@addai/node 0.4.0

package/dist/command-runner.js

@@ -0,0 +1,592 @@
+"use strict";
+// Executes runtime_commands issued from Entity Studio: install a harness
+// (npm i -g) or log one in (PTY-bridged OAuth / API key). Woken by the
+// heartbeat's pending_commands hint — no always-on poller. One command
+// runs at a time; while one is live we poll its row every ~2s so the
+// login conversation (URL out, code back) feels interactive.
+//
+// Truth contract: login "success" is only reported after a capabilities
+// re-probe says authed=true. The CLI's exit code is a hint, the probe is
+// the verdict.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRestartHook = setRestartHook;
+exports.wake = wake;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const pty = __importStar(require("node-pty"));
+const supabase_client_1 = require("./supabase-client");
+const store_1 = require("./store");
+const capabilities_1 = require("./capabilities");
+const heartbeat_1 = require("./heartbeat");
+const win_1 = require("./win");
+const harness_registry_1 = require("./harness-registry");
+const self_update_1 = require("./self-update");
+const paths_1 = require("./paths");
+const pty_helper_1 = require("./pty-helper");
+const COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
+/** Own version, read the same way index.ts does. Resolved here rather than
+ *  imported from index.ts, which already imports this module. */
+const VERSION = (() => {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const pkg = require('../package.json');
+        if (typeof pkg.version === 'string' && pkg.version.length > 0)
+            return pkg.version;
+    }
+    catch { /* fall through */ }
+    return '0.0.0';
+})();
+/** Where did npm -g just put the bin? `npm prefix -g` + /bin/<name>
+ *  (posix) or <prefix>\\<name>.cmd (win). Returns the path if it exists. */
+async function npmGlobalBinFor(name) {
+    const inv = (0, win_1.resolveCliInvocation)('npm', ['prefix', '-g']);
+    const prefix = await new Promise(resolve => {
+        try {
+            const child = (0, child_process_1.spawn)(inv.file, inv.args, { env: process.env, windowsHide: true, timeout: 15_000 });
+            let out = '';
+            child.stdout?.on('data', b => { out += b.toString('utf8'); });
+            child.on('error', () => resolve(null));
+            child.on('exit', code => resolve(code === 0 ? out.trim() : null));
+        }
+        catch {
+            resolve(null);
+        }
+    });
+    if (!prefix)
+        return null;
+    const candidates = process.platform === 'win32'
+        ? [path.join(prefix, `${name}.cmd`), path.join(prefix, `${name}.exe`)]
+        : [path.join(prefix, 'bin', name)];
+    for (const c of candidates) {
+        try {
+            if (fs.statSync(c).isFile())
+                return c;
+        }
+        catch { /* next */ }
+    }
+    return null;
+}
+const INPUT_POLL_MS = 2_000;
+const LOG_TAIL_CHARS = 4_000;
+const LOG_PUSH_MS = 1_000;
+let running = false;
+let restartHook = null;
+function setRestartHook(fn) { restartHook = fn; }
+function token() {
+    return (0, store_1.readPairing)()?.daemonToken ?? null;
+}
+async function update(id, status, payload, error) {
+    const t = token();
+    if (!t)
+        return;
+    try {
+        await (0, supabase_client_1.rpc)('runtime_command_update', {
+            p_token: t, p_id: id,
+            p_status: status, p_payload: payload ?? null, p_error: error ?? null,
+        });
+    }
+    catch (err) {
+        console.error('[commands] update failed:', err.message);
+    }
+}
+async function pollRow(id) {
+    const t = token();
+    if (!t)
+        return null;
+    try {
+        // runtime_command_poll RETURNS TABLE → PostgREST responds with an
+        // ARRAY of rows. Treating it as a bare object made status/input read
+        // as undefined, so the daemon polled forever, blind to pasted codes
+        // and cancels (live incident: gemini Google login stuck on
+        // awaiting_input with the code sitting on the row).
+        const rows = await (0, supabase_client_1.rpc)('runtime_command_poll', { p_token: t, p_id: id });
+        if (Array.isArray(rows))
+            return rows[0] ?? null;
+        return rows ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Wait until Studio supplies input (or cancel/timeout). Returns null on
+ *  cancel or deadline; polls every INPUT_POLL_MS. */
+async function awaitInput(id, deadline, have) {
+    for (;;) {
+        if (Date.now() > deadline)
+            return null;
+        const row = await pollRow(id);
+        if (!row || row.status === 'canceled')
+            return null;
+        const v = row.input ? have(row.input) : undefined;
+        if (v && v.trim())
+            return v.trim();
+        await new Promise(r => setTimeout(r, INPUT_POLL_MS));
+    }
+}
+async function reprobeAuthed(id) {
+    const caps = await (0, capabilities_1.probeCapabilities)();
+    const h = caps[id];
+    return { authed: !!h?.authed, version: h?.version };
+}
+/* ── install ─────────────────────────────────────────────────────────── */
+async function runInstall(cmd, spec) {
+    if (!(0, harness_registry_1.isInstallable)(spec.id)) {
+        await update(cmd.id, 'failed', { instructions: spec.login.instructions }, `${spec.label} has no npm installer — install it on the device.`);
+        return;
+    }
+    await update(cmd.id, 'running', { step: 'installing', log: `$ npm install -g ${spec.npmPackage}\n` });
+    const state = { log: `$ npm install -g ${spec.npmPackage}\n`, lastPush: 0 };
+    const runNpm = (extraArgs) => new Promise(resolve => {
+        let settled = false;
+        const done = (code) => { if (!settled) {
+            settled = true;
+            resolve(code);
+        } };
+        let child;
+        const inv = (0, win_1.resolveCliInvocation)('npm', ['install', '-g', ...extraArgs, spec.npmPackage]);
+        try {
+            child = (0, child_process_1.spawn)(inv.file, inv.args, { env: process.env, windowsHide: true });
+        }
+        catch (err) {
+            state.log += `spawn failed: ${err.message}\n`;
+            done(-1);
+            return;
+        }
+        const timer = setTimeout(() => { try {
+            child.kill('SIGKILL');
+        }
+        catch { /* gone */ } done(-2); }, COMMAND_TIMEOUT_MS);
+        const onChunk = (b) => {
+            state.log = (state.log + b.toString('utf8')).slice(-LOG_TAIL_CHARS);
+            const now = Date.now();
+            if (now - state.lastPush > LOG_PUSH_MS) {
+                state.lastPush = now;
+                void update(cmd.id, null, { log: state.log });
+            }
+        };
+        child.stdout?.on('data', onChunk);
+        child.stderr?.on('data', onChunk);
+        child.on('error', err => { state.log += `\n${err.message}\n`; clearTimeout(timer); done(-1); });
+        child.on('exit', code => { clearTimeout(timer); done(code ?? -1); });
+    });
+    let exitCode = await runNpm([]);
+    // Root-owned global prefix (classic Mac /usr/local): retry into the
+    // daemon's own toolchain prefix — the binary finders search its bin dir.
+    if (exitCode !== 0 && /EACCES/.test(state.log)) {
+        const toolsPrefix = path.join(paths_1.RUNTIME_HOME, 'tools');
+        try {
+            fs.mkdirSync(toolsPrefix, { recursive: true });
+        }
+        catch { /* spawn will surface it */ }
+        state.log = state.log.slice(-1500)
+            + `\n\nGlobal npm prefix is not writable — retrying into ${toolsPrefix}\n`;
+        await update(cmd.id, null, { log: state.log });
+        exitCode = await runNpm(['--prefix', toolsPrefix]);
+    }
+    if (exitCode !== 0) {
+        await update(cmd.id, 'failed', { log: state.log }, exitCode === -2 ? 'install timed out after 10 minutes' : `npm exited with code ${exitCode}`);
+        return;
+    }
+    // Verify the binary actually resolves now — npm can "succeed" into a
+    // PATH the daemon doesn't search. Probe first (it resets the finder
+    // caches, which otherwise still hold the pre-install miss), then fall
+    // back to asking npm where its global bin dir actually is.
+    const probe = await reprobeAuthed(spec.id);
+    let bin = spec.findBinary();
+    if (!bin)
+        bin = await npmGlobalBinFor(spec.id);
+    await (0, heartbeat_1.beat)();
+    if (!bin) {
+        await update(cmd.id, 'failed', { log: state.log }, 'npm reported success but the binary was not found on this machine’s PATH.');
+        return;
+    }
+    await update(cmd.id, 'completed', {
+        log: state.log, version: probe.version ?? null,
+        next: probe.authed ? null : 'login',
+    });
+}
+/* ── login ───────────────────────────────────────────────────────────── */
+async function runLoginPty(cmd, spec, login = spec.login) {
+    (0, harness_registry_1.resetBinaryCaches)(); // a just-installed binary must be loginable immediately
+    const bin = spec.findBinary();
+    if (!bin) {
+        await update(cmd.id, 'failed', {}, `${spec.label} is not installed.`);
+        return;
+    }
+    await update(cmd.id, 'running', { step: 'starting-login', instructions: login.instructions });
+    const deadline = Date.now() + COMMAND_TIMEOUT_MS;
+    const ptyOpts = {
+        name: 'xterm-256color', cols: 120, rows: 30,
+        cwd: os.homedir(),
+        env: { ...process.env, ...(login.env ?? {}) },
+    };
+    let child;
+    try {
+        child = pty.spawn(bin, login.loginArgs ?? [], ptyOpts);
+    }
+    catch (err) {
+        // node-pty's "posix_spawnp failed." is almost always its own
+        // spawn-helper missing +x, not a problem with the harness binary.
+        // Repair and retry once so the operator's click succeeds now rather
+        // than after a daemon restart.
+        const repair = (0, pty_helper_1.ensurePtyHelperExecutable)();
+        if (repair.repaired.length === 0) {
+            await update(cmd.id, 'failed', {}, `could not start ${spec.label} login: ${err.message}` +
+                (repair.dir ? ` (node-pty at ${repair.dir}; spawn-helper looks executable)` : ' (node-pty could not be located)'));
+            return;
+        }
+        console.log((0, pty_helper_1.describeRepair)(repair));
+        try {
+            child = pty.spawn(bin, login.loginArgs ?? [], ptyOpts);
+        }
+        catch (err2) {
+            await update(cmd.id, 'failed', {}, `could not start ${spec.label} login after repairing node-pty's spawn-helper: ${err2.message}`);
+            return;
+        }
+    }
+    let buffer = '';
+    let urlSent = false;
+    let promptSeen = false;
+    let codeSent = false;
+    let exited = false;
+    let exitCode = -1;
+    child.onData((chunk) => { buffer = (buffer + chunk).slice(-16_000); });
+    child.onExit(({ exitCode: c }) => { exited = true; exitCode = c; });
+    const kill = () => { try {
+        child.kill();
+    }
+    catch { /* gone */ } };
+    for (;;) {
+        if (Date.now() > deadline) {
+            kill();
+            await update(cmd.id, 'failed', {}, 'login timed out after 10 minutes');
+            return;
+        }
+        const loginSpec = { ...spec, login };
+        if (!urlSent) {
+            const url = (0, harness_registry_1.extractAuthUrl)(loginSpec, buffer);
+            if (url) {
+                urlSent = true;
+                // Device-code flows print a short user code to type on the site.
+                const userCode = /\b([A-Z0-9]{4,8}-[A-Z0-9]{4,8})\b/.exec((0, harness_registry_1.stripAnsi)(buffer))?.[1] ?? null;
+                await update(cmd.id, null, { url, user_code: userCode, instructions: login.instructions });
+            }
+        }
+        if (urlSent && !promptSeen && (0, harness_registry_1.seesCodePrompt)(loginSpec, buffer)) {
+            promptSeen = true;
+            await update(cmd.id, 'awaiting_input', { needs: 'code' });
+        }
+        if (promptSeen && !codeSent) {
+            const code = await awaitInput(cmd.id, deadline, i => i.code);
+            if (code === null) {
+                kill();
+                await update(cmd.id, 'canceled', {}, 'canceled or timed out waiting for the code');
+                return;
+            }
+            codeSent = true;
+            child.write(code + '\r');
+            await update(cmd.id, 'running', { step: 'verifying' });
+        }
+        // TUI-style CLIs (gemini) never exit after auth — once the code went
+        // in, poll the probe and declare success the moment authed flips.
+        if (codeSent) {
+            const probe = await reprobeAuthed(spec.id);
+            if (probe.authed) {
+                kill();
+                await (0, heartbeat_1.beat)();
+                await update(cmd.id, 'completed', { step: 'done' });
+                return;
+            }
+        }
+        if (exited || (0, harness_registry_1.seesSuccess)(loginSpec, buffer)) {
+            kill();
+            const probe = await reprobeAuthed(spec.id);
+            await (0, heartbeat_1.beat)();
+            if (probe.authed) {
+                await update(cmd.id, 'completed', { step: 'done' });
+            }
+            else {
+                await update(cmd.id, 'failed', { tail: (0, harness_registry_1.stripAnsi)(buffer).slice(-600) }, exited && exitCode !== 0
+                    ? `login exited with code ${exitCode}`
+                    : 'login flow finished but the CLI still reports unauthenticated');
+            }
+            return;
+        }
+        // Also react to a Studio-side cancel while we wait for output.
+        const row = await pollRow(cmd.id);
+        if (row?.status === 'canceled') {
+            kill();
+            return;
+        }
+        await new Promise(r => setTimeout(r, 1_000));
+    }
+}
+function writeEnvVars(rel, vars) {
+    try {
+        const envPath = path.join(os.homedir(), rel);
+        fs.mkdirSync(path.dirname(envPath), { recursive: true });
+        let body = '';
+        try {
+            body = fs.readFileSync(envPath, 'utf8');
+        }
+        catch { /* new file */ }
+        const names = Object.keys(vars);
+        const lines = body.split('\n').filter(l => l.trim() && !names.some(n => l.startsWith(`${n}=`)));
+        for (const [k, v] of Object.entries(vars))
+            lines.push(`${k}=${v}`);
+        fs.writeFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 });
+        return null;
+    }
+    catch (err) {
+        return err.message;
+    }
+}
+async function applyApiKey(spec, key, method) {
+    if (spec.id === 'codex') {
+        (0, harness_registry_1.resetBinaryCaches)();
+        const bin = spec.findBinary();
+        if (!bin)
+            return 'codex is not installed';
+        // Current codex reads the key from STDIN (`codex login --with-api-key`).
+        const inv = (0, win_1.resolveCliInvocation)(bin, ['login', '--with-api-key']);
+        return await new Promise(resolve => {
+            const child = (0, child_process_1.spawn)(inv.file, inv.args, { env: process.env, windowsHide: true, timeout: 60_000 });
+            let err = '';
+            child.stderr?.on('data', b => { err += b.toString('utf8'); });
+            child.on('error', e => resolve(e.message));
+            child.on('exit', code => resolve(code === 0 ? null : (err.trim() || `exit ${code}`)));
+            child.stdin?.write(key + '\n');
+            child.stdin?.end();
+        });
+    }
+    if (spec.id === 'gemini') {
+        return method === 'vertex'
+            ? writeEnvVars('.gemini/.env', { GOOGLE_API_KEY: key, GOOGLE_GENAI_USE_VERTEXAI: 'true' })
+            : writeEnvVars('.gemini/.env', { GEMINI_API_KEY: key });
+    }
+    return `no api-key handler for ${spec.id}`;
+}
+async function runLoginApiKey(cmd, spec, method, instructions) {
+    await update(cmd.id, 'awaiting_input', { needs: 'api_key', instructions: instructions ?? spec.login.instructions });
+    const deadline = Date.now() + COMMAND_TIMEOUT_MS;
+    const key = cmd.input?.api_key?.trim() || await awaitInput(cmd.id, deadline, i => i.api_key);
+    if (key === null) {
+        await update(cmd.id, 'canceled', {}, 'canceled or timed out waiting for the key');
+        return;
+    }
+    await update(cmd.id, 'running', { step: 'applying-key' });
+    const err = await applyApiKey(spec, key, method);
+    if (err) {
+        await update(cmd.id, 'failed', {}, err);
+        return;
+    }
+    const probe = await reprobeAuthed(spec.id);
+    await (0, heartbeat_1.beat)();
+    if (probe.authed)
+        await update(cmd.id, 'completed', { step: 'done' });
+    else
+        await update(cmd.id, 'failed', {}, 'key applied but the CLI still reports unauthenticated');
+}
+async function runLogout(cmd, spec) {
+    if (!spec.logout) {
+        await update(cmd.id, 'failed', { instructions: spec.login.instructions }, `${spec.label} can only be logged out on the device.`);
+        return;
+    }
+    await update(cmd.id, 'running', { step: 'logging-out' });
+    (0, harness_registry_1.resetBinaryCaches)();
+    if (spec.logout.cmd) {
+        const bin = spec.findBinary();
+        if (!bin) {
+            await update(cmd.id, 'failed', {}, `${spec.label} is not installed.`);
+            return;
+        }
+        const inv = (0, win_1.resolveCliInvocation)(bin, spec.logout.cmd);
+        const err = await new Promise(resolve => {
+            try {
+                const child = (0, child_process_1.spawn)(inv.file, inv.args, { env: process.env, windowsHide: true, timeout: 60_000 });
+                let stderr = '';
+                child.stderr?.on('data', b => { stderr += b.toString('utf8'); });
+                child.on('error', e => resolve(e.message));
+                child.on('exit', code => resolve(code === 0 ? null : (stderr.trim() || `exit ${code}`)));
+            }
+            catch (e) {
+                resolve(e.message);
+            }
+        });
+        if (err) {
+            await update(cmd.id, 'failed', {}, err);
+            return;
+        }
+    }
+    for (const rel of spec.logout.files ?? []) {
+        try {
+            fs.rmSync(path.join(os.homedir(), rel), { force: true });
+        }
+        catch { /* best effort */ }
+    }
+    for (const [rel, varName] of spec.logout.envStrip ?? []) {
+        const envPath = path.join(os.homedir(), rel);
+        try {
+            const body = fs.readFileSync(envPath, 'utf8');
+            const lines = body.split('\n').filter(l => !l.startsWith(`${varName}=`));
+            fs.writeFileSync(envPath, lines.join('\n'), { mode: 0o600 });
+        }
+        catch { /* no env file = nothing to strip */ }
+    }
+    const probe = await reprobeAuthed(spec.id);
+    await (0, heartbeat_1.beat)();
+    if (!probe.authed)
+        await update(cmd.id, 'completed', { step: 'done' });
+    else
+        await update(cmd.id, 'failed', {}, 'logout ran but the CLI still reports authenticated');
+}
+/* ── update_runtime ──────────────────────────────────────────────────────
+ * Roll THIS node to a version (default: npm latest) and come back up.
+ *
+ * The command is deliberately left `running` here: this process is about to
+ * stop existing, so it cannot honestly report the outcome. index.ts's boot
+ * path completes it from the handoff file once the replacement daemon is
+ * actually up, with whatever version it actually came up as. */
+async function runUpdateRuntime(cmd) {
+    const target = (cmd.input?.version ?? '').trim() || 'latest';
+    if (!restartHook) {
+        await update(cmd.id, 'failed', {}, 'this daemon is too old to restart itself');
+        return;
+    }
+    const mode = (0, self_update_1.detectLaunchMode)(process.argv[1] ?? '');
+    if (mode === 'source' && target !== 'latest') {
+        // A git checkout's version comes from the working tree, not npm — we'd
+        // restart and report the same old version, looking like a silent no-op.
+        await update(cmd.id, 'failed', { mode }, 'this node runs from a source checkout — pull and rebuild it there; a remote version bump cannot apply');
+        return;
+    }
+    await update(cmd.id, 'running', { step: 'draining', mode, target_version: target, from_version: VERSION });
+    try {
+        await restartHook({ commandId: cmd.id, version: target });
+    }
+    catch (err) {
+        // The hook owns the point of no return (it writes the handoff only once
+        // the replacement is spawned), so a throw here means we never left.
+        await update(cmd.id, 'failed', { mode }, `restart failed: ${err.message}`);
+    }
+}
+/* ── dispatcher ──────────────────────────────────────────────────────── */
+async function execute(cmd) {
+    // Not a harness command — dispatch before the harness lookup, which would
+    // otherwise reject it for having no harness.
+    if (cmd.kind === 'update_runtime') {
+        await runUpdateRuntime(cmd);
+        return;
+    }
+    const spec = (0, harness_registry_1.harness)(cmd.harness ?? '');
+    if (!spec) {
+        await update(cmd.id, 'failed', {}, `unknown harness: ${cmd.harness}`);
+        return;
+    }
+    if (cmd.kind === 'install_harness') {
+        await runInstall(cmd, spec);
+        return;
+    }
+    if (cmd.kind === 'logout_harness') {
+        await runLogout(cmd, spec);
+        return;
+    }
+    const extra = cmd.input?.method
+        ? (spec.extraLogins ?? []).find(m => m.method === cmd.input?.method)
+        : undefined;
+    if (extra) {
+        if (extra.strategy === 'pty-url-code') {
+            await runLoginPty(cmd, spec, extra);
+            return;
+        }
+        if (extra.strategy === 'api-key') {
+            await runLoginApiKey(cmd, spec, extra.method, extra.instructions);
+            return;
+        }
+    }
+    switch (spec.login.strategy) {
+        case 'pty-url-code':
+            await runLoginPty(cmd, spec);
+            return;
+        case 'api-key':
+            await runLoginApiKey(cmd, spec);
+            return;
+        default:
+            await update(cmd.id, 'failed', { instructions: spec.login.instructions }, `${spec.label} can only be logged in on the device.`);
+    }
+}
+/** Called from index.ts when a heartbeat reports pending_commands > 0.
+ *  Drains the queue serially; re-entrant calls while draining are no-ops
+ *  (the drain loop re-picks until empty). */
+function wake() {
+    if (running)
+        return;
+    running = true;
+    void (async () => {
+        try {
+            for (;;) {
+                const t = token();
+                if (!t)
+                    return;
+                let rows;
+                try {
+                    rows = await (0, supabase_client_1.rpc)('runtime_commands_pick', { p_token: t });
+                }
+                catch (err) {
+                    console.error('[commands] pick failed:', err.message);
+                    return;
+                }
+                if (!rows || rows.length === 0)
+                    return;
+                for (const row of rows) {
+                    console.log(`[commands] ${row.kind} ${row.harness} (${row.id})`);
+                    try {
+                        await execute(row);
+                    }
+                    catch (err) {
+                        console.error('[commands] execute crashed:', err.message);
+                        await update(row.id, 'failed', {}, err.message);
+                    }
+                }
+            }
+        }
+        finally {
+            running = false;
+        }
+    })();
+}

package/dist/config.d.ts

@@ -0,0 +1,7 @@
+export declare const SUPABASE_URL = "https://syhzpqqvrplaqdipcymw.supabase.co";
+export declare const SUPABASE_ANON_KEY: string;
+export declare const VAULT_PAIR_URL = "https://vault.add.ai/add/entity";
+export declare const HEARTBEAT_INTERVAL_MS = 30000;
+export declare const HANG_WATCHDOG_IDLE_MS: number;
+export declare const PAIR_POLL_INTERVAL_MS = 2000;
+export declare const PAIR_TIMEOUT_MS: number;

package/dist/config.js

@@ -0,0 +1,38 @@
+"use strict";
+// Compile-time runtime configuration. The anon key is intended to be
+// public (PostgREST anon role only sees what RLS permits), so it's fine
+// to ship in the npm package.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAIR_TIMEOUT_MS = exports.PAIR_POLL_INTERVAL_MS = exports.HANG_WATCHDOG_IDLE_MS = exports.HEARTBEAT_INTERVAL_MS = exports.VAULT_PAIR_URL = exports.SUPABASE_ANON_KEY = exports.SUPABASE_URL = void 0;
+exports.SUPABASE_URL = 'https://syhzpqqvrplaqdipcymw.supabase.co';
+// Legacy anon JWT for the +Ai Project. Used by the daemon for every RPC
+// call; per-runtime authentication happens inside each RPC via the
+// daemon_token argument (or pair_code for unpaired calls).
+exports.SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.' +
+    'eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InN5aHpwcXF2cnBsYXFkaXBjeW13Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDQ4ODAwNDgsImV4cCI6MjA2MDQ1NjA0OH0.' +
+    'X6Rp3JrHra-SdDn8YC0aK3uIsbNZlRJrIUhW9Kiwmac';
+// Where the user goes to pair this machine. The short alias
+// /add/entity[/:code] lands on the Vault "New Item" dialog with the
+// Entity provider pre-selected and the code pre-filled. Vault's
+// LegacyRedirect prepends the user's default workspace slug.
+exports.VAULT_PAIR_URL = 'https://vault.add.ai/add/entity';
+// Heartbeat interval. Picked so the desktop can mark a runtime offline
+// after ~2x missed heartbeats (~60s) without too much chatty traffic.
+exports.HEARTBEAT_INTERVAL_MS = 30_000;
+// Per-run hang watchdog: if a spawned agent produces NO output for this long
+// we kill it (the run then fails 'agent_hang', which is transient → retried).
+// Deliberately generous: a legit slow tool call (e.g. grok kicking off an
+// image/video flow, which emits no intermediate events) must complete inside
+// this window or a false kill would waste the run. 8 min clears typical flows
+// while still firing well before the 1h node-timeout ceiling and the 10-min
+// server watchdog's hard fail. Override with HANG_WATCHDOG_IDLE_MS (0 = off).
+exports.HANG_WATCHDOG_IDLE_MS = (() => {
+    const raw = process.env.HANG_WATCHDOG_IDLE_MS;
+    if (raw == null || raw === '')
+        return 8 * 60 * 1000;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : 8 * 60 * 1000;
+})();
+// How often we poll runtime_pair_finalize while waiting for the user.
+exports.PAIR_POLL_INTERVAL_MS = 2_000;
+exports.PAIR_TIMEOUT_MS = 15 * 60 * 1000; // matches DB expiry

package/dist/control-server.d.ts

@@ -0,0 +1,5 @@
+export interface ControlServer {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function startControlServer(): Promise<ControlServer>;