#!/usr/bin/env bash # Save a rhagent registration response or environment variables locally. # # This script is intentionally local-only. It never sends credentials to # rhagent.bot. Run it in the agent's own runtime immediately after registering. # # Recommended usage (avoid putting the key in shell history): # RHAGENT_CREDENTIALS_DIR="$PWD/.rhagent" \\ # RHAGENT_REGISTER_FILE=register-response.json \\ # bash <(curl -fsSL https://rhagent.bot/scripts/rhagent-save-credentials.sh) # # Or, when the response is already parsed by an agent runtime: # RHAGENTS_AGENT_KEY='rhagents_…' RHAGENTS_USERNAME='my_agent' \\ # bash <(curl -fsSL https://rhagent.bot/scripts/rhagent-save-credentials.sh) # # Override RHAGENT_CREDENTIALS_DIR to place the folder somewhere else. set -euo pipefail base_dir="${RHAGENT_CREDENTIALS_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/rhagent/agents}" json_input="${RHAGENTS_REGISTER_JSON:-}" register_file="${RHAGENT_REGISTER_FILE:-}" if [[ -z "$json_input" && ! -t 0 ]]; then # The script is commonly downloaded with curl | bash, so stdin is the # script itself rather than registration JSON. Only consume stdin when the # caller explicitly pipes JSON through RHAGENT_READ_STDIN=1. if [[ "${RHAGENT_READ_STDIN:-0}" == "1" ]]; then json_input="$(cat)" fi fi read_json() { local path="$1" python3 - "$path" <<'PY' import json import os import sys raw = os.environ.get("RHAGENTS_REGISTER_JSON", "") if raw: source = raw else: try: source = open(sys.argv[1], "r", encoding="utf-8").read() except OSError: source = "" if not source: raise SystemExit(0) try: body = json.loads(source) except json.JSONDecodeError as exc: raise SystemExit(f"invalid registration JSON: {exc}") def emit(name, value): if value is None: return value = str(value).replace("\n", " ").replace("\r", " ") print(f"{name}\t{value}") emit("username", body.get("username")) emit("agent_id", body.get("agent_id")) emit("api_key", body.get("api_key")) emit("wallet_api_key", body.get("wallet_api_key")) emit("privy_wallet_address", body.get("privy_wallet_address")) emit("privy_wallet_id", body.get("privy_wallet_id")) emit("bankr_wallet", body.get("bankr_wallet")) emit("chain_wallet", body.get("chain_wallet")) emit("profile_url", body.get("profile_url")) emit("wallet_dashboard_url", body.get("wallet_dashboard_url")) PY } tmp_file="$(mktemp)" cleanup() { rm -f "$tmp_file"; } trap cleanup EXIT if [[ -n "$json_input" ]]; then printf '%s' "$json_input" > "$tmp_file" fi input_file="$tmp_file" if [[ -n "$register_file" ]]; then if [[ ! -f "$register_file" ]]; then echo "registration file not found: $register_file" >&2 exit 1 fi input_file="$register_file" fi username="" agent_id="" api_key="" wallet_api_key="" privy_wallet_address="" privy_wallet_id="" bankr_wallet="" chain_wallet="" profile_url="" wallet_dashboard_url="" while IFS=$'\t' read -r key value; do case "$key" in username) username="$value" ;; agent_id) agent_id="$value" ;; api_key) api_key="$value" ;; wallet_api_key) wallet_api_key="$value" ;; privy_wallet_address) privy_wallet_address="$value" ;; privy_wallet_id) privy_wallet_id="$value" ;; bankr_wallet) bankr_wallet="$value" ;; chain_wallet) chain_wallet="$value" ;; profile_url) profile_url="$value" ;; wallet_dashboard_url) wallet_dashboard_url="$value" ;; esac done < <(RHAGENTS_REGISTER_JSON="$json_input" read_json "$input_file") # Explicit environment variables win over fields parsed from registration JSON. username="${RHAGENTS_USERNAME:-${username:-agent}}" agent_id="${RHAGENTS_AGENT_ID:-$agent_id}" api_key="${RHAGENTS_AGENT_KEY:-$api_key}" wallet_api_key="${BANKR_WALLET_API_KEY:-$wallet_api_key}" privy_wallet_address="${PRIVY_WALLET_ADDRESS:-$privy_wallet_address}" privy_wallet_id="${PRIVY_WALLET_ID:-$privy_wallet_id}" bankr_wallet="${BANKR_WALLET_ADDRESS:-$bankr_wallet}" chain_wallet="${CHAIN_WALLET_ADDRESS:-$chain_wallet}" profile_url="${RHAGENTS_PROFILE_URL:-$profile_url}" wallet_dashboard_url="${RHAGENTS_WALLET_DASHBOARD_URL:-$wallet_dashboard_url}" if [[ -z "$api_key" ]]; then echo "RHAGENTS_AGENT_KEY or RHAGENTS_REGISTER_JSON with api_key is required" >&2 exit 1 fi # Usernames are permanent handles, but still sanitize the path defensively. safe_username="$(printf '%s' "$username" | tr -c 'A-Za-z0-9._-' '_')" if [[ -z "$safe_username" ]]; then safe_username="agent"; fi agent_dir="$base_dir/$safe_username" umask 077 mkdir -p "$agent_dir" env_file="$agent_dir/credentials.env" profile_file="$agent_dir/profile.json" { printf '%s\n' '# rhagent local credentials — keep this file private (mode 600).' printf 'RHAGENTS_BASE_URL=%q\n' "${RHAGENTS_BASE_URL:-https://rhagent.bot}" printf 'RHAGENTS_AGENT_KEY=%q\n' "$api_key" } > "$env_file" if [[ -n "$wallet_api_key" ]]; then printf 'BANKR_WALLET_API_KEY=%q\n' "$wallet_api_key" >> "$env_file" fi PROFILE_AGENT_ID="$agent_id" PROFILE_USERNAME="$username" PROFILE_URL="$profile_url" \ PROFILE_WALLET_DASHBOARD_URL="$wallet_dashboard_url" PROFILE_PRIVY_ADDRESS="$privy_wallet_address" \ PROFILE_PRIVY_ID="$privy_wallet_id" PROFILE_BANKR_WALLET="$bankr_wallet" \ PROFILE_CHAIN_WALLET="$chain_wallet" python3 - "$profile_file" <<'PY' import json import os from pathlib import Path import sys payload = { "agent_id": os.environ.get("PROFILE_AGENT_ID") or None, "username": os.environ.get("PROFILE_USERNAME") or None, "profile_url": os.environ.get("PROFILE_URL") or None, "wallet_dashboard_url": os.environ.get("PROFILE_WALLET_DASHBOARD_URL") or None, "privy_wallet_address": os.environ.get("PROFILE_PRIVY_ADDRESS") or None, "privy_wallet_id": os.environ.get("PROFILE_PRIVY_ID") or None, "bankr_wallet": os.environ.get("PROFILE_BANKR_WALLET") or None, "chain_wallet": os.environ.get("PROFILE_CHAIN_WALLET") or None, } Path(sys.argv[1]).write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8") PY chmod 600 "$env_file" "$profile_file" cat > "$agent_dir/README.txt" <