@agentshouse/kit 0.2.1-c5262a8cc063d → 0.2.1-c5883630417e1

package/README.md

@@ -1,14 +1,12 @@
 # House Kit
 
-House Kit connects an Environment, a Linux computer or server, to
-[agents.house](https://agents.house). It runs your Agents' conversations
-through the agent CLIs you chose and gives each Agent the `house` command.
+House Kit connects an Environment, a Linux computer or server, to [agents.house](https://agents.house). It runs
+your Agents' conversations through the agent CLIs you chose and gives each Agent the `house` command.
 
 ## Install
 
-Run `curl -fsSL agents.house/kit | sh`, or `irm agents.house/kit.ps1 | iex` on
-Windows, and again to update; options follow `sh -s --`. On macOS and Linux it
-installs House Kit natively under your own account, without an admin password,
+Run `curl -fsSL agents.house/kit | sh`, or `irm agents.house/kit.ps1 | iex` on Windows, and again to update;
+options follow `sh -s --`. On macOS and Linux it installs House Kit natively under your own account, without an admin password,
 as a service that runs while you are logged in. `kit` and `house` are then on
 your login shell's `PATH`, and your workspace is `~/AgentsHouse` unless you
 pass `--workspace <path>`.
@@ -20,7 +18,7 @@ workspace. On Windows 11 the container is the one choice. Append a `kit` or
 Running the command for the other choice on a connected computer asks you to
 confirm, then replaces its Environment, whose Agents end, with a new one.
 
-On your own Ubuntu 26.04 server, run the Linux command with `--linux` to
+On your own Linux server, run the Linux command with `--linux` to
 install House Kit natively, with its workspace at `/agents/house`; `kit` and
 `house` are then on the server's `PATH`.
 
@@ -33,27 +31,30 @@ them out; running it again without the flag brings them back.
 
 ## Commands
 
-`kit login` opens a link you confirm in your browser and keeps the
-Environment's credential in `~/.house-kit`, or in `$HOUSE_KIT_HOME` when it is
-set. Pass `--manual` to paste the code by hand on a machine without a browser,
-and `--environment <id>` to reconnect an Environment you already have. It also
-connects your own agent: `house <tool>` run outside an Agent conversation calls
-House as you, until you revoke that connection on Connections. `house help`
-lists the Tools. `kit logout` disconnects this computer and stops House Kit; a
-later `kit login` reconnects the same Environment.
-
-`kit resident` keeps the Environment connected, and keeps the Rooms you chose
-for this Environment as Git repositories under `local-copies` in the
-workspace. Commit in one and run `house push --owner` there to send the
-commit to House; in the container, run it through the install command from the
-copy's directory. Inside an Agent conversation the Agent runs `house push`.
+`kit login` opens or prints a link you confirm in any browser, on this computer
+or another, continues on its own and keeps the Environment's credential in
+`$HOUSE_KIT_HOME` when it is set, else in `~/.house-kit`, or in `house-kit-<uid>` under the temporary directory when your home is read-only. `--environment <id>`
+reconnects an Environment you already have; `--rooms <ref>[,<ref>...]` gives it
+only those Rooms and `--no-private` every Room but your Private Room; `--code <code>` connects immediately without a link.
+A login also connects your own agent: outside an Agent conversation, `house <tool>` calls
+House as you and `git` clones and pushes your Apps at `<house>/app/` as you, until you revoke
+that connection on Connections. `house help` lists the Tools. Codex sessions started after a
+login run a lone `house` command outside their sandbox. `kit logout` disconnects this
+computer, stops House Kit and ends your own agent's connection, so `house` and `git` no
+longer act as you here; a later `kit login` reconnects the same Environment, or connects
+this computer as a new one when House no longer holds it.
+In a container you do not control, such as ChatGPT's, `npm i -g @agentshouse/kit` and `kit chatgpt --key <key>` with a key made on Connections let `house <tool>` act as you, starting and configuring nothing else.
+
+`kit resident` keeps the Environment connected and, as it connects, copies the text of each Room
+you chose for it as a Git repository in the workspace's `local-copies`. `house fetch` records
+House's changes on each copy's `refs/house/received`; rebase onto it, commit and run
+`house push --owner` in the copy, through the install command in the container. An Agent runs
+both, without `--owner`. `house upload` and `house download` move a Room's other files.
 
