
+    step = "slack"
+    try:
+        so.expected_workspace(cfg)
+    except so.SlackAuthError as e:
+        return fail("Slack", e.text, e.fix, step, e.code)
+    if not so.connected():
+        return fail("Slack", "you haven't signed in to Slack yet", RERUN.format(step=step),
+                    step, "not_connected")
+    try:
+        info = so.verify(cfg, http=http)
+    except so.SlackAuthError as e:
+        if e.code == "expired":
+            return fail("Slack", "your Slack sign-in has expired or was removed",
+                        "sign in again: " + RERUN.format(step=step), step, e.code)
+        return fail("Slack", e.text, e.fix, step, e.code)
+    return ok("Slack", f"workspace {info['team']}; posts only when you press Send" if info["team"]
+              else "posts only when you press Send",
+              step)
+
+
+# ── GitLab ────────────────────────────────────────────────────────────────
+
+def check_gitlab(*, client=None) -> Check:
+    from hyperclaw.digest import state, tokens
+    from hyperclaw.digest.errors import DigestError
+    from hyperclaw.digest.gitlab import GitLabCollector
+    step = "gitlab"
+    meta = state.connections().get("gitlab") or {}
+    try:
+        token = tokens.store(meta.get("store") or "").get("gitlab")
+    except DigestError:
+        token = ""
+    if not token:
+        return fail("GitLab", "GitLab isn't connected (optional)", RERUN.format(step=step),
+                    step, "not_connected")
+    col = GitLabCollector(token, url=meta.get("url") or "", client=client)
+    try:
+        info = col.verify()
+    except DigestError as e:
+        return fail("GitLab", e.text, e.fix or RERUN.format(step=step), step, e.reason.value)
+    finally:
+        if client is None:
+            col.close()
+    return ok("GitLab", f"{info.get('account', '')}, read_api", step)