hyperagents 1.2.3rc5.post3__py3-none-any.whl

hyperclaw/teamsetup/onboard.py

@@ -0,0 +1,550 @@
+"""``hyperclaw onboard --team``: a team member sets up HyperAgents alone.
+
+Steps, in order (each can be re-run alone with ``--step <id>``)::
+
+    item      paste the 1Password item (hidden): team profile + personal keys
+    name      name the agent
+    consent   the one consent line for the outside model, then a live check
+    google    sign in to Google in their own browser (read-only Docs, Sheets)
+    slack     sign in to Slack in their own browser (PKCE; reads, posts only on Send)
+    telegram  create the bot (named after the agent) and pair it by code
+    brief     pick the morning brief time (and, optionally, its Doc and Sheet)
+    gitlab    add GitLab with a read_api token (optional)
+    service   the background service at login (Telegram + scheduler)
+
+It ends with one line per piece: ``✓ Connected: ...`` or the plain reason
+and the fix. Progress is saved after every step in
+``$HYPERCLAW_ROOT/config/onboard-team.json`` (no secrets), so quitting
+halfway is safe: running it again carries on where they left off.
+"""
+from __future__ import annotations
+
+import datetime as _dt
+import json
+import os
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Callable, Optional
+
+STEPS = ("item", "name", "consent", "google", "slack", "telegram", "brief", "gitlab",
+         "service")
+TITLES = {
+    "item": "Your 1Password item", "name": "Name your agent", "consent": "Your model",
+    "google": "Google sign-in", "slack": "Slack sign-in", "telegram": "Telegram",
+    "brief": "Morning brief", "gitlab": "GitLab (optional)", "service": "Background service",
+}
+DONE, FAILED, SKIPPED = "done", "failed", "skipped"
+STOPPED = ("Stopped. Everything finished so far is saved. Run 'hyperclaw onboard --team' "
+           "to carry on from where you left off.")
+
+
+# ── state (non-secret) ────────────────────────────────────────────────────
+
+def state_path() -> Path:
+    from hyperclaw.userconfig import root
+    return root() / "config" / "onboard-team.json"
+
+
+def load_state() -> dict:
+    try:
+        d = json.loads(state_path().read_text(encoding="utf-8"))
+        if isinstance(d, dict) and isinstance(d.get("steps"), dict):
+            return d
+    except Exception:
+        pass
+    return {"steps": {}}
+
+
+def mark(step: str, status: str, code: str = "") -> None:
+    d = load_state()
+    d["steps"][step] = {"status": status, "code": code,
+                        "at": _dt.datetime.now(_dt.timezone.utc).isoformat(timespec="seconds")}
+    p = state_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(".tmp")
+    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        json.dump(d, f, indent=1)
+    os.replace(tmp, p)
+
+
+def status_of(step: str) -> str:
+    return (load_state()["steps"].get(step) or {}).get("status", "")
+
+
+def next_steps() -> list:
+    """Steps still to do, in order (failed ones are tried again)."""
