@agentikos/omega-os 0.2.0 → 0.19.5

package/omega/Agentik_Engine/omega_engine/hermes_desktop.py

@@ -0,0 +1,469 @@
+"""Hermes Desktop adapter — expose OmegaOS as a remote backend.
+
+Hermes Desktop (https://github.com/fathah/hermes-desktop) is an
+Electron native app that connects to a Hermes Agent backend. The
+default backend runs at ``http://127.0.0.1:8642``; the app also supports
+**remote backends**: point it at any HTTP server that speaks the same
+``/api/...`` protocol, plug an API key.
+
+This module ships a tiny HTTP server that lets Hermes Desktop drive a
+remote OmegaOS VPS as if it were a local Hermes process. The result:
+
+  * Operator runs Hermes Desktop on their laptop.
+  * Adds a profile pointing at ``https://<vps-domain>:8642`` with the
+    bearer token written by ``omega hermes-desktop install``.
+  * Every chat message from the desktop UI travels to the VPS, gets
+    classified, and is either answered by Hermès directly OR delegated
+    down to AISB/Oracle/Workers via ``omega run``.
+
+This is the OPPOSITE of Hermes Desktop's default flow (which runs
+Hermès locally). Here Hermès runs on the VPS, the desktop is just a
+window onto it. Why: the operator's heavy AI work happens on the
+24/7 VPS where the Claude OAuth lives, the audit history accumulates,
+and tmux sessions survive laptop sleep.
+
+Routes (Hermes-compatible subset)
+---------------------------------
+
+  GET  /api/health              ok
+  GET  /api/version             {hermes_version, omega_version}
+  POST /api/chat                {messages, stream} → SSE or JSON
+  GET  /api/sessions            list omega missions
+  GET  /api/sessions/<id>       mission detail
+  POST /api/sessions            create new mission (delegates to omega run)
+  GET  /api/skills              merged hermes + omega skill catalog
+  GET  /api/status              omega doctor + hermes status snapshot
+
+Security
+--------
+
+Bearer-token auth via ``Authorization: Bearer <token>``. Token is
+generated at install time and stored at
+``$OMEGA_HOME/Agentik_Extra/etc/hermes-desktop.token`` (mode 0600).
+Operator copies it into the Hermes Desktop "API key" field.
+
+Bound to ``127.0.0.1`` by default — operator MUST forward via SSH
+tunnel or reverse proxy to expose it. We refuse to bind to ``0.0.0.0``
+unless ``--unsafe-public`` is passed (with a loud warning).
+"""
+from __future__ import annotations
+
+import http.server
+import json
+import os
+import secrets
+import socket
+import socketserver
+import threading
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+_DEFAULT_PORT = 8642        # same as Hermes Desktop's default backend port
+_TOKEN_FILE = "hermes-desktop.token"
+_PROFILE_DIR = "Agentik_Extra/etc"
+
+
+def _omega_home(explicit: str | Path | None = None) -> Path:
+    if explicit is not None:
+        return Path(explicit)
+    return Path(os.environ.get("OMEGA_HOME", str(Path.home() / "Omega")))
+
+
+def token_path(omega_home: str | Path | None = None) -> Path:
+    return _omega_home(omega_home) / _PROFILE_DIR / _TOKEN_FILE
+
+
+# ---------------------------------------------------------------------------
+# Token management
+# ---------------------------------------------------------------------------
+
+
+def generate_token(omega_home: str | Path | None = None) -> str:
+    """Create + persist a fresh bearer token (40 hex chars)."""
+    p = token_path(omega_home)
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tok = secrets.token_hex(20)
+    p.write_text(tok)
+    try:
+        os.chmod(p, 0o600)
+    except OSError:
+        pass
+    return tok
+
+
+def read_token(omega_home: str | Path | None = None) -> str | None:
+    p = token_path(omega_home)
+    if not p.exists():
+        return None
+    try:
+        return p.read_text().strip() or None
+    except OSError:
+        return None
+
+
+# ---------------------------------------------------------------------------
+# Profile manifest — what Hermes Desktop should paste into its config
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class DesktopProfile:
+    name: str
+    base_url: str
+    api_key: str
+    description: str
+
+    def to_dict(self) -> dict[str, Any]:
+        from dataclasses import asdict
+        return asdict(self)
+
+    def to_json(self) -> str:
+        return json.dumps(self.to_dict(), indent=2)
+
+
+def build_profile(
+    *,
+    public_url: str | None = None,
+    port: int = _DEFAULT_PORT,
+    omega_home: str | Path | None = None,
+) -> DesktopProfile:
+    """Build the profile JSON the operator pastes into Hermes Desktop."""
