@addai/node 0.4.0

package/dist/hang-watchdog.js

@@ -0,0 +1,48 @@
+"use strict";
+// Per-run silence watchdog, run INSIDE the daemon. A live daemon whose agent
+// child wedges (e.g. a stuck MCP tool call — grok waiting on a slow flow that
+// never returns) emits no events and, today, nothing kills it until the
+// server-side watchdog fires at 10 minutes. This fires much sooner: if the
+// run produces no output for `idleMs`, we kill the child so the run can fail
+// (and, for a transient hang, retry) instead of dangling.
+//
+// It is reset on every event, so a legitimately streaming run is never
+// touched — only genuine silence trips it. Timer fns are injectable so the
+// behaviour is unit-testable without real waits.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHangWatchdog = createHangWatchdog;
+function createHangWatchdog(opts) {
+    const setT = opts.setTimer ?? ((fn, ms) => { const t = setTimeout(fn, ms); t.unref?.(); return t; });
+    const clearT = opts.clearTimer ?? ((h) => clearTimeout(h));
+    let handle = null;
+    let stopped = false;
+    let fired = false;
+    const arm = () => {
+        if (stopped || fired)
+            return;
+        if (handle != null)
+            clearT(handle);
+        handle = setT(() => {
+            if (stopped || fired)
+                return;
+            fired = true;
+            handle = null;
+            try {
+                opts.onHang();
+            }
+            catch { /* child already gone */ }
+        }, opts.idleMsFn ? opts.idleMsFn() : opts.idleMs);
+    };
+    // Arm immediately: a spawn that produces NOTHING at all must also trip.
+    arm();
+    return {
+        touch() { arm(); },
+        stop() {
+            stopped = true;
+            if (handle != null) {
+                clearT(handle);
+                handle = null;
+            }
+        },
+    };
+}

package/dist/harness-registry.d.ts

@@ -0,0 +1,55 @@
+export type HarnessId = 'claude' | 'codex' | 'gemini' | 'grok' | 'kimi';
+export type LoginStrategy = 'pty-url-code' | 'api-key' | 'on-device';
+export interface HarnessLoginSpec {
+    strategy: LoginStrategy;
+    /** Extra env for the login process (e.g. NO_BROWSER for gemini oauth). */
+    env?: Record<string, string>;
+    /** argv appended to the harness binary for pty-url-code logins. */
+    loginArgs?: string[];
+    /** Extracts the auth URL from pty output (pty-url-code). */
+    urlPattern?: RegExp;
+    /** Output that means "paste the code now" (pty-url-code). */
+    codePromptPattern?: RegExp;
+    /** Output that means the login landed (pty-url-code; exit 0 also counts). */
+    successPattern?: RegExp;
+    /** Shown in Studio / TUI for on-device (and as the api-key hint). */
+    instructions: string;
+}
+export interface HarnessLogoutSpec {
+    /** argv appended to the harness binary (e.g. ['auth','logout']). */
+    cmd?: string[];
+    /** Credential files to remove, ~-relative to the home dir. */
+    files?: string[];
+    /** Env var lines to strip from an env file: [envFilePath, VAR_NAME][]. */
+    envStrip?: Array<[string, string]>;
+}
+export interface HarnessSpec {
+    id: HarnessId;
+    label: string;
+    /** npm package for `npm i -g` installs; null = not npm-installable. */
+    npmPackage: string | null;
+    findBinary: () => string | null;
+    /** Model-effort levels this harness accepts (empty = no effort knob). */
+    efforts: string[];
+    login: HarnessLoginSpec;
+    /** Additional remote login methods (Studio offers one button each).
+     *  Selected by issuing the command with input.method === entry.method. */
+    extraLogins?: Array<{
+        method: string;
+    } & HarnessLoginSpec>;
+    /** How to log this harness out remotely; absent = on-device only. */
+    logout?: HarnessLogoutSpec;
+}
+export declare const HARNESSES: Record<HarnessId, HarnessSpec>;
+export declare const HARNESS_IDS: HarnessId[];
+/** Forget every finder's cached lookup — a probe after this sees the
+ *  machine as it is now, not as it was at daemon start. (claude's finder
+ *  is uncached.) */
+export declare function resetBinaryCaches(): void;
+export declare function harness(id: string): HarnessSpec | null;
+export declare function isInstallable(id: HarnessId): boolean;
+/** First URL in a pty output chunk, ANSI-stripped. Exported for tests. */
+export declare function extractAuthUrl(spec: HarnessSpec, text: string): string | null;
+export declare function seesCodePrompt(spec: HarnessSpec, text: string): boolean;
+export declare function seesSuccess(spec: HarnessSpec, text: string): boolean;
+export declare function stripAnsi(s: string): string;

