feat: master-password vault, aios uninstall, and a plugin store

VAULT (aios_vault.py) — a master password set at install that gates destructive,
irreversible operations: `aios uninstall`, and disabling the guardrails.

The obvious promise — "the AI can't delete it" — is not achievable by encryption
alone: the agents run as you and have a shell, so any file you can delete they
can delete. What IS enforceable, and what this does:

  1. The password is never stored, only scrypt(pw, salt) with n=2^15 (~32MB,
     ~0.1s/attempt). There is nothing to read back, even with the file.
  2. Deleting it must not GRANT anything. Every protected op fails CLOSED — no
     vault, a corrupt vault, or two copies that disagree all REFUSE. That turns
     "delete the password to escape the gate" into locking yourself out.
  3. Tamper-evidence: self-checksummed and mirrored outside the repo, so a
     `git clean` or a rewritten project tree can't silently drop it.
  4. The agents' shell refuses to touch the vault paths (aios_sec.guard),
     checked BEFORE the guardrails-enabled switch — since disabling guardrails
     is itself vault-protected, letting that unlock vault deletion is circular.

Adversarially tested: editing the hash, deleting both copies, deleting one copy,
and replacing one copy with a correctly-checksummed forgery are all rejected;
deleting the vault refuses the uninstall rather than allowing it; a single
surviving copy auto-heals once the real password proves ownership.

UNINSTALL — `aios uninstall` requires the password, then stops services, removes
the global CLI shim and autostart, and KEEPS your .aios state unless --purge. It
never deletes the project folder. Refuses with exit 1 on a wrong password and
when no password is set at all.

Fixed while testing: getpass() on Windows reads the console directly and ignores
a pipe, so `echo pw | aios uninstall` hung forever instead of failing. Non-tty
stdin now reads the line, which makes it scriptable and unable to hang.

PLUGIN STORE (aios_plugins.py) — one place to browse and install everything
installable, normalising four genuinely different mechanisms: OpenClaw channels
(26), ruflo packs (40, via `npx ruflo plugin add`), skills (13), and OpenClaw
feature plugins. The catalogue is read from what's actually on disk rather than
hardcoded, so it reflects this install. New Plugin Store view with kind filters
and search, plus GET/POST /api/plugins and /api/vault (which never returns
anything secret).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ZD Studios

aios.py

@@ -820,6 +820,7 @@ def cmd_setup(args):
 
     # 7b) hand the agents the machine, and mint the token that keeps that safe
     ensure_hub_token()
+    ensure_master_password(interactive=not args.non_interactive)
     if not args.skip_wire:
         wire_full_control(cfg)
 
@@ -1952,6 +1953,183 @@ def cmd_web(args):
         print(json.dumps(r, indent=2)[:12000])
 