+    tok = read_token(omega_home) or generate_token(omega_home)
+    base = public_url or f"http://127.0.0.1:{port}"
+    return DesktopProfile(
+        name="OmegaOS VPS",
+        base_url=base,
+        api_key=tok,
+        description=(
+            "OmegaOS-backed Hermès — chat hits the VPS, which delegates "
+            "engineering work to AISB → Oracle → Workers (Layer 3-5)."
+        ),
+    )
+
+
+# ---------------------------------------------------------------------------
+# HTTP server
+# ---------------------------------------------------------------------------
+
+
+class _Handler(http.server.BaseHTTPRequestHandler):
+    """Hermes-compatible request handler.
+
+    Implements a SAFE subset of the Hermes API:
+
+      * /api/health
+      * /api/version
+      * /api/status
+      * /api/skills
+      * /api/sessions (GET = list, POST = create)
+      * /api/sessions/<id> (GET = detail)
+      * /api/chat (POST → JSON for now; SSE streaming is a follow-up)
+    """
+
+    # Bearer-token shared across the whole server instance (set on the
+    # serve_forever helper below before binding).
+    expected_token: str = ""
+    omega_home: Path = _omega_home(None)
+    quiet: bool = True
+
+    # ---- Internal helpers --------------------------------------------------
+
+    def log_message(self, fmt: str, *args: Any) -> None:  # noqa: A003
+        if not self.quiet:
+            super().log_message(fmt, *args)
+
+    def _check_auth(self) -> bool:
+        if not self.expected_token:
+            return True              # auth disabled (only --unsafe-public)
+        got = self.headers.get("Authorization") or ""
+        if not got.startswith("Bearer "):
+            return False
+        return secrets.compare_digest(got[7:].strip(), self.expected_token)
+
+    def _send_json(self, status: int, payload: dict[str, Any]) -> None:
+        body = json.dumps(payload).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _read_json(self) -> dict[str, Any] | None:
+        length = int(self.headers.get("Content-Length") or 0)
+        if length <= 0:
+            return None
+        raw = self.rfile.read(length)
+        try:
+            return json.loads(raw.decode("utf-8"))
+        except (ValueError, UnicodeDecodeError):
+            return None
+
+    # ---- Route dispatch ---------------------------------------------------
+
+    def do_GET(self) -> None:  # noqa: N802
+        path = self.path.split("?", 1)[0]
+        if path == "/api/health":
+            return self._send_json(200, {"status": "ok"})
+        if not self._check_auth():
+            return self._send_json(401, {"error": "missing or bad bearer token"})
+
+        if path == "/api/version":
+            return self._send_json(200, self._version())
+        if path == "/api/status":
+            return self._send_json(200, self._status())
+        if path == "/api/skills":
+            return self._send_json(200, {"skills": self._skills()})
+        if path == "/api/sessions":
+            return self._send_json(200, {"sessions": self._sessions_list()})
+        if path.startswith("/api/sessions/"):
+            sid = path[len("/api/sessions/"):]
+            d = self._session_detail(sid)
+            if d is None:
+                return self._send_json(404, {"error": "no such session"})
+            return self._send_json(200, d)
+
+        return self._send_json(404, {"error": f"no route {path}"})
+
+    def do_POST(self) -> None:  # noqa: N802
+        path = self.path.split("?", 1)[0]
+        if not self._check_auth():
+            return self._send_json(401, {"error": "missing or bad bearer token"})
+        body = self._read_json() or {}
+
+        if path == "/api/sessions":
+            intent = (body.get("intent") or body.get("message") or "").strip()
+            if not intent:
+                return self._send_json(400, {"error": "intent required"})
+            slug = body.get("project") or None
+            return self._send_json(202, self._create_session(intent, slug))
+
+        if path == "/api/chat":
+            messages = body.get("messages") or []
+            if not isinstance(messages, list) or not messages:
+                return self._send_json(400, {"error": "messages[] required"})
+            user_text = messages[-1].get("content", "").strip()
+            if not user_text:
+                return self._send_json(400, {"error": "last message empty"})
+            return self._send_json(200, self._chat(user_text))
+
+        return self._send_json(404, {"error": f"no route {path}"})
+
+    # ---- Endpoint implementations -----------------------------------------
+
+    def _version(self) -> dict[str, Any]:
+        from omega_engine import __version__
+        return {
+            "omega_version": __version__,
+            "hermes_compat": "1.x",
+            "api_routes": [
+                "GET /api/health", "GET /api/version", "GET /api/status",
+                "GET /api/skills", "GET /api/sessions",
+                "GET /api/sessions/<id>", "POST /api/sessions", "POST /api/chat",
+            ],
+        }
+
+    def _status(self) -> dict[str, Any]:
+        # Lightweight — don't run the full doctor (too slow). Quick
+        # snapshot of OmegaOS + Hermès bridge.