+    st = load_state()["steps"]
+    return [s for s in STEPS if (st.get(s) or {}).get("status") not in (DONE, SKIPPED)]
+
+
+# ── terminal I/O (tests pass a fake) ──────────────────────────────────────
+
+@dataclass
+class IO:
+    say: Callable[[str], None]
+    ask: Callable[..., str]                      # ask(label, default="") -> str
+    hidden: Callable[[str], str]                 # hidden(label) -> str (never echoed)
+    confirm: Callable[..., bool]                 # confirm(label, default=False) -> bool
+    open_browser: Optional[Callable[[str], object]] = None
+
+
+def terminal_io() -> IO:
+    import webbrowser
+
+    from rich.console import Console
+    from rich.prompt import Confirm, Prompt
+
+    from hyperclaw.teamsetup.tty import read_hidden
+    con = Console()
+    return IO(
+        say=lambda t: con.print(t, markup=False, highlight=False),
+        ask=lambda label, default="": Prompt.ask(label, default=default,
+                                                 show_default=bool(default)),
+        hidden=lambda label: read_hidden(label + ": "),
+        confirm=lambda label, default=False: Confirm.ask(label, default=default),
+        open_browser=webbrowser.open,
+    )
+
+
+@dataclass
+class StepResult:
+    status: str
+    line: str = ""
+    code: str = ""
+
+
+# ── the steps ─────────────────────────────────────────────────────────────
+
+def _profile() -> dict:
+    from hyperclaw.teamsetup import profile
+    return profile.load()
+
+
+def _need_profile() -> Optional[StepResult]:
+    if not _profile():
+        return StepResult(FAILED, "✗ This step needs your team item first. Fix: hyperclaw "
+                                  "onboard --team --step item", "no_item")
+    return None
+
+
+def step_item(io: IO) -> StepResult:
+    from hyperclaw.teamsetup import profile, secrets
+    from hyperclaw.teamsetup.item import ItemError, parse
+    from hyperclaw.userconfig import update_config
+    io.say("Open 1Password, find the HyperAgents item Vaughn shared with you, and copy its "
+           "text. Paste it here and press Enter. Nothing will show on screen as you paste; "
+           "that is on purpose.")
+    item = None
+    for _ in range(3):
+        raw = io.hidden("Paste your 1Password item (hidden)")
+        try:
+            item = parse(raw)
+            break
+        except ItemError as e:
+            io.say(e.text)
+        finally:
+            raw = ""
+    if item is None:
+        return StepResult(FAILED, "✗ Team item: not saved. Fix: copy the item from 1Password "
+                                  "again, then hyperclaw onboard --team --step item", "item")
+    profile.save(item.envelope)
+    where = secrets.put("model_key", item.model_key)
+    if item.hyper_key:
+        secrets.put("hyper_key", item.hyper_key, env="HYPERSPEED_API_KEY")
+    if item.google_client_secret:
+        secrets.put("google_client_secret", item.google_client_secret)
+        if item.profile["google"]["client_id"]:
+            write_google_client(item.profile["google"]["client_id"], item.google_client_secret)
+    update_config(deployment="hyper" if item.profile["install_mode"] == "hyper" else "standard",
+                  team_profile=item.profile["name"])
+    if secrets.env_map()["env"].get("ANTHROPIC_API_KEY") == "model_key":
+        secrets.link_env("model_key", "ANTHROPIC_API_KEY")      # re-paste: keep it current
+    del item
+    return StepResult(DONE, f"✓ Team item saved. Your keys are kept in {where}.")
+
+
+def step_name(io: IO) -> StepResult:
+    from hyperclaw import naming
+    current = naming.current_name()
+    if current and io.confirm(f"Your agent is called {current}. Keep that name?", default=True):
+        return StepResult(DONE, f"✓ Your agent is called {current}.")
+    name = naming.run_interactive(lambda label: io.ask(label, ""), io.say, model_call=None)
+    if not name:
+        return StepResult(FAILED, "✗ No name chosen. Fix: hyperclaw onboard --team --step "
+                                  "name", "no_name")
+    return StepResult(DONE, f"✓ Your agent is called {name}.")
+
+
+def step_consent(io: IO, *, http=None) -> StepResult:
+    from hyperclaw.model_policy import consent_line, has_consent, record_consent
+    from hyperclaw.teamsetup import checks, secrets
+    need = _need_profile()
+    if need:
+        return need
+    provider, _, model = _profile()["default_model"].partition("/")
+    label = checks.model_label(provider, model)
+    if provider == "hyperspeed":
+        return StepResult(DONE, f"✓ Your model is {label} (Hyper's own; no consent needed).")
+    io.say(f"Your model: {label}.")
