@agentshouse/kit 0.2.1-alpha.9 → 0.2.1-c05cd91c26b1d

package/dist/bridge.js

@@ -1,17 +1,19 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { once } from 'node:events';
-import { mkdir } from 'node:fs/promises';
+import { setTimeout as delay } from 'node:timers/promises';
 import { createServer, request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
-import { delimiter, join } from 'node:path';
+import { delimiter, dirname, join } from 'node:path';
 import { parse } from 'yaml';
-import { KIT_VERSION } from './clis.js';
-import { changedPaths, refusalCode, } from './copies.js';
-import { kitHome, readEnrolment } from './home.js';
+import { finalRefusal, HouseRefusal, retryDelay, retrying } from './api.js';
+import { loginPath } from './clis.js';
+import { changedPaths, } from './copies.js';
+import { kitHome, readEnrolment, socketDirectory } from './home.js';
+import { callHouse, mcpBody, rpc, UNREACHABLE } from './mcp.js';
 import { operationId } from './operation.js';
-const MCP_PROTOCOL_VERSION = '2026-07-28';
+import { refusalOf, retryable } from './refusals.js';
+import { relayed } from './relay.js';
 const MCP_REQUEST_BYTES = 4 * 1024 * 1024;
-const FORWARDED = new Set(['/', '/kit/attachments/upload']);
 export async function received(request) {
     let text = '';
     request.setEncoding('utf8');
@@ -19,7 +21,8 @@ export async function received(request) {
         text += chunk;
     return text;
 }
-function relay(request, response, target, authorization) {
+function relay(request, response, house, authorization) {
+    const target = relayed(house);
     const send = target.protocol === 'https:' ? httpsRequest : httpRequest;
     const forwarded = send(target, {
         method: request.method,
@@ -31,16 +34,37 @@ function relay(request, response, target, authorization) {
     forwarded.on('error', () => response.destroy());
     request.pipe(forwarded);
 }
+function refusalIn(text, status) {
+    return refusalOf(text) ?? { code: '', text: text === '' ? `House refused it with ${status}` : text, conflicts: [] };
+}
 function answered(forwarded) {
-    if (forwarded.status >= 500)
-        throw new Error(`House answered ${forwarded.status}`);
     if (forwarded.status !== 200)
-        return { refused: { code: refusalCode(forwarded.text), text: forwarded.text } };
+        return { refused: refusalIn(forwarded.text, forwarded.status) };
     const answer = JSON.parse(forwarded.text);
     if (answer.error !== undefined)
-        return { refused: { code: refusalCode(answer.error.message), text: answer.error.message } };
+        return { refused: refusalIn(answer.error.message, forwarded.status) };
     const text = answer.result.content.map((content) => content.text).join('\n');
-    return answer.result.isError === true ? { refused: { code: refusalCode(text), text } } : { text };
+    return answer.result.isError === true ? { refused: refusalIn(text, forwarded.status) } : { text };
+}
+function pendingSeconds(forwarded) {
+    if (forwarded.status !== 200)
+        return null;
+    const { result } = JSON.parse(forwarded.text);
+    if (result === undefined || result.isError === true)
+        return null;
+    const text = result.content.map((content) => content.text).join('\n');
+    if (!text.startsWith('{"pending":'))
+        return null;
+    const seconds = JSON.parse(text).pending.retry_after;
+    return typeof seconds === 'number' ? seconds : null;
+}
+function resendAfter(forwarded, attempt) {
+    if (forwarded === null)
+        return retryDelay(attempt);
+    if (forwarded.status !== 200)
+        return retryable(forwarded.text) === false ? null : retryDelay(attempt);
+    const seconds = pendingSeconds(forwarded);
+    return seconds === null ? null : seconds * 1000;
 }
 function editAnswer(forwarded) {
     const answer = answered(forwarded);
@@ -50,44 +74,33 @@ function editAnswer(forwarded) {
     return {
         accepted: results.flatMap((result) => [
             ...(result.from === undefined ? [] : [{ path: result.from, revision: null, content: null }]),
-            { path: result.path, revision: result.op === 'remove' ? null : result.revision },
+            { path: result.path, revision: result.revision ?? null },
         ]),
     };
 }
 export async function openBridge(house, copies, conversationId, signal) {
+    const path = [join(kitHome(), 'shim'), dirname(process.execPath), await loginPath()].join(delimiter);
     const origin = (await readEnrolment()).house;
-    const { credential } = await house.post(`/kit/conversations/${conversationId}/credential`, {}, signal);
+    const { credential } = await retrying(() => house.post(`/kit/conversations/${conversationId}/credential`, {}, signal), signal);
     const closed = new AbortController();
-    const body = (message, operation) => JSON.stringify({
-        ...message,
-        params: {
-            ...message.params,
-            _meta: {
-                'io.modelcontextprotocol/protocolVersion': MCP_PROTOCOL_VERSION,
-                'io.modelcontextprotocol/clientInfo': { name: '@agentshouse/kit', version: KIT_VERSION },
-                'io.modelcontextprotocol/clientCapabilities': {},
-                ...(operation === null ? {} : { 'agents.house/agent-operation': operation }),
-            },
-        },
-    });
+    const sent = (message, operation) => callHouse(origin, credential, message, operation, closed.signal);
     const send = async (message, operation) => {
-        const tool = message.method === 'tools/call' ? String(message.params?.name) : null;
-        const answer = await fetch(new URL('/', origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: `Bearer ${credential}`,
-                accept: 'application/json, text/event-stream',
-                'mcp-protocol-version': MCP_PROTOCOL_VERSION,
-                'mcp-method': message.method,
-                ...(tool === null ? {} : { 'mcp-name': tool }),
-            },
-            body: body(message, operation),
-            signal: closed.signal,
-        });
-        return { status: answer.status, text: await answer.text() };
+        if (operation === null)
+            return sent(message, null);
+        for (let attempt = 0;; attempt++) {
+            const forwarded = await sent(message, operation).catch((error) => {
+                if (closed.signal.aborted)
+                    throw error;
+                return null;
+            });
+            const after = resendAfter(forwarded, attempt);
+            if (after === null)
+                return forwarded;
+            // A Tool call House did not settle is sent again on the jittered curve, or after the wait House names for a pending one.
+            await delay(after, undefined, { signal: closed.signal });
+        }
     };
-    const call = (name, args) => ({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name, arguments: args } });
+    const call = (name, args) => rpc('tools/call', { name, arguments: args });
     const staged = async (operation, changes) => {
         const bytes = Buffer.from(JSON.stringify({ changes }));
         const sha256 = createHash('sha256').update(bytes).digest('hex');
@@ -98,42 +111,39 @@ export async function openBridge(house, copies, conversationId, signal) {
         if ('refused' in prepared)
             return prepared;
         const { transfer } = parse(prepared.text);
-        const posted = await fetch(transfer.url, {
-            method: 'POST',
-            headers: { 'content-type': 'text/plain; charset=utf-8' },
-            body: Buffer.concat([Buffer.from(`${transfer.operation}\n`), bytes]),
-            signal: closed.signal,
-        });
-        const text = await posted.text();
-        if (posted.status >= 500)
-            throw new Error(`House answered ${posted.status}`);
-        if (!posted.ok)
-            return { refused: { code: refusalCode(text), text } };
+        let text;
+        try {
+            text = await retrying(async () => {
+                const posted = await fetch(relayed(transfer.url), {
+                    method: 'POST',
+                    headers: { 'content-type': 'text/plain; charset=utf-8' },
+                    body: Buffer.concat([Buffer.from(`${transfer.operation}\n`), bytes]),
+                    signal: closed.signal,
+                });
+                const answer = await posted.text();
+                if (!posted.ok)
+                    throw new HouseRefusal('/', posted.status, answer);
+                return answer;
+            }, closed.signal);
+        }
+        catch (error) {
+            if (!finalRefusal(error))
+                throw error;
+            return { refused: refusalIn(error.text, error.status) };
+        }
         const held = JSON.parse(text).transfer;
         return { url: held.url, operation: held.operation, bytes: bytes.length, sha256 };
     };
-    const forward = async (path, text) => {
-        if (path === '/') {
-            const message = JSON.parse(text);
-            const tool = message.method === 'tools/call' ? String(message.params?.name) : null;
-            const writes = tool !== null &&
-                (await house.post('/kit/tools/mutations', {}, closed.signal)).tools.some((listed) => listed.name === tool && listed.writes);
-            return send(message, writes ? operationId() : null);
-        }
-        const answer = await fetch(new URL(path, origin), {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', authorization: `Bearer ${credential}` },
-            body: text,
-            signal: closed.signal,
-        });
-        return { status: answer.status, text: await answer.text() };
+    const forward = (text) => {
+        const message = JSON.parse(text);
+        return send(message, message.method === 'tools/call' ? operationId() : null);
     };
     const caller = {
         key: `conversation:${conversationId}`,
         submit: async (operation, changes, held, retain) => {
             const inline = call('edit', { changes });
             let upload = held;
-            if (upload === undefined && Buffer.byteLength(body(inline, operation)) > MCP_REQUEST_BYTES) {
+            if (upload === undefined && Buffer.byteLength(mcpBody(inline, operation)) > MCP_REQUEST_BYTES) {
                 const prepared = await staged(operation, changes);
                 if ('refused' in prepared)
                     return prepared;
@@ -148,15 +158,15 @@ export async function openBridge(house, copies, conversationId, signal) {
             const { cwd, commit } = JSON.parse(text);
             return { status: 200, text: JSON.stringify(await copies.push(cwd, commit, caller)) };
         }
+        if (path === '/git/fetch')
+            return { status: 200, text: JSON.stringify(await copies.fetch()) };
         if (path === '/git/observed') {
             await copies.observed(JSON.parse(text));
             return { status: 200, text: '{}' };
         }
-        return FORWARDED.has(path) ? forward(path, text) : { status: 404, text: '' };
+        return path === '/' ? forward(text) : { status: 404, text: '' };
     };
-    const sockets = join(kitHome(), 'bridges');
-    await mkdir(sockets, { recursive: true, mode: 0o700 });
-    const socketPath = join(sockets, `${randomUUID()}.sock`);
+    const socketPath = join(socketDirectory(), `${randomUUID()}.sock`);
     const bridge = createServer(async (request, response) => {
         try {
             const path = request.url ?? '';
@@ -168,7 +178,12 @@ export async function openBridge(house, copies, conversationId, signal) {
             response.writeHead(answered.status, { 'content-type': 'application/json' }).end(answered.text);
         }
         catch (error) {
-            response.writeHead(502).end(error instanceof Error ? error.message : String(error));
+            if (error instanceof HouseRefusal) {
+                response.writeHead(error.status, { 'content-type': 'application/json' }).end(error.text);
+                return;
+            }
+            const verb = request.url === '/git/push' || request.url === '/git/fetch';
+            response.writeHead(502).end(verb && error instanceof Error ? error.message : UNREACHABLE);
         }
     });
     bridge.listen(socketPath);
@@ -189,13 +204,13 @@ export async function openBridge(house, copies, conversationId, signal) {
     return {
         env: {
             HOUSE_BRIDGE: socketPath,
-            PATH: `${join(kitHome(), 'shim')}${delimiter}${process.env.PATH ?? ''}`,
+            PATH: path,
             GIT_CONFIG_COUNT: '1',
             GIT_CONFIG_KEY_0: `url.${proxy}/app/.insteadOf`,
             GIT_CONFIG_VALUE_0: app,
         },
         tool: async (name, args) => {
-            const forwarded = await forward('/', JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name, arguments: args } }));
+            const forwarded = await forward(JSON.stringify(call(name, args)));
             if (forwarded.status !== 200)
                 throw new Error(`House refused ${name} with ${forwarded.status}: ${forwarded.text}`);
             const answer = JSON.parse(forwarded.text);

package/dist/chatgpt.js

@@ -0,0 +1,32 @@
+import { parseArgs } from 'node:util';
+import { placeAppGit } from './app-git.js';
+import { kitHome, readOwnAgent, writeOwnAgent } from './home.js';
+import { accepted, DEFAULT_HOUSE } from './login.js';
+const KEY_SOURCE = 'New key for a script on Connections';
+const USAGE = `usage: kit chatgpt --key <key> [--house <origin>]
+  --key <key>       a key from ${KEY_SOURCE}
+  --house <origin>  the House of the key, ${DEFAULT_HOUSE} unless one is stored
+`;
+export async function chatgpt(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: { key: { type: 'string' }, house: { type: 'string' }, help: { type: 'boolean', default: false } },
+    });
+    if (values.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (values.key === undefined)
+        throw new Error(`pass --key with a key from ${KEY_SOURCE}`);
+    const before = await readOwnAgent();
+    const house = values.house ?? before?.house ?? DEFAULT_HOUSE;
+    if (!(await accepted(house, values.key)))
+        throw new Error(`${house} does not accept this key; pass one from ${KEY_SOURCE}`);
+    const relay = process.env.HOUSE_KIT_RELAY || undefined;
+    await writeOwnAgent({ house, ...(relay === undefined ? {} : { relay }), credential: values.key });
+    await placeAppGit(await readOwnAgent()).catch((error) => process.stderr.write(`kit: ${error.message}\n`));
+    if (before !== null && before.credential !== values.key) {
+        process.stdout.write('This replaced the key this Kit home held; give each session its own HOUSE_KIT_HOME to keep its own key.\n');
+    }
+    process.stdout.write(`house now calls ${house} as you, with the key kept in ${kitHome()}.\n`);
+}

package/dist/clis-main.js

@@ -0,0 +1,23 @@
+import { setGlobalProxyFromEnv } from 'node:http';
+import { post } from './api.js';
+import { CLIS, below, locate, versionOf } from './clis.js';
+import { readEnrolment } from './home.js';
+setGlobalProxyFromEnv();
+try {
+    const { house, credential } = (await readEnrolment());
+    const { agents } = await post(house, '/kit/agents/desired', {}, credential);
+    for (const kind of agents) {
+        const cli = await locate(kind);
+        if (cli === null)
+            continue;
+        const release = await versionOf(cli);
+        if (release === null)
+            continue;
+        const { bin, minimum } = CLIS[kind];
+        process.stdout.write(`${[bin, cli, release, minimum, below(release, minimum) ? 'old' : 'current'].join('\t')}\n`);
+    }
+}
+catch (error) {
+    process.stderr.write(`kit: ${error.message}\n`);
+    process.exitCode = 1;
+}

package/dist/clis.js

@@ -1,83 +1,159 @@
 import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { constants, readFileSync } from 'node:fs';
+import { access, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir, userInfo } from 'node:os';
+import { delimiter, dirname, isAbsolute, join } from 'node:path';
 import { kitHome } from './home.js';
-const RUNNING_JOB = new Set(['running', 'paused']);
-function threadStatus({ method, params }) {
-    if (method !== 'session/update' || params?.update?.sessionUpdate !== 'session_info_update')
-        return undefined;
-    return params.update._meta?.codex?.threadStatus?.type;
-}
-function asyncTask({ method, params }) {
-    const update = params?.update;
-    if (method !== 'session/update' || update?.asyncTaskId === undefined)
-        return null;
-    if (update.sessionUpdate === 'async_task_spawned')
-        return { id: update.asyncTaskId, running: true };
-    if (update.sessionUpdate === 'async_task_state_update' && !RUNNING_JOB.has(update.state ?? '')) {
-        return { id: update.asyncTaskId, running: false };
+const HOUSE_EXECUTABLES = /^host_executable\(name = "house", paths = (\[.*\])\)$/m;
+function houseRule(houses) {
+    return `prefix_rule(pattern = ["house"], decision = "allow")\nhost_executable(name = "house", paths = ${JSON.stringify(houses)})\n`;
+}
+const RAW_SUBTYPES = [