 House Kit turns each audio file of your message to an Agent into text on this
-computer before the Agent reads the message. The first audio file downloads the
-speech engine and model, about 425 MB, into `~/.house-kit`.
+computer before the Agent reads it. While transcription is on, the speech
+engine and model use about 425 MB beside the Environment's credential; turning it off deletes them.
 
 ## License
 
-MIT
-
-The skills come from [mattpocock/skills](https://github.com/mattpocock/skills); thank you, Matt Pocock.
+MIT. The skills come from [mattpocock/skills](https://github.com/mattpocock/skills); thank you, Matt Pocock.

package/dist/acp.js

@@ -1,18 +1,21 @@
 import { ndJsonStream, PROTOCOL_VERSION, } from '@agentclientprotocol/sdk';
-import { execFileSync, spawn } from 'node:child_process';
-import { readdirSync, readFileSync } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { Readable, Writable } from 'node:stream';
 import { CLIS, KIT_VERSION, adapterCommand, withoutProxy } from './clis.js';
-export const TURN_STARTED = 'kit/turn_started';
-export const TURN_ENDED = 'kit/turn_ended';
-export async function startAdapter(kind, cli, cwd, app, jobs = () => undefined, added = {}) {
+import { killTree } from './scope.js';
+export async function startAdapter(kind, cli, cwd, app, events = () => undefined, added = {}, signal, scope = null) {
     const adapter = CLIS[kind].adapter;
-    const child = spawn(adapter === null ? cli : adapterCommand(kind), CLIS[kind].args, {
+    const started = [adapter === null ? cli : adapterCommand(kind), CLIS[kind].args];
+    const [command, args] = scope?.command(...started) ?? started;
+    const child = spawn(command, args, {
         cwd,
         env: { ...withoutProxy(), ...(adapter === null ? {} : { ...adapter.env, [adapter.executable]: cli }), ...added },
         stdio: ['pipe', 'pipe', 'pipe'],
         detached: true,
     });
+    const stop = () => killTree(child);
+    signal?.addEventListener('abort', stop, { once: true });
+    child.on('exit', () => signal?.removeEventListener('abort', stop));
     let stderr = '';
     child.stderr.on('data', (chunk) => {
         stderr = (stderr + chunk.toString('utf8')).slice(-4000);
@@ -29,16 +32,11 @@ export async function startAdapter(kind, cli, cwd, app, jobs = () => undefined,
         writable: stream.writable,
         readable: stream.readable.pipeThrough(new TransformStream({
             transform(message, controller) {
-                const notice = message;
-                const job = CLIS[kind].job(notice);
-                if (job !== null)
-                    jobs(job);
-                if (!notice.params?.update?.sessionUpdate?.startsWith('async_task_'))
+                const read = message;
+                events(read);
+                if (read.id !== undefined || (read.method !== 'session/update' && !read.method.startsWith('_'))) {
                     controller.enqueue(message);
-                if (CLIS[kind].turnStarted(notice))
-                    controller.enqueue({ jsonrpc: '2.0', method: TURN_STARTED });
-                if (CLIS[kind].turnEnded(notice))
-                    controller.enqueue({ jsonrpc: '2.0', method: TURN_ENDED });
+                }
             },
         })),
     });
@@ -50,10 +48,12 @@ export async function startAdapter(kind, cli, cwd, app, jobs = () => undefined,
                 fs: { readTextFile: false, writeTextFile: false },
                 terminal: false,
                 elicitation: { form: {} },
-                _meta: { jetbrains: { air: { version: 1, capabilities: ['asyncTasks'] } } },
+                session: { compaction: {}, notices: {} },
+                _meta: { jetbrains: { air: { version: 1, capabilities: CLIS[kind].air } } },
             },
             clientInfo: { name: '@agentshouse/kit', version: KIT_VERSION },
         });
+        scope?.entered(child.pid);
         return { child, connection, initialized, exited };
     }
     catch (error) {
@@ -61,80 +61,3 @@ export async function startAdapter(kind, cli, cwd, app, jobs = () => undefined,
         throw error;
     }
 }
-const LISTING_BYTES = 1 << 28;
-function listed(options) {
-    return execFileSync('ps', [options, '-o', 'pid=,ppid=,command='], { encoding: 'utf8', maxBuffer: LISTING_BYTES })
-        .split('\n')
-        .flatMap((line) => {
-        const fields = /^\s*(\d+)\s+(\d+)\s?(.*)$/.exec(line);
-        return fields === null ? [] : [[Number(fields[1]), Number(fields[2]), fields[3]]];
-    });
-}
-function parents() {
-    const children = new Map();
-    const adopt = (pid, parent) => children.set(parent, [...(children.get(parent) ?? []), pid]);
-    if (process.platform === 'darwin') {
-        for (const [pid, parent] of listed('-Aww'))
-            adopt(pid, parent);
-        return children;
-    }
-    for (const entry of readdirSync('/proc')) {
-        if (!/^\d+$/.test(entry))
-            continue;
-        try {
-            const stat = readFileSync(`/proc/${entry}/stat`, 'utf8');
-            adopt(Number(entry), Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[1]));
-        }
-        catch { }
-    }
-    return children;
-}
-function descendants(roots) {
-    const children = parents();
-    const tree = [];
-    const pending = roots.flatMap((root) => children.get(root) ?? []);
-    while (pending.length > 0) {
-        const pid = pending.pop();
-        tree.push(pid);
-        pending.push(...(children.get(pid) ?? []));
-    }
-    return tree;
-}
-function killAll(pids) {
-    for (const pid of pids) {
-        for (const target of [-pid, pid]) {
-            try {
-                process.kill(target, 'SIGKILL');
-            }
-            catch { }
-        }
-    }
-}
-function marked(marker) {
-    if (process.platform === 'darwin') {
-        return listed('-AEww')
-            .filter(([, , command]) => ` ${command} `.includes(` ${marker} `))
-            .map(([pid]) => pid);
-    }
-    return readdirSync('/proc')
-        .filter((entry) => {
-        try {
-            return /^\d+$/.test(entry) && readFileSync(`/proc/${entry}/environ`, 'utf8').split('\0').includes(marker);
-        }
-        catch {
-            return false;
-        }
-    })
-        .map(Number);
-}
-export function killTree(child) {
-    killAll([child.pid, ...descendants([child.pid])]);
-}
-export function killMarked(marker) {
-    const pids = marked(marker);
-    killAll([...pids, ...descendants(pids)]);
-}
-export function killDescendants() {
-    const pids = marked(`HOUSE_KIT_RESIDENT=${process.pid}`);
-    killAll([...pids, ...descendants([process.pid, ...pids])]);
-}

package/dist/agents.js

@@ -1,15 +1,22 @@
 import { client } from '@agentclientprotocol/sdk';
 import { readFile, realpath } from 'node:fs/promises';
-import { killTree, startAdapter } from './acp.js';
+import { startAdapter } from './acp.js';
 import { CLIS, KIT_VERSION, below, installAdapter, installCli, locate, run, versionOf } from './clis.js';
 import { agentBase, kitHome } from './home.js';
-const SIGNED_OUT = { signed_in: false, models: [] };
+import { updatesItself } from './placement.js';
+import { killTree } from './scope.js';
+import { holdTranscription, transcriptionReport } from './transcription.js';
+import { KIT_WIRE } from './wire.js';
+const SIGNED_OUT = { signed_in: false, models: [], modes: [] };
 function select(options, category) {
     const option = options.find((candidate) => candidate.category === category);
     return option?.type === 'select' ? option : undefined;
 }
+function choices(options) {
+    return options.flatMap((entry) => ('group' in entry ? entry.options : [entry]));
+}
 function values(options) {
-    return options.flatMap((entry) => ('group' in entry ? entry.options : [entry])).map((entry) => entry.value);
+    return choices(options).map((entry) => entry.value);
 }
 function causeOf(error) {
     return error instanceof Error ? error.message : String(error);
@@ -21,9 +28,11 @@ async function models(kind, adapter, known) {
     const agent = adapter.connection.agent;
     const opened = await agent.request('session/new', { cwd: kitHome(), mcpServers: [] });
     let options = opened.configOptions ?? [];
+    const mode = select(options, 'mode');
+    const modes = mode === undefined ? [] : choices(mode.options).map(({ value, name }) => ({ mode: value, name }));
     const model = select(options, 'model');
     if (model === undefined)
-        return [];
+        return { models: [], modes };
     const offered = [];
     for (const value of values(model.options)) {
         if (select(options, 'model')?.currentValue !== value) {
@@ -39,25 +48,46 @@ async function models(kind, adapter, known) {
         const effort = select(options, 'thought_level');
         offered.push({ model: value, efforts: effort === undefined ? [] : values(effort.options) });
     }
-    return offered;
+    return { models: offered, modes };
+}
+async function signedIn(kind, cli, known, signal) {
+    const probe = CLIS[kind].signedIn;
+    // A sign-in check that has not answered in half a minute counts as signed out rather than stalling the report.
+    if ('command' in probe)
+        return (await run(cli, probe.command, 30_000, false, signal)).status === 0;
+    return (await offer(kind, cli, known, signal)).signed_in;
 }
-async function offer(kind, cli, known) {
+function ended(signal) {
+    return new Promise((_, reject) => {
+        if (signal.aborted)
+            reject(signal.reason);
+        signal.addEventListener('abort', () => reject(signal.reason), { once: true });
+    });
+}
+async function offer(kind, cli, known, signal) {
     const probe = CLIS[kind].signedIn;
-    if ('command' in probe && (await run(cli, probe.command, 30_000)).status !== 0)
+    // A sign-in check that has not answered in half a minute counts as signed out rather than stalling the report.
+    if ('command' in probe && (await run(cli, probe.command, 30_000, false, signal)).status !== 0)
         return SIGNED_OUT;
     let adapter;
     try {
-        adapter = await startAdapter(kind, cli, kitHome(), client({ name: '@agentshouse/kit' }));
+        adapter = await startAdapter(kind, cli, kitHome(), client({ name: '@agentshouse/kit' }), () => undefined, {}, signal);
+        signal?.throwIfAborted();
         if ('initializeMeta' in probe) {
             const method = adapter.initialized._meta?.[probe.initializeMeta];
             if (typeof method !== 'string' || method.length === 0)
                 return SIGNED_OUT;
         }
-        return { signed_in: true, models: await models(kind, adapter, known.models) };
+        return { signed_in: true, ...(await models(kind, adapter, known.models)) };
     }
     catch (error) {
-        process.stderr.write(`kit: ${kind} did not offer its models: ${causeOf(error)}\n`);
-        return { signed_in: adapter === undefined && 'initializeMeta' in probe ? known.signed_in : true, models: known.models };