+        out: dict[str, Any] = {"omega_home": str(self.omega_home)}
+        try:
+            from omega_engine import hermes_bootstrap as HB
+            out["hermes_bootstrap"] = HB.status()
+        except Exception as exc:  # noqa: BLE001
+            out["hermes_bootstrap_error"] = str(exc)
+        try:
+            from omega_engine import hermes as H
+            st = H.status()
+            out["hermes_bridge"] = {
+                "installed": st.installed,
+                "oauth_token_present": st.oauth_token_present,
+                "subscription": st.oauth_subscription,
+            }
+        except Exception as exc:  # noqa: BLE001
+            out["hermes_bridge_error"] = str(exc)
+        return out
+
+    def _skills(self) -> list[dict[str, Any]]:
+        from omega_engine.skill_routing import (
+            catalog_for_home, POWER_SKILLS, recommend,
+        )
+        cat = catalog_for_home(self.omega_home)
+        return [
+            {
+                "name": s, "source": "omega-ssot",
+                "power_skill": s in POWER_SKILLS,
+            }
+            for s in cat
+        ] + [
+            {
+                "name": role, "source": "role-palette",
+                "skills": recommend(role),
+            }
+            for role in ("worker", "oracle", "audit", "worker_ui")
+        ]
+
+    def _sessions_list(self) -> list[dict[str, Any]]:
+        # Surface OmegaOS missions + per-task workers as "sessions"
+        out: list[dict[str, Any]] = []
+        try:
+            from omega_engine import worker as W
+            for w in W.list_workers(self.omega_home):
+                out.append({
+                    "id": w["task_id"], "title": w["intent"],
+                    "kind": "worker", "state": w["state"],
+                    "project": w.get("project"),
+                })
+        except Exception:  # noqa: BLE001
+            pass
+        return out
+
+    def _session_detail(self, session_id: str) -> dict[str, Any] | None:
+        try:
+            from omega_engine import worker as W
+            from omega_engine.done_signal import read_done
+            status = W.worker_status(self.omega_home, session_id)
+            done = read_done(self.omega_home, session_id)
+            return {
+                "id": session_id, "status": status,
+                "done": done.to_dict() if done else None,
+            }
+        except FileNotFoundError:
+            return None
+        except Exception as exc:  # noqa: BLE001
+            return {"id": session_id, "error": str(exc)}
+
+    def _create_session(
+        self, intent: str, slug: str | None,
+    ) -> dict[str, Any]:
+        """Dispatch a mission via omega run (synchronous for now)."""
+        import subprocess
+        # We DO NOT run heavy work in the HTTP thread — emit the command
+        # asynchronously via a detached subprocess + return the mission
+        # id immediately. The Desktop client polls /api/sessions for
+        # progress.
+        env = {**os.environ, "OMEGA_HOME": str(self.omega_home)}
+        cmd = ["omega", "run", intent]
+        if slug:
+            cmd += ["--project", slug]
+        try:
+            subprocess.Popen(
+                cmd, env=env,
+                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                start_new_session=True,
+            )
+        except (OSError, subprocess.SubprocessError) as exc:
+            return {"error": f"dispatch failed: {exc}"}
+        return {
+            "dispatched": True, "intent": intent,
+            "project": slug,
+            "note": "poll /api/sessions for progress",
+        }
+
+    def _chat(self, user_text: str) -> dict[str, Any]:
+        """Send the user text through the local Hermès binary (if installed),
+        else delegate via omega ask + return the text."""
+        from omega_engine import hermes as H
+        try:
+            if H.is_installed():
+                rc, stdout, stderr = H.ask(user_text, timeout_s=180)
+                return {
+                    "rc": rc,
+                    "text": stdout.strip() or stderr.strip(),
+                }
+        except H.HermesError as exc:
+            return {"rc": 2, "text": f"hermes error: {exc}"}
+        return {
+            "rc": 1,
+            "text": "hermes binary not installed on the VPS — "
+                    "run `omega hermes install` first.",
+        }
+
+
+# ---------------------------------------------------------------------------
+# Server lifecycle
+# ---------------------------------------------------------------------------
+
+
+class _ThreadedTCPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+
+
+@dataclass
+class ServerStatus:
+    bound: str
+    port: int
+    pid: int
+
+
+_RUNNING_LOCK = threading.Lock()
+
+
+def serve(
+    *,
+    host: str = "127.0.0.1",
+    port: int = _DEFAULT_PORT,
+    omega_home: str | Path | None = None,
+    token: str | None = None,
+    quiet: bool = True,
+    unsafe_public: bool = False,
+) -> _ThreadedTCPServer:
+    """Bind + serve. Returns the server object so callers can shut down.
+
+    NOT a daemon — for systemd / detached tmux, use ``serve_forever``.
+    """
+    if host == "0.0.0.0" and not unsafe_public:
+        raise RuntimeError(
+            "refusing to bind 0.0.0.0 — pass unsafe_public=True if you "
+            "really want public, but you almost certainly want SSH "
+            "tunneling instead"
+        )
+    tok = token if token is not None else (
+        read_token(omega_home) or generate_token(omega_home)
+    )
+    # Subclass the handler so attributes don't bleed across servers.
+    handler = type("_BoundHandler", (_Handler,), {
+        "expected_token": tok,
+        "omega_home": _omega_home(omega_home),
+        "quiet": quiet,
+    })
+    server = _ThreadedTCPServer((host, port), handler)
+    return server
+
+
+def serve_forever(
+    *,
+    host: str = "127.0.0.1",
+    port: int = _DEFAULT_PORT,
+    omega_home: str | Path | None = None,
+    token: str | None = None,
+    quiet: bool = True,
+    unsafe_public: bool = False,
+) -> None:
+    """Blocking serve. Best run inside a tmux session or systemd unit."""
+    s = serve(host=host, port=port, omega_home=omega_home, token=token,
+              quiet=quiet, unsafe_public=unsafe_public)
+    try:
+        s.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    finally:
+        try:
+            s.shutdown()
+            s.server_close()
+        except OSError:
+            pass
+
+
+def is_port_free(port: int = _DEFAULT_PORT, host: str = "127.0.0.1") -> bool:
+    """Probe whether ``host:port`` can be bound. Useful for the install check."""
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        try:
+            sock.bind((host, port))
+            return True
+        except OSError:
+            return False

package/omega/Agentik_Engine/omega_engine/integrations/__init__.py

@@ -0,0 +1,30 @@
+"""Third-party integrations — thin wrappers around external CLI tools.
+
+Each integration is opt-in: if the upstream binary is missing the wrapper
+raises a typed error, never crashes the engine. The wrappers translate the
+tool's native output into the engine's own shapes (Documents, graph edges,
+Tool registry entries) so the rest of the system stays binary-free.
+"""
+from omega_engine.integrations.graphify import (
+    GraphifyError,
+    GraphifyGraphMissing,
+    GraphifyNotInstalled,
+    GraphifyReport,
+    graphify_install_skill,
+    graphify_into_rag,
+    graphify_load_graph,
+    graphify_version,
+    is_graphify_installed,
+)
+
+__all__ = [
+    "GraphifyError",
+    "GraphifyGraphMissing",
+    "GraphifyNotInstalled",
+    "GraphifyReport",
+    "graphify_install_skill",
+    "graphify_into_rag",
+    "graphify_load_graph",
+    "graphify_version",
+    "is_graphify_installed",
+]