 
+def _vault():
+    sys.path.insert(0, str(ROOT))
+    import aios_vault
+    return aios_vault
+
+
+def _ask_password(prompt: str = "Master password: ") -> str:
+    """Read a password without echoing it.
+
+    getpass() on Windows reads the console device directly and ignores a pipe,
+    so `echo pw | aios uninstall` would hang forever rather than fail. When stdin
+    isn't a terminal, read the line instead — that keeps it scriptable and, more
+    importantly, means it can never hang."""
+    if not sys.stdin.isatty():
+        line = sys.stdin.readline()
+        if not line:
+            return ""
+        return line.rstrip("\r\n")
+    import getpass
+    try:
+        return getpass.getpass(prompt)
+    except Exception:
+        return input(prompt)
+
+
+def ensure_master_password(interactive: bool = True) -> bool:
+    """Offered once at setup. Gates uninstall and other irreversible operations."""
+    V = _vault()
+    if V.is_set():
+        return True
+    if not interactive or not sys.stdin.isatty():
+        warn("no master password set — `aios uninstall` and other protected "
+             "operations will refuse until you run `aios password set`")
+        return False
+    head("Master password")
+    say("  Sets a password required to UNINSTALL The AI OS or disable its guardrails.")
+    say(f"  {C.GRY}Stored as a memory-hard scrypt hash — never in plain text, so it")
+    say(f"  cannot be read back. Deleting it does not bypass anything: protected")
+    say(f"  operations refuse when the vault is missing.{C.R}\n")
+    for _ in range(3):
+        p1 = _ask_password("  Choose a master password (min 8 chars, blank to skip): ")
+        if not p1.strip():
+            warn("skipped — set one later with `aios password set`")
+            return False
+        p2 = _ask_password("  Confirm: ")
+        if p1 != p2:
+            warn("passwords didn't match — try again")
+            continue
+        r = V.set_password(p1)
+        if r.get("ok"):
+            ok("master password set")
+            say(f"  {C.GRY}stored (hashed) at {V.VAULT} and mirrored to {V.MIRROR}{C.R}")
+            return True
+        warn(r.get("error", "could not set password"))
+    return False
+
+
+def cmd_password(args):
+    V = _vault()
+    action = getattr(args, "action", "status")
+    if action == "status":
+        st = V.status()
+        head("Master password")
+        say(f"  set        : {C.GRN if st['set'] else C.YEL}{st['set']}{C.R}")
+        say(f"  primary    : {st['primary']}  {C.GRY}{st['paths']['primary']}{C.R}")
+        say(f"  mirror     : {st['mirror']}  {C.GRY}{st['paths']['mirror']}{C.R}")
+        if st.get("tampered"):
+            warn("a copy is corrupt or was edited — protected operations will refuse")
+        if st.get("mismatch"):
+            warn("the two copies disagree — compare them and remove the wrong one")
+        if not st["set"]:
+            say(f"\n  {C.GRY}Set one with:{C.R} aios password set")
+        return
+    if action == "set":
+        if V.is_set():
+            cur = _ask_password("Current master password: ")
+        else:
+            cur = None
+        for _ in range(3):
+            p1 = _ask_password("New master password (min 8 chars): ")
+            p2 = _ask_password("Confirm: ")
+            if p1 != p2:
+                warn("passwords didn't match")
+                continue
+            r = V.set_password(p1, current=cur)
+            (ok if r.get("ok") else warn)(
+                ("rotated" if r.get("rotated") else "master password set")
+                if r.get("ok") else r.get("error"))
+            return
+        return
+    if action == "verify":
+        r = V.verify(_ask_password())
+        (ok if r.get("ok") else warn)("correct" if r.get("ok") else r.get("error"))
+        sys.exit(0 if r.get("ok") else 1)
+
+
+def cmd_uninstall(args):
+    """Remove The AI OS. Protected by the master password, and never silent."""
+    V = _vault()
+    head("Uninstall The AI OS")
+
+    st = V.status()
+    if not st["set"]:
+        warn("no master password is set, so uninstall is refused.")
+        say(f"  {C.GRY}This is deliberate: a missing vault must never unlock a "
+            f"destructive action.{C.R}")
+        say(f"  {C.GRY}Set one with `aios password set`, or remove the folder "
+            f"manually if you've lost it.{C.R}")
+        sys.exit(1)
+
+    r = V.require(_ask_password("Master password: "), "uninstall")
+    if not r.get("ok"):
+        warn(r.get("error", "incorrect password"))
+        sys.exit(1)
+    ok("password accepted")
+
+    keep_data = not getattr(args, "purge", False)
+    say(f"\n{C.B}This will:{C.R}")
+    say("  · stop every AIOS service")
+    say("  · remove the global `aios` command and any autostart entry")
+    say(f"  · {'KEEP' if keep_data else 'DELETE'} your state in .aios/ "
+        f"(memory, tasks, flows, audit log){'' if keep_data else '  ← --purge'}")
+    say(f"  · {C.GRY}leave the project folder itself — delete it yourself when happy{C.R}")
+    if not getattr(args, "yes", False):
+        if input(f"\n{C.YEL}Type 'uninstall' to confirm: {C.R}").strip().lower() != "uninstall":
+            say("aborted — nothing changed.")
+            return
+
+    head("Stopping services")
+    try:
+        cmd_stop(argparse.Namespace(service=["all"]))
+    except Exception as e:
+        warn(f"stop reported: {e}")
+
+    head("Removing integration")
+    try:
+        cmd_autostart(argparse.Namespace(action="disable"))
+    except Exception as e:
+        warn(f"autostart: {e}")
+    try:
+        install_cli_remove()
+    except Exception as e:
+        warn(f"cli shim: {e}")
+
+    if not keep_data:
+        head("Deleting state")
+        for p in (STATE, V.MIRROR.parent):
+            try:
+                if p.exists():
+                    shutil.rmtree(p, ignore_errors=True)
+                    ok(f"removed {p}")
+            except Exception as e:
+                warn(f"could not remove {p}: {e}")
+
+    say()
+    ok("The AI OS is uninstalled.")
+    say(f"  {C.GRY}The project folder is still at {ROOT} — delete it when you're ready.{C.R}")
+    if keep_data:
+        say(f"  {C.GRY}Your state was kept in {STATE} (use --purge to delete it too).{C.R}")
+
+
+def install_cli_remove():
+    """Undo install_cli()."""
+    d = _cli_bin_dir()
+    removed = []
+    for name in ("aios", "aios.cmd", "aios.ps1"):
+        p = d / name
+        try:
+            if p.exists():
+                p.unlink()
+                removed.append(str(p))
+        except Exception:
+            pass
+    (ok if removed else warn)(f"removed CLI shim(s): {', '.join(removed)}" if removed
+                              else "no CLI shim found on PATH")
+
+
 def cmd_updates(args):
     """Supervised updates: what moved upstream, what the agents think, apply/rollback."""
     sys.path.insert(0, str(ROOT))
@@ -2201,9 +2379,9 @@ def _print_urls(cfg):
 # unreadable once you have 25 subcommands.
 HELP_GROUPS = [
     ("Get started", ["setup", "start", "stop", "restart", "status", "url"]),
-    ("Everyday", ["logs", "doctor", "exec", "web", "channels", "profile", "token"]),
+    ("Everyday", ["logs", "doctor", "exec", "web", "channels", "profile", "token", "password"]),
     ("Agents & updates", ["updates", "update", "claude-login", "ruflo", "attach", "migrate", "wire"]),
-    ("Advanced", ["test", "debug", "autostart", "install-cli", "bootstrap"]),
+    ("Advanced", ["test", "debug", "autostart", "install-cli", "bootstrap", "uninstall"]),
 ]
 TAGLINE = "Nine open-source AI projects. One operating system."
 