package/dist/harness-registry.js

@@ -0,0 +1,180 @@
+"use strict";
+// Single source of truth for everything the daemon knows about agent
+// harnesses: how to find them, how to install them, how to log them in,
+// and which model-effort levels each supports. capabilities.ts reports
+// from here (so Studio needs no duplicate registry), command-runner.ts
+// executes from here, and the `harnesses` TUI renders from here.
+//
+// Honesty contract: `installable`/`login.strategy` describe what the
+// daemon can ACTUALLY do remotely. Harnesses whose vendors ship custom
+// installers or localhost-callback OAuth are marked on-device with human
+// instructions — a truthful "go to the machine" beats a fake button.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HARNESS_IDS = exports.HARNESSES = void 0;
+exports.resetBinaryCaches = resetBinaryCaches;
+exports.harness = harness;
+exports.isInstallable = isInstallable;
+exports.extractAuthUrl = extractAuthUrl;
+exports.seesCodePrompt = seesCodePrompt;
+exports.seesSuccess = seesSuccess;
+exports.stripAnsi = stripAnsi;
+const claude_binary_1 = require("./claude-binary");
+const codex_binary_1 = require("./codex-binary");
+const gemini_binary_1 = require("./gemini-binary");
+const grok_binary_1 = require("./grok-binary");
+const kimi_binary_1 = require("./kimi-binary");
+exports.HARNESSES = {
+    claude: {
+        id: 'claude',
+        label: 'Claude Code',
+        npmPackage: '@anthropic-ai/claude-code',
+        findBinary: claude_binary_1.findClaudeBinary,
+        efforts: ['low', 'medium', 'high', 'xhigh', 'max'],
+        login: {
+            strategy: 'pty-url-code',
+            loginArgs: ['auth', 'login'],
+            // "Visit: https://claude.ai/oauth/authorize?..." (exact copy varies
+            // by version, so match any https URL on a line after ~"browser"/"visit",
+            // falling back to the first URL seen).
+            urlPattern: /(https:\/\/[^\s]+)/,
+            codePromptPattern: /paste (?:the )?code|enter (?:the )?code|authorization code/i,
+            successPattern: /logged in|login successful|token (?:saved|created)|success/i,
+            instructions: 'Open the link in your own browser, approve, and paste the code back here.',
+        },
+        logout: { cmd: ['auth', 'logout'] },
+    },
+    codex: {
+        id: 'codex',
+        label: 'Codex',
+        npmPackage: '@openai/codex',
+        findBinary: codex_binary_1.findCodexBinary,
+        efforts: ['minimal', 'low', 'medium', 'high'],
+        login: {
+            strategy: 'api-key',
+            instructions: 'Paste an OpenAI API key (applied via `codex login --with-api-key`).',
+        },
+        extraLogins: [{
+                method: 'chatgpt',
+                strategy: 'pty-url-code',
+                loginArgs: ['login', '--device-auth'],
+                urlPattern: /(https:\/\/[^\s]+)/,
+                successPattern: /logged in|success/i,
+                instructions: 'Sign in with your ChatGPT account in the browser — the CLI completes by itself.',
+            }],
+        logout: { cmd: ['logout'] },
+    },
+    gemini: {
+        id: 'gemini',
+        label: 'Gemini CLI',
+        npmPackage: '@google/gemini-cli',
+        findBinary: gemini_binary_1.findGeminiBinary,
+        efforts: [],
+        login: {
+            strategy: 'api-key',
+            instructions: 'Paste a Gemini API key (stored in ~/.gemini/.env as GEMINI_API_KEY).',
+        },
+        extraLogins: [
+            // Google-account OAuth, fully remote: NO_BROWSER makes the CLI print
+            // the accounts.google.com URL and wait for the pasted auth code.
+            {
+                method: 'google',
+                strategy: 'pty-url-code',
+                loginArgs: [],
+                env: { NO_BROWSER: 'true' },
+                urlPattern: /(https:\/\/accounts\.google\.com[^\s]+)/,
+                codePromptPattern: /code/i,
+                successPattern: /authenticated|success|logged in/i,
+                instructions: 'Sign in with Google in your browser, then paste the authorization code back here.',
+            },
+            // Vertex AI express mode: GOOGLE_API_KEY + GOOGLE_GENAI_USE_VERTEXAI
+            // in ~/.gemini/.env — a paste-a-key flow, no device interaction.
+            {
+                method: 'vertex',
+                strategy: 'api-key',
+                instructions: 'Paste a Vertex AI (express mode) API key — stored in ~/.gemini/.env as GOOGLE_API_KEY with GOOGLE_GENAI_USE_VERTEXAI=true.',
+            },
+        ],
+        logout: {
+            files: ['.gemini/oauth_creds.json', '.gemini/google_accounts.json'],
+            envStrip: [
+                ['.gemini/.env', 'GEMINI_API_KEY'],
+                ['.gemini/.env', 'GOOGLE_API_KEY'],
+                ['.gemini/.env', 'GOOGLE_GENAI_USE_VERTEXAI'],
+            ],
+        },
+    },
+    grok: {
+        id: 'grok',
+        label: 'Grok CLI',
+        npmPackage: null,
+        findBinary: grok_binary_1.findGrokBinary,
+        efforts: [],
+        login: {
+            strategy: 'pty-url-code',
+            loginArgs: ['login', '--device-auth'],
+            urlPattern: /(https:\/\/[^\s]+)/,
+            successPattern: /logged in|success|welcome/i,
+            instructions: 'Approve the sign-in in your browser — the CLI completes by itself. ' +
+                '(Install still happens on the device via the xAI installer.)',
+        },
+        logout: { files: ['.grok/auth.json'] },
+    },
+    kimi: {
+        id: 'kimi',
+        label: 'Kimi CLI',
+        npmPackage: '@moonshot-ai/kimi-code',
+        findBinary: kimi_binary_1.findKimiBinary,
+        efforts: [],
+        login: {
+            strategy: 'pty-url-code',
+            loginArgs: ['login'],
+            // Device-code flow: prints a verification URL (and usually a short
+            // user code) then polls — no paste-back into the CLI needed.
+            urlPattern: /(https:\/\/[^\s]+)/,
+            successPattern: /logged in|login successful|success|welcome/i,
+            instructions: 'Open the link in your browser and approve — the CLI completes by itself. ' +
+                '(MOONSHOT_API_KEY in the environment also works.)',
+        },
+        logout: { files: ['.kimi-code/credentials/kimi-code.json'] },
+    },
+};
+exports.HARNESS_IDS = Object.keys(exports.HARNESSES);
+/** Forget every finder's cached lookup — a probe after this sees the
+ *  machine as it is now, not as it was at daemon start. (claude's finder
+ *  is uncached.) */
+function resetBinaryCaches() {
+    (0, codex_binary_1.resetCache)();
+    (0, gemini_binary_1.resetCache)();
+    (0, grok_binary_1.resetCache)();
+    (0, kimi_binary_1.resetCache)();
+}
+function harness(id) {
+    return exports.HARNESSES[id] ?? null;
+}
+function isInstallable(id) {
+    return exports.HARNESSES[id].npmPackage !== null;
+}
+/** First URL in a pty output chunk, ANSI-stripped. Exported for tests. */
+function extractAuthUrl(spec, text) {
+    if (!spec.login.urlPattern)
+        return null;
+    const clean = stripAnsi(text);
+    const m = spec.login.urlPattern.exec(clean);
+    if (!m)
+        return null;
+    // Trim trailing punctuation the regex may have swallowed.
+    return m[1].replace(/[)\].,'"]+$/, '');
+}
+function seesCodePrompt(spec, text) {
+    return !!spec.login.codePromptPattern?.test(stripAnsi(text));
+}
+function seesSuccess(spec, text) {
+    return !!spec.login.successPattern?.test(stripAnsi(text));
+}
+function stripAnsi(s) {
+    // CSI sequences, then OSC sequences (BEL- or ST-terminated).
+    // eslint-disable-next-line no-control-regex
+    return s
+        .replace(/\x1b\[[0-9;?]*[ -\/]*[@-~]/g, '')
+        .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, '');
+}

package/dist/heartbeat.d.ts

@@ -0,0 +1,13 @@
+export declare function setPendingCommandsHook(cb: () => void): void;
+/** Announce a clean shutdown so the server flips us offline immediately
+ *  (status='offline') instead of waiting ~90s for last_seen_at to age out —
+ *  lets a planned restart fail over instantly. Best-effort; the stale-window
+ *  is the backstop if this call doesn't land. */
+export declare function goOffline(): Promise<void>;
+/** Push one heartbeat immediately, out of band. Used on wake-from-sleep so
+ *  the server stops treating a just-resumed runtime as offline without
+ *  waiting for the next 30s interval. Safe to call anytime; no-ops the same
+ *  way tick() does when unpaired or circuit-broken. */
+export declare function beat(): Promise<void>;
+export declare function start(): void;
+export declare function stop(): void;

package/dist/heartbeat.js

@@ -0,0 +1,95 @@
+"use strict";
+// Periodic heartbeat — pushes a fresh capabilities probe up to Supabase
+// every HEARTBEAT_INTERVAL_MS. Run as a long-lived loop while the daemon
+// is paired.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setPendingCommandsHook = setPendingCommandsHook;
+exports.goOffline = goOffline;
+exports.beat = beat;
+exports.start = start;
+exports.stop = stop;
+const supabase_client_1 = require("./supabase-client");
+const store_1 = require("./store");
+const capabilities_1 = require("./capabilities");
+const config_1 = require("./config");
+let timer = null;
+let stopped = false;
+/** Hook invoked when the server reports queued runtime_commands. Wired by
+ *  index.ts (keeps heartbeat ← command-runner import direction acyclic). */
+let onPendingCommands = null;
+function setPendingCommandsHook(cb) {
+    onPendingCommands = cb;
+}
+async function tick() {
+    // Skip if the daemon-wide circuit breaker is open. Heartbeats are
+    // safe to miss — vault marks the runtime offline after ~90s; the
+    // breaker pause is shorter than that so we resume in time.
+    if ((0, supabase_client_1.rpcShouldSkip)())
+        return;
+    const pairing = (0, store_1.readPairing)();
+    if (!pairing)
+        return;
+    try {
+        const capabilities = await (0, capabilities_1.probeCapabilities)();
+        // Older servers return void; newer ones return {pending_commands: n}
+        // so the daemon can drain install/login commands without a poller.
+        const res = await (0, supabase_client_1.rpc)('runtime_heartbeat', {
+            p_token: pairing.daemonToken,
+            p_capabilities: capabilities,
+        });
+        if (res && typeof res.pending_commands === 'number' && res.pending_commands > 0) {
+            onPendingCommands?.();
+        }
+    }
+    catch (err) {
+        if (err instanceof supabase_client_1.RpcError && err.status === 401) {
+            // Server-side has revoked us (or 42501 unauthorized). Clear our
+            // local pairing so the next launch goes back through the code
+            // flow.
+            console.error('[heartbeat] runtime unpaired by server; clearing state.');
+            (0, store_1.clearPairing)();
+            stop();
+        }
+        else {
+            // Soft fail; we'll try again next tick.
+            console.error('[heartbeat] failed:', err.message || err);
+        }
+    }
+}
+/** Announce a clean shutdown so the server flips us offline immediately
+ *  (status='offline') instead of waiting ~90s for last_seen_at to age out —
+ *  lets a planned restart fail over instantly. Best-effort; the stale-window
+ *  is the backstop if this call doesn't land. */
+async function goOffline() {
+    const pairing = (0, store_1.readPairing)();
+    if (!pairing)
+        return;
+    try {
+        await (0, supabase_client_1.rpc)('runtime_go_offline', { p_token: pairing.daemonToken });
+    }
+    catch (err) {
+        console.error('[shutdown] go-offline failed:', err.message || err);
+    }
+}
+/** Push one heartbeat immediately, out of band. Used on wake-from-sleep so
+ *  the server stops treating a just-resumed runtime as offline without
+ *  waiting for the next 30s interval. Safe to call anytime; no-ops the same
+ *  way tick() does when unpaired or circuit-broken. */
+async function beat() {
+    await tick();
+}
+function start() {
+    if (timer || stopped)
+        return;
+    // Fire one immediately so vault sees the runtime online without waiting
+    // 30s for the first interval.
+    void tick();
+    timer = setInterval(() => { void tick(); }, config_1.HEARTBEAT_INTERVAL_MS);
+}
+function stop() {
+    stopped = true;
+    if (timer) {
+        clearInterval(timer);
+        timer = null;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+declare const VERSION: string;
+export interface RunningRuntime {
+    port: number;
+    pid: number;
+    stop(): Promise<void>;
+}
+/**
+ * Boot the daemon. If we don't have a pairing yet, run the user through
+ * the 5-letter code flow first; once paired, kick off the heartbeat.
+ */
+export declare function start(): Promise<RunningRuntime>;
+export { VERSION };