+    io.say(consent_line(provider))
+    if not io.confirm("Continue?", default=False):
+        secrets.unlink_env("ANTHROPIC_API_KEY")
+        return StepResult(FAILED, f"✗ {label}: not switched on, because you didn't agree. "
+                                  "Fix: when you're ready, hyperclaw onboard --team --step "
+                                  "consent", "declined")
+    if not has_consent(provider):
+        record_consent(provider, model)
+    if not secrets.link_env("model_key", "ANTHROPIC_API_KEY"):
+        return StepResult(FAILED, f"✗ {label}: no model key is stored. Fix: hyperclaw onboard "
+                                  "--team --step item", "no_key")
+    try:
+        from hyperclaw.providers import reset_registry
+        reset_registry()
+    except Exception:
+        pass
+    c = checks.check_model(provider, model, http=http)
+    return StepResult(DONE if c.ok else FAILED, c.line, c.code)
+
+
+def write_google_client(client_id: str, client_secret: str) -> Path:
+    """The install's Desktop client file for the Google sign-in
+    (hyperclaw.google_workspace.auth.client_path), owner-only."""
+    from hyperclaw.google_workspace import auth as ga
+    p = ga.client_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(p.parent, 0o700)
+    except OSError:
+        pass
+    body = {"installed": {"client_id": client_id, "client_secret": client_secret,
+                          "auth_uri": ga.AUTH_URI, "token_uri": ga.TOKEN_URI,
+                          "redirect_uris": ["http://127.0.0.1"]}}
+    tmp = p.with_suffix(".tmp")
+    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        json.dump(body, f)
+    os.replace(tmp, p)
+    return p
+
+
+def step_google(io: IO, *, http=None, connect=None) -> StepResult:
+    """`hyperclaw google connect` (hyperclaw.google_workspace): one sign-in in
+    their own browser, loopback PKCE, the full team scopes (Gmail read,
+    compose and send; read-only Calendar, Meet, Drive, Docs, Sheets, Slides;
+    Calendar write only when the profile allows it); token in the OS secret
+    store."""
+    from hyperclaw.google_workspace import auth as ga
+    from hyperclaw.google_workspace.cli import _whoami
+    from hyperclaw.google_workspace.errors import GoogleError
+    from hyperclaw.teamsetup import checks, profile
+    need = _need_profile()
+    if need:
+        return need
+    client = profile.google_client()
+    if client:
+        write_google_client(client["client_id"], client["client_secret"])
+    elif not ga.client_path().is_file():
+        return StepResult(FAILED, "✗ Google: your team item has no Google sign-in details. "
+                                  "Fix: ask Vaughn for an updated item, then hyperclaw onboard "
+                                  "--team --step item", "no_client")
+    io.say("Next, Google. Your browser will open: sign in with your work Google account and "
+           "choose Allow. Your agent can then read your email and draft or send mail you "
+           "approve, and read your Calendar, Meet notes, Drive, Docs, Sheets and Slides.")
+    try:
+        (connect or ga.connect)(show=io.say, open_browser=io.open_browser, http=http,
+                                whoami=_whoami)
+    except GoogleError as e:
+        return StepResult(FAILED, f"✗ Google: {e.text.split('. ')[0].rstrip('.')}. Nothing was "
+                                  "saved. Fix: hyperclaw onboard --team --step google",
+                          e.reason.value)
+    c = checks.check_google(http=http)
+    return StepResult(DONE if c.ok else FAILED, c.line, c.code)
+
+
+def step_slack(io: IO, *, http=None, sign_in=None) -> StepResult:
+    from hyperclaw.teamsetup import checks, slack_oauth
+    need = _need_profile()
+    if need:
+        return need
+    cfg = _profile().get("slack") or {}
+    if not cfg.get("client_id"):
+        return StepResult(SKIPPED, "– Slack: not part of your team profile.", "no_app")
+    io.say("Next, Slack.")
+    try:
+        (sign_in or slack_oauth.sign_in)(cfg, show=io.say, open_browser=io.open_browser,
+                                         http=http)
+    except slack_oauth.SlackAuthError as e:
+        saved = "" if "nothing was saved" in e.text else " Nothing was saved."
+        return StepResult(FAILED, f"✗ Slack: {e.text}.{saved} Fix: {e.fix}", e.code)
+    c = checks.check_slack(cfg, http=http)
+    return StepResult(DONE if c.ok else FAILED, c.line, c.code)
+
+
+def bot_username_hint(agent: str) -> str:
+    base = re.sub(r"[^a-z0-9]+", "_", agent.lower()).strip("_") or "my"
+    return f"{base[:20]}_hyperagents_bot"
+
+
+def step_telegram(io: IO, *, client=None, pair=None, paused=None) -> StepResult:
+    from hyperclaw import naming
+    from hyperclaw import telegram_pairing as tp
+    from hyperclaw.teamsetup import checks, secrets, service
+    need = _need_profile()
+    if need:
+        return need
+    if not _profile().get("telegram"):
+        return StepResult(SKIPPED, "– Telegram: not part of your team profile.", "off")
+    agent = naming.current_name() or "HyperAgents"
+    io.say("Next, Telegram: your agent gets its own bot, and only your chat can use it.")
+    io.say("1. In Telegram, open @BotFather and send /newbot.")
+    io.say(f"2. When it asks for a name, send: {agent}")
+    io.say(f"3. When it asks for a username, send one ending in 'bot', for example "
+           f"{bot_username_hint(agent)}")
+    io.say("4. BotFather replies with a token. Copy it and paste it here.")
+    token = ""
+    for _ in range(3):
+        token = "".join(io.hidden("Bot token (hidden)").split())
+        if re.fullmatch(tp._TOKEN_SHAPE, token):
+            break
+        io.say("That doesn't look like a Telegram bot token, so it wasn't saved. Copy the "
+               "whole token from BotFather's message and paste it again.")
+        token = ""
+    if not token:
+        return StepResult(FAILED, "✗ Telegram: no bot token saved. Fix: hyperclaw onboard "
+                                  "--team --step telegram", "token")
+    secrets.put("telegram_bot_token", token, env="TELEGRAM_BOT_TOKEN")
+    with (paused or service.paused)():
+        chat = (pair or tp.run_owner_pairing)(token, io.say, client=client)
+    if chat is None:
+        return StepResult(FAILED, "✗ Telegram: not paired. Fix: hyperclaw onboard --team "
+                                  "--step telegram", "unpaired")
+    try:
+        tp._call(client or tp._client(), token, "setMyName", {"name": agent[:64]}, timeout=15)
+    except Exception:
+        io.say(f"Telegram didn't take the display name {agent} just now; the bot works anyway, "
+               "and you can try again later with /name.")
+    c = checks.check_telegram(client=client)
+    return StepResult(DONE if c.ok else FAILED, c.line, c.code)
+
+
+def local_timezone() -> str:
+    tz = os.environ.get("TZ", "").strip().lstrip(":")
+    if tz and "/" in tz:
+        return tz
+    try:
+        target = os.path.realpath("/etc/localtime")
+        if "zoneinfo/" in target:
+            return target.split("zoneinfo/", 1)[1]
+    except OSError:
+        pass
+    return ""
+
+
+def _brief_ready_line(when: str, tz: str) -> StepResult:
+    from hyperclaw.brief import compose, store
+    from hyperclaw.brief.errors import BriefError
+    from hyperclaw.digest.errors import DigestError
+    try:
+        from hyperclaw.providers import reset_registry
+        reset_registry()
+    except Exception:
+        pass
+    try:
+        compose.v2_route()
+    except (BriefError, DigestError):
+        return StepResult(FAILED, f"✗ Morning brief: set for {when} {tz}, but it is written only "
+                                  "by HyperSpeed V2 and this install has no Hyper access key. "
+                                  "Fix: ask Vaughn for an item that includes one, then "
+                                  "hyperclaw onboard --team --step item", "no_v2")
+    from hyperclaw.brief import google_auth
+    if store.source_id("doc") and not google_auth.connected():
+        return StepResult(FAILED, f"✗ Morning brief: set for {when} {tz}, but it can't read its "
+                                  "Doc yet (no Google sign-in for the brief). Fix: hyperclaw "
+                                  "onboard --team --step brief", "brief_google")
+    if not (store.source_id("doc") and store.source_id("sheet")):
+        return StepResult(FAILED, f"✗ Morning brief: set for {when} {tz}, but its Google Doc "
+                                  "and Sheet aren't set. Fix: hyperclaw onboard --team --step "
+                                  "brief", "no_sources")
+    return StepResult(DONE, f"✓ Morning brief: every day at {when} {tz}")
+
+
+def step_brief(io: IO, *, brief_connect=None, http=None) -> StepResult:
+    from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
+
+    from hyperclaw.brief import links, store
+    when = None
+    for _ in range(3):
+        raw = io.ask("What time should your morning brief arrive? (24-hour, e.g. 07:30)",
+                     str(store.config().get("time") or store.DEFAULT_TIME))
+        when = store.parse_hhmm(raw)
+        if when:
+            break
+        io.say("Use the 24-hour form HH:MM, for example 07:30.")
+    if not when:
+        return StepResult(FAILED, "✗ Morning brief: no time set. Fix: hyperclaw onboard --team "
+                                  "--step brief", "time")
+    tz = ""
+    for _ in range(3):
+        tz = io.ask("Your time zone", str(store.config().get("tz") or local_timezone()
+                                         or "America/Chicago")).strip()
+        try:
+            ZoneInfo(tz)
+            break
+        except (ZoneInfoNotFoundError, ValueError):
+            io.say("That isn't a time zone name. Use one like America/Chicago or Europe/London.")
+            tz = ""
+    if not tz:
+        return StepResult(FAILED, "✗ Morning brief: no time zone set. Fix: hyperclaw onboard "
+                                  "--team --step brief", "tz")
+    hm = f"{when[0]:02d}:{when[1]:02d}"
+    store.set_config(scheduled=True, time=hm, tz=tz,
+                     scheduled_at=_dt.datetime.now(ZoneInfo(tz)).isoformat(timespec="seconds"))
+    have = bool(store.source_id("doc") and store.source_id("sheet"))
+    if io.confirm("Set the Google Doc and Sheet your brief reads now? (you can do it later)",
+                  default=not have):
+        for kind, want, label in (("doc", links.DOC, "Doc"), ("sheet", links.SHEET, "Sheet")):
+            raw = io.hidden(f"Link to your {label} (hidden; Enter to keep the current one)")
+            if not raw.strip():
+                continue
+            got, fid = links.parse(raw.strip())
+            raw = ""
+            if got != want or not fid:
+                io.say(f"That isn't a Google {label} link, so the {label} wasn't changed.")
+                continue
+            store.set_source(kind, fid, "")
+            io.say(f"{label}: set.")
+    from hyperclaw.brief import google_auth
+    from hyperclaw.brief.errors import BriefError
+    if store.source_id("doc") and not google_auth.connected():
+        # The brief reads its Doc and Sheet with its own read-only sign-in.
+        io.say("Your brief reads that Doc and Sheet with its own read-only Google sign-in. Your "
+               "browser will open once more: choose the same account and Allow.")
+        try:
+            (brief_connect or google_auth.connect)(show=io.say, open_browser=io.open_browser,
+                                                   http=http)
+        except BriefError as e:
+            return StepResult(FAILED, f"✗ Morning brief: set for {hm} {tz}, but {e.text}. Fix: "
+                                      "hyperclaw onboard --team --step brief", e.reason.value)
+    return _brief_ready_line(hm, tz)
+
+
+def step_gitlab(io: IO, *, client=None) -> StepResult:
+    from hyperclaw.digest.errors import DigestError
+    from hyperclaw.digest.service import connect
+    from hyperclaw.teamsetup import checks
+    if not io.confirm("Add GitLab, so your agent can tell you about your merge requests and "
+                      "to-dos? (optional, read-only)", default=False):
+        return StepResult(SKIPPED, "– GitLab: not added (optional). Add it any time: hyperclaw "
+                                   "onboard --team --step gitlab", "declined")
+    url = (_profile().get("gitlab") or {}).get("url") or "https://gitlab.com"
+    io.say(f"In GitLab ({url}): click your avatar, then Edit profile, then Access tokens, then "
+           "Add new token. Tick only read_api, pick an expiry date, create it and copy it.")
+    token = io.hidden("GitLab token (hidden)")
+    try:
+        connect("gitlab", token, gitlab_url=url, client=client)
+    except DigestError as e:
+        return StepResult(FAILED, f"✗ GitLab: {e.text}. Nothing was saved. Fix: "
+                                  + (e.fix or "hyperclaw onboard --team --step gitlab"),
+                          e.reason.value)
+    finally:
+        token = ""
+    c = checks.check_gitlab(client=client)
+    return StepResult(DONE if c.ok else FAILED, c.line, c.code)
+
+
+def step_service(io: IO, *, run=None) -> StepResult:
+    from hyperclaw.teamsetup import service
+    io.say("Last, the background service: it starts when you log in and keeps your agent "
+           "on Telegram and your brief on time, even after a restart or sleep.")
+    r = service.install(**({"run": run} if run else {}))
+    return StepResult(DONE if r.ok else FAILED, r.line, "" if r.ok else "service")
+
+
+RUNNERS = {"item": step_item, "name": step_name, "consent": step_consent,
+           "google": step_google, "slack": step_slack, "telegram": step_telegram,
+           "brief": step_brief, "gitlab": step_gitlab, "service": step_service}
+
+
+# ── summary ───────────────────────────────────────────────────────────────
+
+def summary_lines(*, http=None, client=None, run=None) -> list:
+    """One line per piece, from live checks (and the saved state for skipped
+    optional pieces)."""
+    from hyperclaw.teamsetup import checks, service
+    steps = load_state()["steps"]
+    lines = []
+    prof = _profile()
+    if not prof:
+        return ["✗ Team item: not set up. Fix: hyperclaw onboard --team --step item"]
+    provider, _, model = prof["default_model"].partition("/")
+    if (steps.get("consent") or {}).get("code") == "declined":
+        lines.append(f"✗ {checks.model_label(provider, model)}: not switched on, because you "
+                     "didn't agree. Fix: hyperclaw onboard --team --step consent")
+    else:
+        lines.append(checks.check_model(provider, model, http=http).line)
+    lines.append(checks.check_google(http=http).line)
+    if (prof.get("slack") or {}).get("client_id"):
+        lines.append(checks.check_slack(prof["slack"], http=http).line)
+    if prof.get("telegram"):
+        lines.append(checks.check_telegram(client=client).line)
+    from hyperclaw.brief import store
+    if store.opted_in_by_config():
+        lines.append(_brief_ready_line(str(store.config().get("time")), store.tz_name()).line)
+    else:
+        lines.append("✗ Morning brief: no time set. Fix: hyperclaw onboard --team --step brief")
+    if (steps.get("gitlab") or {}).get("status") == SKIPPED:
+        lines.append("– GitLab: not added (optional)")
+    else:
+        lines.append(checks.check_gitlab(client=client).line)
+    lines.append(service.check(**({"run": run} if run else {})).line)
+    return lines
+
+
+# ── runner ────────────────────────────────────────────────────────────────
+
+def run(io: Optional[IO] = None, *, only: Optional[str] = None, deps: Optional[dict] = None,
+        summary: bool = True) -> int:
+    """Run the remaining steps (or one, with ``only``). Returns an exit code:
+    0 when every line is ✓ (or an optional piece was skipped)."""
+    io = io or terminal_io()
+    deps = deps or {}
+    todo = [only] if only else next_steps()
+    if only and only not in RUNNERS:
+        io.say(f"Unknown step '{only}'. Steps: {', '.join(STEPS)}")
+        return 2
+    if not only:
+        done = [s for s in STEPS if s not in todo]
+        if done and todo:
+            io.say(f"Picking up where you left off: {TITLES[todo[0]]}.")
+    try:
+        for step in todo:
+            io.say("")
+            io.say(f"── {TITLES[step]} ──")
+            res = RUNNERS[step](io, **deps.get(step, {}))
+            mark(step, res.status, res.code)
+            if res.line:
+                io.say(res.line)
+    except (KeyboardInterrupt, EOFError):
+        io.say("")
+        io.say(STOPPED)
+        return 130
+    if only and status_of("service") == DONE and only != "service":
+        from hyperclaw.teamsetup import service
+        service.install(**({"run": deps["service"]["run"]} if deps.get("service") else {}))
+    if not summary:
+        return 0
+    io.say("")
+    io.say("Where everything stands:")
+    lines = summary_lines(**deps.get("summary", {}))
+    for line in lines:
+        io.say("  " + line)
+    bad = [x for x in lines if x.startswith("✗")]
+    io.say("")
+    if bad:
+        io.say("Follow each Fix above. If you're stuck, run 'hyperclaw self-check' and send "
+               "Vaughn the report it writes (it has no keys, tokens, emails or messages in it).")
+    else:
+        io.say("All set. Say hello to your agent on Telegram.")
+    return 1 if bad else 0

hyperclaw/teamsetup/profile.py

@@ -0,0 +1,82 @@
+"""The team profile on this install: the Hyper-signed policy from the team
+item (hyperclaw.teamsetup.item), kept as issued in
+``$HYPERCLAW_ROOT/config/team-profile.json`` (0600).
+
+It is verified again every time it is read, so editing the file only makes
+it invalid (then the strictest defaults apply). ``hyperclaw.managed_config``
+reads it as the install's managed settings when no system managed file is
+present (docs/MODEL-POLICY.md, "Team install profile").
+"""
+from __future__ import annotations
+
+import json
+import logging
+import os
+from pathlib import Path
+
+log = logging.getLogger("hyperclaw.teamsetup.profile")
+
+_cache: dict = {}
+
+
+def path() -> Path:
+    from hyperclaw.userconfig import root
+    return root() / "config" / "team-profile.json"
+
+
+def save(envelope: dict) -> None:
+    p = path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(".tmp")
+    fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        json.dump(envelope, f, indent=1, sort_keys=True)
+    os.replace(tmp, p)
+    _cache.clear()
+
+
+def load() -> dict:
+    """The verified profile, or {} (no file, or it doesn't verify)."""
+    from hyperclaw.teamsetup.item import ItemError, verify_profile
+    p = path()
+    try:
+        st = p.stat()
+    except OSError:
+        return {}
+    key = (str(p), st.st_mtime_ns, st.st_size)
+    if _cache.get("key") == key:
+        return dict(_cache["profile"])
+    try:
+        prof = verify_profile(json.loads(p.read_text(encoding="utf-8")))
+    except (ItemError, ValueError, OSError) as e:
+        log.warning("team profile %s ignored (%s); defaults apply", p,
+                    getattr(e, "code", type(e).__name__))
+        prof = {}
+    _cache.update(key=key, profile=prof)
+    return dict(prof)
+
+
+def managed_view() -> dict:
+    """The profile's managed-config fields (same shape as the managed config file)."""
+    prof = load()
+    if not prof:
+        return {}
+    return {"allowed_models": list(prof["allowed_models"]),
+            "default_model": prof["default_model"],
+            "hyper_issued_keys": list(prof["hyper_issued_keys"]),
+            "model_names": dict(prof["model_names"]),
+            "telegram": prof["telegram"] is True,
+            "restricted_clients": [dict(c) for c in prof["restricted_clients"]],
+            "restricted_clients_required": prof["restricted_clients_required"] is True,
+            "google_calendar_write": prof["google_calendar_write"] is True}
+
+
+def google_client() -> dict:
+    """{"client_id", "client_secret"} for the team Google client, or {}."""
+    prof = load()
+    cid = (prof.get("google") or {}).get("client_id") or ""
+    if not cid:
+        return {}
+    from hyperclaw.teamsetup import secrets
+    sec = secrets.get("google_client_secret")
+    return {"client_id": cid, "client_secret": sec} if sec else {}