@@ -2351,6 +2529,15 @@ def build_parser():
                    help="passed to `npx ruflo` — or: plugins | mcp-register")
     s.set_defaults(func=cmd_ruflo)
 
+    s = sub.add_parser("password", help="master password that gates uninstall + guardrail changes")
+    s.add_argument("action", nargs="?", choices=["status", "set", "verify"], default="status")
+    s.set_defaults(func=cmd_password)
+
+    s = sub.add_parser("uninstall", help="remove The AI OS (requires the master password)")
+    s.add_argument("--purge", action="store_true", help="also delete .aios state (memory, tasks, audit)")
+    s.add_argument("--yes", action="store_true", help="skip the typed confirmation")
+    s.set_defaults(func=cmd_uninstall)
+
     s = sub.add_parser("token", help="print the hub token (needed for non-loopback access)")
     s.add_argument("--rotate", action="store_true", help="generate a fresh token")
     s.set_defaults(func=cmd_token)

aios_hub.py

@@ -36,6 +36,8 @@
 import aios_updates as updates  # noqa: E402  agent-supervised dependency updates
 import aios_web as web          # noqa: E402  YouTube / Reddit / HN / page readers
 import aios_swarm as swarm      # noqa: E402  decompose big tasks across agents
+import aios_plugins as plugins  # noqa: E402  the plugin store
+import aios_vault as vault      # noqa: E402  master password for destructive ops
 
 PORT = int(os.environ.get("AIOS_HUB_PORT", "8787"))
 ROOT = Path(os.environ.get("AIOS_ROOT", Path(__file__).resolve().parent))
@@ -1500,6 +1502,10 @@ def do_GET(self):
         elif self.path == "/api/activity":
             self._send(200, activity(self._query.get("turn", [""])[0],
                                      int(self._query.get("since", ["0"])[0] or 0)))
+        elif self.path == "/api/plugins":
+            self._send(200, {"plugins": plugins.catalog()})
+        elif self.path == "/api/vault":
+            self._send(200, vault.status())   # never returns anything secret
         elif self.path == "/api/actions":
             # Cursor-based so the live monitor never re-sends what it already has.
             since = int(self._query.get("since", ["0"])[0] or 0)
@@ -1762,6 +1768,32 @@ def do_POST(self):
             brain.audit(payload.get("by", "agent"), "web." + op,
                         f"{q[:120]} -> ok={r.get('ok')}")
             self._send(200, r)
+        elif self.path == "/api/plugins":
+            op = payload.get("op", "install")
+            pid = payload.get("id", "")
+            if op == "install":
+                r = plugins.install(pid, payload)
+            elif op == "uninstall":
+                r = plugins.uninstall(pid)
+            else:
+                r = {"ok": False, "error": "unknown op"}
+            brain.audit("hub", "plugin." + op, f"{pid} -> ok={r.get('ok')}")
+            self._send(200, r)
+        elif self.path == "/api/vault":
+            # Set or rotate from the dashboard. Verification happens server-side;
+            # the password is never stored, logged, or echoed back.
+            op = payload.get("op", "status")
+            if op == "set":
+                r = vault.set_password(payload.get("password", ""),
+                                       current=payload.get("current"))
+                brain.audit("hub", "vault.set", f"ok={r.get('ok')}")
+                self._send(200, {k: v for k, v in r.items()})
+            elif op == "verify":
+                r = vault.verify(payload.get("password", ""))
+                brain.audit("hub", "vault.verify", f"ok={r.get('ok')}", ok=r.get("ok", False))
+                self._send(200, {"ok": r.get("ok", False), "error": r.get("error", "")})
+            else:
+                self._send(200, vault.status())
         elif self.path == "/api/swarm":
             msg = payload.get("message", "")
             if not msg: