@addai/node 0.30.2 → 0.30.4

package/dist/capabilities.js

@@ -76,7 +76,14 @@ function runCmd(cmd, args, timeoutMs = 5000) {
         // a single failing probe must not take down the whole heartbeat.
         try {
             const inv = (0, win_1.resolveCliInvocation)(cmd, args);
-            (0, child_process_1.execFile)(inv.file, inv.args, { timeout: timeoutMs, maxBuffer: 256 * 1024 }, (err, stdout, stderr) => {
+            // windowsHide: this probe runs for every harness on every heartbeat, so
+            // without it a Windows node flashes a console window several times a
+            // minute, for ever. stderr is captured here rather than discarded — a
+            // probe's error text is the diagnosis when a harness is present but
+            // broken, unlike the "not found" that whereLookup drops.
+            (0, child_process_1.execFile)(inv.file, inv.args, {
+                timeout: timeoutMs, maxBuffer: 256 * 1024, windowsHide: true,
+            }, (err, stdout, stderr) => {
                 resolve({ ok: !err, stdout: (stdout ?? '').trim(), stderr: (stderr ?? '').trim() });
             });
         }

package/dist/claude-binary.js

@@ -86,7 +86,13 @@ function findClaudeBinary() {
             // (extensionless bash script, .cmd, .ps1). Prefer a native .exe
             // (installer builds), then .cmd — never the extensionless one,
             // which CreateProcess can't run.
-            const lines = (0, child_process_1.execSync)('where claude', { encoding: 'utf-8', timeout: 5000 })
+            // windowsHide and a discarded stderr — see whereLookup in win.ts for
+            // why. execSync goes through cmd.exe, so a miss here costs a console
+            // window AND a line of noise in daemon.log every time it runs.
+            const lines = (0, child_process_1.execSync)('where claude', {
+                encoding: 'utf-8', timeout: 5000, windowsHide: true,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            })
                 .split(/\r?\n/)
                 .map(l => l.trim())
                 .filter(Boolean);

package/dist/claude-print.js

@@ -181,6 +181,9 @@ function spawnClaudePrint(input) {
             cwd: input.workingDirectory,
             env: { ...process.env, TERM: 'dumb' },
             stdio: ['ignore', 'pipe', 'pipe'],
+            // No console window. This is headless work on somebody's machine —
+            // on Windows a spawn without this flashes a terminal every run.
+            windowsHide: true,
         });
     }
     catch (err) {

package/dist/codex-spawn.js

@@ -301,6 +301,9 @@ function spawnCodex(input) {
             cwd: input.workingDirectory,
             env: childEnv,
             stdio: ['ignore', 'pipe', 'pipe'],
+            // No console window. This is headless work on somebody's machine —
+            // on Windows a spawn without this flashes a terminal every run.
+            windowsHide: true,
         });
     }
     catch (err) {

package/dist/desktop/learn/browser.js

@@ -87,9 +87,66 @@ exports.WRAPPER_PATH = '/usr/local/bin/browser';
  * so the loop cannot be rebuilt even if something else recreates the shape.
  */
 exports.WRAPPER_MARKER = 'Written by @addai/node';
+/**
+ * The first-run flow, off.
+ *
+ * ⚠️ Without these you do not get a browser. You get Chrome's first-run
+ * DIALOGS — the terms of service, then "make Chrome your default" — each one a
+ * separate top-level X window. Over xpra, which forwards windows one at a
+ * time, that is what lands on somebody's desktop: a 610x564 dialog, then a
+ * 490x162 one, and never the browser behind them.
+ *
+ * Worse, they are modal and they are traps. Escape on the terms dialog means
+ * DECLINE, and Chrome exits — so "close that popup" closed the whole thing,
+ * and an entity typing into what it assumed was a search box was typing into
+ * a consent prompt.
+ *
+ * Every container starts with a fresh profile, so this happened on every
+ * desktop, every time, and only ever looked like the browser being broken.
+ *
+ * The crash bubble is the same class of problem: any unclean exit — a rebuild,
+ * a killed container — and the next launch opens with "Restore pages?" over
+ * the top of whatever was asked for.
+ *
+ * Verified on a live container: with these flags the first window is
+ * 1918x1078 with a tab strip and an address bar, instead of a dialog.
+ */
+const FIRST_RUN = ' --no-first-run --no-default-browser-check --hide-crash-restore-bubble';
 /** The in-container script that signs the browser in. Beside the extension,
  *  under the same bind mount, so it arrives by the same route. */
 exports.SEED_SCRIPT = '/conf/vault/vault-seed.mjs';
+/**
+ * Chrome's profile, on the mount, and named.
+ *
+ * ⚠️ This one flag fixes three separate things, which is why it is worth the
+ * one-off cost below.
+ *
+ * THE DEBUG PORT. Chrome has refused --remote-debugging-port on the DEFAULT
+ * user data directory since M136. We have always passed the port and never
+ * passed a directory, so the port has never listened — verified on a live
+ * container, where Chrome's own command line carried
+ * --remote-debugging-port=9222 while nothing was bound to 9222. Every reason
+ * the wrapper exists — +Ai Learn watching which control was clicked, the vault
+ * seeder attaching — has therefore been quietly dead on modern Chrome.
+ *
+ * THE PROFILE. Chrome's default lives in the container's writable layer, which
+ * a rebuild destroys. So every login an entity has ever made was thrown away
+ * the next time its desktop was rebuilt. /conf is bind-mounted from the host
+ * (provider.ts publishes it), so a profile here SURVIVES — which is the first
+ * time that has been true.
+ *
+ * THE BOT WALL. A profile with no history and no cookies is a brand-new
+ * stranger, and Google treats it like one. That is a large part of why an
+ * entity meets a CAPTCHA on an ordinary search. A profile that persists earns
+ * reputation instead of resetting it daily.
+ *
+ * ⚠️ THE ONE-OFF COST, stated plainly: this abandons whatever is in the
+ * current default profile, so an entity signed into something appears signed
+ * out, once. That profile was already destroyed on every rebuild, so nothing
+ * durable is being lost — the loss has simply been happening quietly, and this
+ * is the last time.
+ */
+const PROFILE_DIR = '/conf/browser-profile';
 /**
  * The wrapper, exactly.
  *
@@ -117,7 +174,7 @@ function wrapperScript(realBrowser, extensionDir) {
     return `#!/bin/sh
 # Written by @addai/node so +Ai Learn can watch this browser${extensionDir ? ' and the +Ai Vault can fill logins in it' : ''}.
 # Removing it costs you the page detail in a lesson${extensionDir ? ' and vault autofill' : ''} and nothing else.
-${seed}exec ${realBrowser} --remote-debugging-port=${exports.DEBUG_PORT} --remote-debugging-address=127.0.0.1${ext} "$@"
+${seed}exec ${realBrowser} --user-data-dir=${PROFILE_DIR} --remote-debugging-port=${exports.DEBUG_PORT} --remote-debugging-address=127.0.0.1${FIRST_RUN}${ext} "$@"
 `;
 }
 /** Is what is on disk already what we would write? Exact match, so a change to

package/dist/gemini-spawn.js

@@ -357,6 +357,9 @@ function spawnGemini(input) {
             cwd: input.workingDirectory,
             env: childEnv,
             stdio: ['ignore', 'pipe', 'pipe'],
+            // No console window. This is headless work on somebody's machine —
+            // on Windows a spawn without this flashes a terminal every run.
+            windowsHide: true,
         });
     }
     catch (err) {

package/dist/git-identity.js

@@ -66,7 +66,9 @@ async function applyGitIdentity(dir, requestId, token) {
     if (!ident?.configured || !ident.author_name || !ident.author_email)
         return;
     const git = (args) => new Promise((resolve) => {
-        (0, child_process_1.execFile)('git', ['-C', dir, ...args], { timeout: 10_000 }, () => resolve());
+        (0, child_process_1.execFile)('git', ['-C', dir, ...args], 
+        // Headless: no console window on Windows.
+        { timeout: 10_000, windowsHide: true }, () => resolve());
     });
     // Repo-local only — never touch the machine's global config, which other
     // entities and the human owner share.

package/dist/grok-spawn.js

@@ -349,6 +349,9 @@ function spawnGrok(input) {
             cwd: input.workingDirectory,
             env: childEnv,
             stdio: ['ignore', 'pipe', 'pipe'],
+            // No console window. This is headless work on somebody's machine —
+            // on Windows a spawn without this flashes a terminal every run.
+            windowsHide: true,
         });
     }
     catch (err) {

package/dist/kimi-spawn.js

@@ -390,6 +390,9 @@ function spawnKimi(input) {
             cwd: input.workingDirectory,
             env: childEnv,
             stdio: ['ignore', 'pipe', 'pipe'],
+            // No console window. This is headless work on somebody's machine —
+            // on Windows a spawn without this flashes a terminal every run.
+            windowsHide: true,
         });
     }
     catch (err) {

package/dist/projects.js

@@ -105,7 +105,12 @@ function projectDir(p) {
 }
 function run(cmd, args, opts = {}) {
     return new Promise(resolve => {
-        (0, child_process_1.execFile)(cmd, args, { cwd: opts.cwd, timeout: opts.timeoutMs ?? 5 * 60_000, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(cmd, args, {
+            cwd: opts.cwd, timeout: opts.timeoutMs ?? 5 * 60_000,
+            maxBuffer: 4 * 1024 * 1024,
+            // Headless: no console window on Windows.
+            windowsHide: true,
+        }, (err, stdout, stderr) => {
             resolve({ ok: !err, stdout: stdout.toString(), stderr: stderr.toString() });
         });
     });

package/dist/win.js

@@ -91,7 +91,19 @@ function whereLookup(name) {
     if (!exports.IS_WINDOWS)
         return null;
     try {
-        const out = (0, child_process_1.execFileSync)('where', [name], { encoding: 'utf8', timeout: 5000 });
+        // ⚠️ windowsHide, and stderr thrown away. Both for the same reason: this
+        // runs for every CLI we look for, on a timer, and most of them are not
+        // installed. Without windowsHide each miss flashes a console window on
+        // the user's screen; without the stdio the miss writes
+        //
+        //     INFO: Could not find files for the given pattern(s).
+        //
+        // to our stderr, and daemon.log fills with nothing else. "Not found" is
+        // the return value here, not an event worth reporting.
+        const out = (0, child_process_1.execFileSync)('where', [name], {
+            encoding: 'utf8', timeout: 5000, windowsHide: true,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
         const lines = out.split(/\r?\n/).map(l => l.trim()).filter(Boolean);
         const pick = lines.find(l => /\.exe$/i.test(l)) ??
             lines.find(l => /\.cmd$/i.test(l)) ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.30.2",
+  "version": "0.30.4",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [