@agentshouse/kit 0.2.1-c15804a0fa28d → 0.2.1-c2c600f2d2b30

package/dist/agents.js

@@ -3,13 +3,16 @@ import { readFile, realpath } from 'node:fs/promises';
 import { killTree, startAdapter } from './acp.js';
 import { CLIS, KIT_VERSION, below, installAdapter, installCli, locate, run, versionOf } from './clis.js';
 import { agentBase, kitHome } from './home.js';
-const SIGNED_OUT = { signed_in: false, models: [] };
+const SIGNED_OUT = { signed_in: false, models: [], modes: [] };
 function select(options, category) {
     const option = options.find((candidate) => candidate.category === category);
     return option?.type === 'select' ? option : undefined;
 }
+function choices(options) {
+    return options.flatMap((entry) => ('group' in entry ? entry.options : [entry]));
+}
 function values(options) {
-    return options.flatMap((entry) => ('group' in entry ? entry.options : [entry])).map((entry) => entry.value);
+    return choices(options).map((entry) => entry.value);
 }
 function causeOf(error) {
     return error instanceof Error ? error.message : String(error);
@@ -21,9 +24,11 @@ async function models(kind, adapter, known) {
     const agent = adapter.connection.agent;
     const opened = await agent.request('session/new', { cwd: kitHome(), mcpServers: [] });
     let options = opened.configOptions ?? [];
+    const mode = select(options, 'mode');
+    const modes = mode === undefined ? [] : choices(mode.options).map(({ value, name }) => ({ mode: value, name }));
     const model = select(options, 'model');
     if (model === undefined)
-        return [];
+        return { models: [], modes };
     const offered = [];
     for (const value of values(model.options)) {
         if (select(options, 'model')?.currentValue !== value) {
@@ -39,10 +44,18 @@ async function models(kind, adapter, known) {
         const effort = select(options, 'thought_level');
         offered.push({ model: value, efforts: effort === undefined ? [] : values(effort.options) });
     }
-    return offered;
+    return { models: offered, modes };
+}
+async function signedIn(kind, cli, known) {
+    const probe = CLIS[kind].signedIn;
+    // A sign-in check that has not answered in half a minute counts as signed out rather than stalling the report.
+    if ('command' in probe)
+        return (await run(cli, probe.command, 30_000)).status === 0;
+    return (await offer(kind, cli, known)).signed_in;
 }
 async function offer(kind, cli, known) {
     const probe = CLIS[kind].signedIn;
+    // A sign-in check that has not answered in half a minute counts as signed out rather than stalling the report.
     if ('command' in probe && (await run(cli, probe.command, 30_000)).status !== 0)
         return SIGNED_OUT;
     let adapter;
@@ -53,11 +66,15 @@ async function offer(kind, cli, known) {
             if (typeof method !== 'string' || method.length === 0)
                 return SIGNED_OUT;
         }
-        return { signed_in: true, models: await models(kind, adapter, known.models) };
+        return { signed_in: true, ...(await models(kind, adapter, known.models)) };
     }
     catch (error) {
         process.stderr.write(`kit: ${kind} did not offer its models: ${causeOf(error)}\n`);
-        return { signed_in: adapter === undefined && 'initializeMeta' in probe ? known.signed_in : true, models: known.models };
+        return {
+            signed_in: adapter === undefined && 'initializeMeta' in probe ? known.signed_in : true,
+            models: known.models,
+            modes: known.modes,
+        };
     }
     finally {
         if (adapter !== undefined)
@@ -72,6 +89,8 @@ function reported(kind, reading) {
         failure: reading.failure,
         signed_in: reading.signed_in,
         models: reading.models,
+        modes: reading.modes,
+        full_access: CLIS[kind].fullAccess,
     };
 }
 function tooOld(kind, release) {
@@ -79,10 +98,12 @@ function tooOld(kind, release) {
     return `${cli.bin} ${release} is older than ${cli.minimum}, the oldest this Kit runs`;
 }
 async function sshHostKey() {
+    // Listing a local host key takes a moment, so ten seconds only bounds a stuck ssh-keygen.
     const listed = await run('ssh-keygen', ['-l', '-E', 'sha256', '-f', '/etc/ssh/ssh_host_ed25519_key.pub'], 10_000);
     return listed.status === 0 ? (/^\d+ (SHA256:\S+)/.exec(listed.output)?.[1] ?? null) : null;
 }
 async function operatingSystem() {
+    // sw_vers answers at once, so ten seconds only bounds a stuck call.
     if (process.platform === 'darwin')
         return `macOS ${(await run('sw_vers', ['-productVersion'], 10_000)).output.trim()}`;
     const release = await readFile('/etc/os-release', 'utf8');
@@ -114,7 +135,7 @@ export class Agents {
         });
         this.reading = reading;
         return reading.then(({ agents }) => {
-            Promise.all(agents.map((kind) => this.queue(kind, () => this.load(kind))))
+            Promise.all(agents.map((kind) => this.load(kind)))
                 .then(() => this.report())
                 .catch(logged);
         });
@@ -130,7 +151,7 @@ export class Agents {
             const known = this.readings.get(kind);
             const kept = known?.release === null || known?.minimum !== undefined ? SIGNED_OUT : (known ?? SIGNED_OUT);
             if (known?.release !== release || known.minimum !== undefined) {
-                this.update(kind, { release, failure: null, signed_in: kept.signed_in, models: kept.models });
+                this.update(kind, { release, failure: null, signed_in: kept.signed_in, models: kept.models, modes: kept.modes });
             }
             const read = this.nextRead(kind);
             offer(kind, cli, kept)
@@ -147,10 +168,12 @@ export class Agents {
         return this.queue(kind, () => this.ensure(kind));
     }
     async reread(kind) {
-        await this.queue(kind, async () => {
-            this.nextRead(kind);
-            this.readings.set(kind, await this.examine(kind, this.readings.get(kind) ?? SIGNED_OUT));
-        });
+        await this.examine(kind, this.readings.get(kind) ?? SIGNED_OUT, offer);
+        await this.report();
+    }
+    async recheck(kind) {
+        const known = this.readings.get(kind) ?? SIGNED_OUT;
+        await this.examine(kind, known, async (kind, cli) => (await signedIn(kind, cli, known)) ? { ...known, signed_in: true } : SIGNED_OUT);
         await this.report();
     }
     report() {
@@ -207,18 +230,18 @@ export class Agents {
             return { release, minimum, failure: null, ...SIGNED_OUT };
         return { cli, release };
     }
-    async examine(kind, known) {
-        const resolved = await this.resolve(kind);
-        if (!('cli' in resolved))
-            return resolved;
-        return { release: resolved.release, failure: null, ...(await offer(kind, resolved.cli, known)) };
+    async examine(kind, known, read) {
+        const current = this.nextRead(kind);
+        const resolved = await this.queue(kind, () => this.resolve(kind));
+        const reading = 'cli' in resolved ? { release: resolved.release, failure: null, ...(await read(kind, resolved.cli, known)) } : resolved;
+        if (this.reads.get(kind) === current)
+            this.readings.set(kind, reading);
     }
     async load(kind) {
         const known = this.readings.get(kind);
         if (known !== undefined && known.failure === null)
             return;
-        this.nextRead(kind);
-        this.readings.set(kind, await this.examine(kind, SIGNED_OUT));
+        await this.examine(kind, SIGNED_OUT, offer);
     }
     async send() {
         const agents = this.desired.agents.flatMap((kind) => {

package/dist/api.js

@@ -1,3 +1,4 @@
+import { end, SIGN_IN_AGAIN } from './end.js';
 import { readEnrolment } from './home.js';
 import { relayed } from './relay.js';
 export class HouseRefusal extends Error {
@@ -10,6 +11,7 @@ export class HouseRefusal extends Error {
     }
 }
 export function retryDelay(attempt) {
+    // Full jitter, doubling from one second to a 30-second cap, spreads the Kits one outage dropped and retries within half a minute of House's return.
     return Math.random() * Math.min(30_000, 1000 * 2 ** attempt);
 }
 export async function post(house, path, body, credential, signal) {
@@ -29,7 +31,14 @@ export async function post(house, path, body, credential, signal) {
 }
 async function enrolledPost(path, body, signal) {
     const { house, credential } = (await readEnrolment());
-    return post(house, path, body, credential, signal);
+    try {
+        return await post(house, path, body, credential, signal);
+    }
+    catch (error) {
+        if (error instanceof HouseRefusal && error.status === 401)
+            end(SIGN_IN_AGAIN);
+        throw error;
+    }
 }
 export const house = {
     post: enrolledPost,
@@ -42,6 +51,7 @@ export const house = {
                 if (error instanceof HouseRefusal && error.status < 500)
                     throw error;
                 process.stderr.write(`kit: ${path} did not reach House: ${error.message}\n`);
+                // A delivery House did not take is sent again on the jittered curve for as long as it is still current.
                 await new Promise((resolve) => setTimeout(resolve, retryDelay(attempt)));
                 if (!current())
                     throw error;

package/dist/bootstrap.json

@@ -1,23 +1,23 @@
 {
   "schemaVersion": 2,
-  "version": "0.2.1-c15804a0fa28d",
+  "version": "0.2.1-c2c600f2d2b30",
   "hosts": {
     "macos": {
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c15804a0fa28d/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c2c600f2d2b30/connect-linux.sh"
       }
     },
     "linux": {
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c15804a0fa28d/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c2c600f2d2b30/connect-linux.sh"
       }
     },
     "windows": {
       "asset": {
         "name": "connect-windows.ps1",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c15804a0fa28d/connect-windows.ps1"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.2.1-c2c600f2d2b30/connect-windows.ps1"
       }
     }
   }

package/dist/bridge.js

@@ -105,6 +105,7 @@ export async function openBridge(house, copies, conversationId, signal) {
             const after = resendAfter(forwarded, attempt);
             if (after === null)
                 return forwarded;
+            // A write House did not settle is sent again on the jittered curve, or after the wait House names for a pending one.
             await delay(after, undefined, { signal: closed.signal });
         }
     };

package/dist/clis.js

@@ -1,10 +1,16 @@
 import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
-import { userInfo } from 'node:os';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir, userInfo } from 'node:os';
 import { join } from 'node:path';
 import { kitHome } from './home.js';
 const RUNNING_JOB = new Set(['running', 'paused']);
+async function allowHouseInCodex() {
+    const rules = join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'rules');
+    await mkdir(rules, { recursive: true });
+    await writeFile(join(rules, 'house.rules'), 'prefix_rule(pattern = ["house"], decision = "allow")\n');
+}
+async function nothing() { }
 function threadStatus({ method, params }) {
     if (method !== 'session/update' || params?.update?.sessionUpdate !== 'session_info_update')
         return undefined;
@@ -36,6 +42,9 @@ export const CLIS = {
         install: 'curl -fsSL https://chatgpt.com/codex/install.sh | sh',
         adapter: { package: '@agentclientprotocol/codex-acp', bin: 'codex-acp', executable: 'CODEX_PATH', env: {} },
         args: [],
+        fullAccess: 'agent-full-access',
+        sessionMeta: {},
+        allowHouse: allowHouseInCodex,
         signedIn: { command: ['login', 'status'] },
         login: { args: ['login', '--device-auth'], code: 'show' },
         queues: false,
@@ -52,9 +61,12 @@ export const CLIS = {
             package: '@agentclientprotocol/claude-agent-acp',
             bin: 'claude-agent-acp',
             executable: 'CLAUDE_CODE_EXECUTABLE',
-            env: { CLAUDE_CODE_ENTRYPOINT: 'claude-agent-acp' },
+            env: { CLAUDE_CODE_ENTRYPOINT: 'claude-agent-acp', IS_SANDBOX: '1' },
         },
         args: [],
+        fullAccess: 'bypassPermissions',
+        sessionMeta: { claudeCode: { options: { allowedTools: ['Bash(house:*)'] } } },
+        allowHouse: nothing,
         signedIn: { command: ['auth', 'status'] },
         login: { args: ['auth', 'login', '--claudeai'], code: 'collect', rejected: 'Invalid code' },
         queues: false,
@@ -70,7 +82,10 @@ export const CLIS = {
         minimum: '1.0.46',
         install: 'curl -fsSL https://x.ai/cli/install.sh | bash',
         adapter: null,
-        args: ['agent', '--no-leader', 'stdio'],
+        args: ['agent', '--always-approve', '--no-leader', 'stdio'],
+        fullAccess: null,
+        sessionMeta: {},
+        allowHouse: nothing,
         signedIn: { initializeMeta: 'defaultAuthMethodId' },
         login: { args: ['login', '--device-auth'], code: 'show' },
         queues: true,
@@ -90,7 +105,9 @@ const KIT_PACKAGE = JSON.parse(readFileSync(new URL('../package.json', import.me
 export const KIT_VERSION = KIT_PACKAGE.version;
 const PROXY = /^https?_proxy$/i;
 const VERSION = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?/;
+// An install still running after fifteen minutes is ended and reported as failed, so a hung download cannot hold its CLI's report.
 const INSTALL_MS = 15 * 60_000;
+// A login shell or a version read is ended after half a minute, so a profile that waits for input cannot stall the report.
 const READ_MS = 30_000;
 const CAUSE_CHARACTERS = 4000;
 function prefix(kind) {

package/dist/conversations.js

@@ -285,13 +285,15 @@ export class Conversations {
         conversation.opening = bridge;
         try {
             await unlessAborted(createHowWeWork(bridge), conversation.killed.signal);
+            await CLIS[route.kind].allowHouse();
             const adapter = await startAdapter(route.kind, cli, route.working_directory, app, (job) => this.job(conversation, job), bridge.env);
             void adapter.exited.then(() => bridge.close());
             const agent = adapter.connection.agent;
             const cwd = route.working_directory;
+            const _meta = CLIS[route.kind].sessionMeta;
             const opened = sessionId === null
-                ? await agent.request('session/new', { cwd, mcpServers: [] })
-                : { ...(await agent.request('session/resume', { sessionId, cwd, mcpServers: [] })), sessionId };
+                ? await agent.request('session/new', { cwd, mcpServers: [], _meta })
+                : { ...(await agent.request('session/resume', { sessionId, cwd, mcpServers: [], _meta })), sessionId };
             const running = {
                 adapter,
                 bridge,
@@ -321,6 +323,7 @@ export class Conversations {
     async launchSettings(running, route, offered) {
         let options = offered;
         const settings = [
+            ['mode', route.mode ?? CLIS[route.kind].fullAccess],
             ['model', route.model],
             ['thought_level', route.effort],
         ];
@@ -389,10 +392,8 @@ export class Conversations {
         turn.admitted = true;
         for (const note of turn.notes.splice(0))
             this.kit.send(note);
-        if (turn.text !== '') {
-            turn.unsentFrom = 0;
-            this.draft(conversation, turn);
-        }
+        turn.unsentFrom = 0;
+        this.draft(conversation, turn);
         if (turn.entries !== null)
             this.plan(conversation, turn);
     }
@@ -442,8 +443,11 @@ export class Conversations {
             this.attach(conversation.turn ?? this.begin(conversation), sent);
         }
         running.adapter.connection.agent.request('session/prompt', { sessionId: running.sessionId, prompt }).then(() => this.answered(conversation, sent, null), async (error) => {
-            if (!running.adapter.connection.signal.aborted)
+            if (!running.adapter.connection.signal.aborted) {
                 this.answered(conversation, sent, causeOf(error));
+                if (conversation.open === 0 && conversation.running === running)
+                    stop(running.bridge);
+            }
             else if (sent.turn !== null) {
                 this.end(conversation, sent.turn, { failed: running.killed ? KILLED : await running.adapter.exited });
             }

package/dist/copies.js

@@ -11,7 +11,6 @@ import { changed } from './translate.js';
 import { relayed } from './relay.js';
 const BRANCH = 'main';
 const PROVENANCE = '_provenance';
-const REPLICA_RETRY_MS = 30_000;
 const IDENTITY = { GIT_COMMITTER_NAME: 'House Kit', GIT_COMMITTER_EMAIL: 'house-kit@localhost' };
 function causeOf(error) {
     return error instanceof Error ? error.message : String(error);
@@ -439,7 +438,6 @@ export class LocalCopies {
                     return this.received(copy);
                 if (code !== 'replica_behind')
                     throw error;
-                setTimeout(() => this.deliver(copy.key), REPLICA_RETRY_MS).unref();
                 return copy;
             }
             const view = answer.authorities.find((entry) => entry.authority === copy.room_ref);

package/dist/end.js

@@ -0,0 +1,8 @@
+import { killDescendants } from './acp.js';
+export const REPLACED = 'another Kit started for this Environment';
+export const SIGN_IN_AGAIN = 'sign in again';
+export function end(reason) {
+    process.stderr.write(`kit: ${reason}\n`);
+    killDescendants();
+    process.exit(0);
+}

package/dist/secret-input.js

@@ -1,4 +1,4 @@
-import { retryDelay } from './api.js';
+import { HouseRefusal, retryDelay } from './api.js';
 export async function holdSecretInput(house, subject, steps, waiting) {
     for (let failures = 0; waiting();) {
         try {
@@ -10,7 +10,10 @@ export async function holdSecretInput(house, subject, steps, waiting) {
             failures = 0;
         }
         catch (error) {
+            if (error instanceof HouseRefusal && error.status < 500)
+                return null;
             process.stderr.write(`kit: ${error instanceof Error ? error.message : String(error)}\n`);
+            // A wait that did not reach House is held again on the jittered curve for as long as its asker still waits.
             await new Promise((resolve) => setTimeout(resolve, retryDelay(failures++)));
         }
     }

package/dist/sign-in.js

@@ -31,8 +31,9 @@ export class SignIns {
         this.running.add(input.input_id);
         this.changed();
         this.login(input)
-            .then(() => this.agents.reread(input.cli))
+            .then(() => this.agents.recheck(input.cli))
             .then(() => this.house.deliver(`/kit/inputs/${input.input_id}/ack`, {}))
+            .then(() => this.agents.reread(input.cli))
             .catch(logged)
             .finally(() => {
             this.running.delete(input.input_id);

package/dist/stream.js

@@ -1,17 +1,36 @@
-import { retryDelay } from './api.js';
+import { subscribe } from 'node:diagnostics_channel';
+import { HouseRefusal, retryDelay } from './api.js';
+import { end, REPLACED, SIGN_IN_AGAIN } from './end.js';
 import { readEnrolment } from './home.js';
 import { relayed } from './relay.js';
+const PATH = '/kit/stream';
 const SUBPROTOCOL = 'house.kit.stream.1';
+const REFUSAL_HEADER = 'x-house-refusal';
 function streamUrl(house) {
-    const url = new URL('/kit/stream', house);
+    const url = new URL(PATH, house);
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
     return url;
 }
+function header(headers, name) {
+    for (let index = 0; index < headers.length; index += 2) {
+        if (headers[index].toString('latin1').toLowerCase() === name)
+            return headers[index + 1].toString('latin1');
+    }
+    return '';
+}
+let refused = null;
+subscribe('undici:request:headers', (message) => {
+    const { request, response } = message;
+    if (!request.path.endsWith(PATH))
+        return;
+    refused = new HouseRefusal(PATH, response.statusCode, header(response.headers, REFUSAL_HEADER) || response.statusText);
+});
 export function holdStream(handlers) {
     let socket = null;
     let failures = 0;
     const connect = async () => {
         const { house, credential } = (await readEnrolment());
+        refused = null;
         const opening = new WebSocket(relayed(streamUrl(house)), {
             protocols: [SUBPROTOCOL],
             headers: { authorization: `Bearer ${credential}` },
@@ -31,8 +50,14 @@ export function holdStream(handlers) {
             if (socket === opening)
                 socket = null;
             process.stderr.write(`kit: control stream closed ${event.code} ${event.reason}\n`);
-            const delay = opened ? 1000 + Math.random() * 2000 : retryDelay(failures++);
-            setTimeout(() => void connect(), delay);
+            if (event.reason === 'replaced')
+                end(REPLACED);
+            if (event.reason === 'credential_rejected' || refused?.status === 401)
+                end(SIGN_IN_AGAIN);
+            if (refused !== null && refused.status >= 400 && refused.status < 500)
+                end(refused.message);
+            // A closed socket reopens in one to three seconds, spread so Kits one restart closed return apart; a failed opening backs off on the jittered curve.
+            setTimeout(() => void connect(), opened ? 1000 + Math.random() * 2000 : retryDelay(failures++));
         };
     };
     void connect();

package/dist/transcription.js

@@ -36,6 +36,7 @@ function installed(artifact) {
     return join(directory(), artifact.sha256);
 }
 async function executed(command, args, signal) {
+    // A download or a transcription runs as long as its size needs; the conversation's interrupt or end aborts it instead.
     const ran = await run(command, args, 0, false, signal);
     if (ran.status !== 0)
         throw new Error(failureOf(ran, basename(command)));
@@ -68,6 +69,7 @@ async function install(artifacts, signal) {
     try {
         for (const artifact of missing) {
             const part = `${installed(artifact)}.part`;
+            // Three retries carry a large download past a dropped connection before the transcription fails.
             await executed('curl', ['-fsSL', '--retry', '3', '-o', part, artifact.url], signal);
             if ((await sha256(part)) !== artifact.sha256)
                 throw new Error(`${artifact.url} does not match its sha256`);

package/dist/update.js

@@ -40,9 +40,11 @@ async function finished(inputId) {
         const ack = await recorded();
         if (ack !== null)
             return ack;
+        // systemctl answers at once, so ten seconds only bounds a stuck service manager.
         if ((await run('systemctl', ['is-active', '--quiet', unit(inputId)], 10_000)).status !== 0) {
             return (await recorded()) ?? { refused: 'the Kit bootstrap did not finish' };
         }
+        // The bootstrap runs for minutes, so checking each second sees its outcome within a second at little cost.
         await new Promise((resolve) => setTimeout(resolve, 1000));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.2.1-c15804a0fa28d",
+  "version": "0.2.1-c2c600f2d2b30",
   "description": "House Kit connects an Environment to agents.house.",
   "license": "MIT",
   "repository": {