+    'background_tasks_changed',
+    'task_started',
+    'task_updated',
+    'task_notification',
+    'session_state_changed',
+    'hook_started',
+    'hook_response',
+];
+async function executable(path) {
+    try {
+        await access(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function listedHouses(file) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    try {
+        const listed = JSON.parse(HOUSE_EXECUTABLES.exec(text)?.[1] ?? '[]');
+        return Array.isArray(listed) ? listed.filter((house) => typeof house === 'string') : [];
+    }
+    catch {
+        return [];
     }
-    return null;
+}
+export async function allowHouseInCodex(path) {
+    const candidates = [...new Set(path.split(delimiter).filter((directory) => isAbsolute(directory)))].map((directory) => join(directory, 'house'));
+    const rules = join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'rules');
+    const file = join(rules, 'house.rules');
+    const houses = [];
+    for (const house of [...(await listedHouses(file)), ...candidates]) {
+        if (!houses.includes(house) && (await executable(house)))
+            houses.push(house);
+    }
+    await mkdir(rules, { recursive: true });
+    const temporary = `${file}.${randomUUID()}`;
+    await writeFile(temporary, houseRule(houses));
+    await rename(temporary, file);
+}
+async function nothing() { }
+function answered(error) {
+    return typeof error === 'object' && error !== null ? error : {};
+}
+function bridgeInClaudeSandbox(bridge) {
+    return process.platform === 'darwin' ? { allowUnixSockets: [bridge] } : { allowAllUnixSockets: true };
 }
 export const CLIS = {
     'codex-acp': {
-        package: '@agentclientprotocol/codex-acp',
-        bin: 'codex-acp',
+        bin: 'codex',
+        minimum: '0.159.1',
+        install: 'curl -fsSL https://chatgpt.com/codex/install.sh | sh',
+        adapter: {
+            package: '@agentclientprotocol/codex-acp',
+            bin: 'codex-acp',
+            executable: 'CODEX_PATH',
+            env: { CODEX_CONFIG: JSON.stringify({ features: { shell_zsh_fork: true } }) },
+        },
         args: [],
-        signedIn: { command: ['cli', 'login', 'status'] },
-        login: { args: ['cli', 'login', '--device-auth'], code: 'show' },
-        queues: false,
-        turnStarted: (notice) => threadStatus(notice) === 'active',
-        turnEnded: (notice) => threadStatus(notice) === 'idle',
-        job: asyncTask,
+        fullAccess: 'agent-full-access',
+        sessionMeta: () => ({}),
+        unknownSession: (error) => {
+            const { code, data } = answered(error);
+            return code === -32603 && typeof data?.details === 'string' && data.details.startsWith('no rollout found');
+        },
+        renames: true,
+        allowHouse: allowHouseInCodex,
+        signedIn: { command: ['login', 'status'] },
+        login: { args: ['login', '--device-auth'], code: 'show' },
+        air: ['asyncTasks', 'nativeSubagentSessions'],
     },
     'claude-agent-acp': {
-        package: '@agentclientprotocol/claude-agent-acp',
-        bin: 'claude-agent-acp',
+        bin: 'claude',
+        minimum: '2.1.286',
+        install: 'curl -fsSL https://claude.ai/install.sh | bash',
+        adapter: {
+            package: '@agentclientprotocol/claude-agent-acp',
+            bin: 'claude-agent-acp',
+            executable: 'CLAUDE_CODE_EXECUTABLE',
+            env: { CLAUDE_CODE_ENTRYPOINT: 'claude-agent-acp', IS_SANDBOX: '1' },
+        },
         args: [],
-        signedIn: { command: ['--cli', 'auth', 'status'] },
-        login: { args: ['--cli', 'auth', 'login', '--claudeai'], code: 'collect' },
-        queues: false,
-        turnStarted: () => false,
-        turnEnded: ({ method, params }) => method === 'session/update' &&
-            params?.update?.sessionUpdate === 'usage_update' &&
-            params.update._meta?.['_claude/origin'] !== undefined,
-        job: asyncTask,
+        fullAccess: 'bypassPermissions',
+        sessionMeta: (bridge, title) => ({
+            claudeCode: {
+                options: {
+                    allowedTools: ['Bash(house:*)'],
+                    includeHookEvents: true,
+                    title,
+                    settings: { sandbox: { network: bridgeInClaudeSandbox(bridge) } },
+                },
+                emitRawSDKMessages: RAW_SUBTYPES.map((subtype) => ({ type: 'system', subtype })),
+            },
+        }),
+        unknownSession: (error) => answered(error).code === -32002,
+        renames: false,
+        allowHouse: nothing,
+        signedIn: { command: ['auth', 'status'] },
+        login: { args: ['auth', 'login', '--claudeai'], code: 'collect', rejected: 'Invalid code' },
+        air: ['asyncTasks', 'sessionFailure'],
     },
     'grok-build': {
-        package: '@xai-official/grok',
         bin: 'grok',
-        args: ['agent', '--no-leader', 'stdio'],
+        minimum: '1.0.46',
+        install: 'curl -fsSL https://x.ai/cli/install.sh | bash',
+        adapter: null,
+        args: ['--sandbox', 'off', 'agent', '--always-approve', '--no-leader', 'stdio'],
+        fullAccess: null,
+        sessionMeta: () => ({}),
+        unknownSession: (error) => answered(error).data?.code === 'FS_NOT_FOUND',
+        renames: false,
+        allowHouse: nothing,
         signedIn: { initializeMeta: 'defaultAuthMethodId' },
         login: { args: ['login', '--device-auth'], code: 'show' },
-        queues: true,
-        turnStarted: ({ method, params }) => method === '_x.ai/queue/changed' && params?.runningPromptId !== undefined,
-        turnEnded: ({ method, params }) => method === '_x.ai/session_notification' && params?.update?.sessionUpdate === 'turn_completed',
-        job: ({ method, params }) => {
-            if (method === '_x.ai/task_backgrounded')
-                return { id: params.update.task_id, running: true };
-            if (method === '_x.ai/task_completed')
-                return { id: params.update.task_snapshot.task_id, running: false };
-            return null;
-        },
+        air: ['asyncTasks'],
     },
 };
 const KIT_PACKAGE = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 export const KIT_VERSION = KIT_PACKAGE.version;
 const PROXY = /^https?_proxy$/i;
-export function pinned(kind) {
-    return KIT_PACKAGE.peerDependencies[CLIS[kind].package];
-}
+const VERSION = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?/;
+// An install still running after fifteen minutes is ended and reported as failed, so a hung download cannot hold its CLI's report.
+const INSTALL_MS = 15 * 60_000;
+// A login shell or a version read is ended after half a minute, so a profile that waits for input cannot stall the report.
+const READ_MS = 30_000;
+const CAUSE_CHARACTERS = 4000;
 function prefix(kind) {
     return join(kitHome(), 'agents', kind);
 }
-export function cliCommand(kind) {
-    return join(prefix(kind), 'node_modules', '.bin', CLIS[kind].bin);
+export function adapterCommand(kind) {
+    return join(prefix(kind), 'node_modules', '.bin', CLIS[kind].adapter.bin);
 }
-export async function installedRelease(kind) {
+async function installedAdapter(kind) {
     try {
-        const manifest = join(prefix(kind), 'node_modules', CLIS[kind].package, 'package.json');
+        const manifest = join(prefix(kind), 'node_modules', CLIS[kind].adapter.package, 'package.json');
         return JSON.parse(await readFile(manifest, 'utf8')).version;
     }
     catch {
@@ -87,28 +163,94 @@ export async function installedRelease(kind) {
 export function withoutProxy() {
     return Object.fromEntries(Object.entries(process.env).filter(([name]) => !PROXY.test(name)));
 }
-export function run(command, args, timeoutMs) {
+export function run(command, args, timeoutMs, detached = false, signal) {
     return new Promise((resolve) => {
-        const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], timeout: timeoutMs, env: withoutProxy() });
+        const child = spawn(command, args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: timeoutMs,
+            env: withoutProxy(),
+            detached,
+            signal: detached ? undefined : signal,
+        });
+        const stop = () => {
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+            }
+            catch { }
+        };
+        if (detached && signal?.aborted)
+            stop();
+        if (detached)
+            signal?.addEventListener('abort', stop, { once: true });
+        const ended = (ran) => {
+            signal?.removeEventListener('abort', stop);
+            resolve(ran);
+        };
+        let stdout = '';
         let output = '';
-        child.stdout.on('data', (chunk) => {
-            output += chunk.toString('utf8');
+        child.stdout.setEncoding('utf8').on('data', (chunk) => {
+            stdout += chunk;
+            output += chunk;
         });
-        child.stderr.on('data', (chunk) => {
-            output += chunk.toString('utf8');
+        child.stderr.setEncoding('utf8').on('data', (chunk) => {
+            output += chunk;
         });
-        child.on('error', (error) => resolve({ status: null, output: error.message }));
-        child.on('close', (status) => resolve({ status, output }));
+        child.on('error', (error) => ended({ status: null, stdout, output: error.message }));
+        child.on('close', (status) => ended({ status, stdout, output }));
     });
 }
-export async function install(kind) {
-    const release = pinned(kind);
-    if ((await installedRelease(kind)) === release)
-        return release;
-    const ran = await run('npm', ['install', '--prefix', prefix(kind), '--no-save', '--no-audit', '--no-fund', `${CLIS[kind].package}@${release}`], 15 * 60_000);
-    if (ran.status !== 0) {
-        process.stderr.write(`kit: ${kind} did not install: ${ran.output.trim()}\n`);
+export function failureOf(ran, program) {
+    return ran.output.trim().slice(-CAUSE_CHARACTERS) || `${program} exited with ${ran.status ?? 'a signal'}`;
+}
+export async function installAdapter(kind, signal) {
+    const adapter = CLIS[kind].adapter;
+    if (adapter === null)
         return null;
+    const release = KIT_PACKAGE.peerDependencies[adapter.package];
+    if ((await installedAdapter(kind)) === release)
+        return null;
+    const ran = await run('npm', ['install', '--prefix', prefix(kind), '--cache', join(kitHome(), 'npm-cache'), '--no-save', '--no-audit', '--no-fund', '--omit=optional', `${adapter.package}@${release}`], INSTALL_MS, true, signal);
+    return ran.status === 0 ? null : failureOf(ran, 'npm');
+}
+export async function installCli(kind, signal) {
+    const ran = await run('bash', ['-o', 'pipefail', '-c', CLIS[kind].install], INSTALL_MS, true, signal);
+    return ran.status === 0 ? null : failureOf(ran, 'the install');
+}
+function loginShell() {
+    return process.env.SHELL || userInfo().shell;
+}
+const FOUND = 'house-kit-cli ';
+const LOOKUP = `found=$(command -v "$1") || exit 0; case $found in /*) ;; *) found=$(pwd -P)/$found ;; esac; printf "${FOUND}%s\\n" "$found"`;
+const USER_BIN = 'case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) PATH="$PATH:$HOME/.local/bin" ;; esac; export PATH';
+function inLoginShell(script, argument = '', signal) {
+    return run(loginShell(), ['-l', '-i', '-c', `exec /bin/sh -c '${USER_BIN}; ${script}' sh ${argument}`], READ_MS, true, signal);
+}
+export async function locate(kind, signal) {
+    const ran = await inLoginShell(LOOKUP, CLIS[kind].bin, signal);
+    return ran.stdout.split('\n').findLast((line) => line.startsWith(FOUND))?.slice(FOUND.length) ?? null;
+}
+export async function loginPath() {
+    const marker = 'house-kit-path ';
+    const ran = await inLoginShell(`printf "${marker}%s\\n" "$PATH"`);
+    return ran.stdout.split('\n').findLast((line) => line.startsWith(marker)).slice(marker.length);
+}
+export async function writeCodexRule() {
+    const shell = await loginPath().catch(() => '');
+    await allowHouseInCodex([dirname(process.execPath), process.env.PATH ?? '', shell].join(delimiter)).catch((error) => {
+        throw new Error(`Codex's rule for house could not be written: ${error.message}`);
+    });
+}
+export async function versionOf(path, signal) {
+    return VERSION.exec((await run(path, ['--version'], READ_MS, false, signal)).stdout)?.[0] ?? null;
+}
+function numbers(version) {
+    return version.split(/[.-]/, 3).map(Number);
+}
+export function below(found, minimum) {
+    const [have, need] = [numbers(found), numbers(minimum)];
+    for (let index = 0; index < 3; index++) {
+        if (have[index] !== need[index])
+            return have[index] < need[index];
     }
-    return installedRelease(kind);
+    return found.includes('-') && !minimum.includes('-');
 }