+        if (!signal?.aborted)
+            process.stderr.write(`kit: ${kind} did not offer its models: ${causeOf(error)}\n`);
+        return {
+            signed_in: adapter === undefined && 'initializeMeta' in probe ? known.signed_in : true,
+            models: known.models,
+            modes: known.modes,
+        };
     }
     finally {
         if (adapter !== undefined)
@@ -72,6 +102,8 @@ function reported(kind, reading) {
         failure: reading.failure,
         signed_in: reading.signed_in,
         models: reading.models,
+        modes: reading.modes,
+        full_access: CLIS[kind].fullAccess,
     };
 }
 function tooOld(kind, release) {
@@ -79,17 +111,19 @@ function tooOld(kind, release) {
     return `${cli.bin} ${release} is older than ${cli.minimum}, the oldest this Kit runs`;
 }
 async function sshHostKey() {
+    // Listing a local host key takes a moment, so ten seconds only bounds a stuck ssh-keygen.
     const listed = await run('ssh-keygen', ['-l', '-E', 'sha256', '-f', '/etc/ssh/ssh_host_ed25519_key.pub'], 10_000);
     return listed.status === 0 ? (/^\d+ (SHA256:\S+)/.exec(listed.output)?.[1] ?? null) : null;
 }
 async function operatingSystem() {
+    // sw_vers answers at once, so ten seconds only bounds a stuck call.
     if (process.platform === 'darwin')
         return `macOS ${(await run('sw_vers', ['-productVersion'], 10_000)).output.trim()}`;
     const release = await readFile('/etc/os-release', 'utf8');
     return /^PRETTY_NAME="?([^"\n]*)"?$/m.exec(release)?.[1] ?? release;
 }
 export class Agents {
-    desired = { agents: [], routes: [] };
+    desired = { agents: [], routes: [], transcribe: false };
     house;
     reading = Promise.resolve();
     queues = new Map();
@@ -98,8 +132,14 @@ export class Agents {
     reads = new Map();
     sending = Promise.resolve();
     sent = null;
-    constructor(house) {
+    refreshing = 0;
+    changed;
+    constructor(house, changed = () => undefined) {
         this.house = house;
+        this.changed = changed;
+    }
+    idle() {
+        return this.refreshing === 0;
     }
     read() {
         return this.reading.then(() => undefined, () => undefined);
@@ -108,16 +148,28 @@ export class Agents {
         return this.desired.routes.find((route) => route.agent_id === agentId);
     }
     refresh() {
+        this.refreshing++;
+        this.changed();
         const reading = this.read().then(async () => {
             this.desired = await this.house.deliver('/kit/agents/desired', {});
             return this.desired;
         });
         this.reading = reading;
-        return reading.then(({ agents }) => {
-            Promise.all(agents.map((kind) => this.queue(kind, () => this.load(kind))))
+        reading
+            .then(({ agents, transcribe }) => Promise.all([
+            holdTranscription(transcribe)
+                .then((changed) => (changed ? this.report() : undefined))
+                .catch(logged),
+            Promise.all(agents.map((kind) => this.load(kind)))
                 .then(() => this.report())
-                .catch(logged);
+                .catch(logged),
+        ]))
+            .catch(() => undefined)
+            .finally(() => {
+            this.refreshing--;
+            this.changed();
         });
+        return reading.then(() => undefined);
     }
     cli(kind) {
         return this.queue(kind, async () => {
@@ -130,7 +182,7 @@ export class Agents {
             const known = this.readings.get(kind);
             const kept = known?.release === null || known?.minimum !== undefined ? SIGNED_OUT : (known ?? SIGNED_OUT);
             if (known?.release !== release || known.minimum !== undefined) {
-                this.update(kind, { release, failure: null, signed_in: kept.signed_in, models: kept.models });
+                this.update(kind, { release, failure: null, signed_in: kept.signed_in, models: kept.models, modes: kept.modes });
             }
             const read = this.nextRead(kind);
             offer(kind, cli, kept)
@@ -143,16 +195,19 @@ export class Agents {
             return cli;
         });
     }
-    located(kind) {
-        return this.queue(kind, () => this.ensure(kind));
+    located(kind, signal) {
+        return this.queue(kind, () => this.ensure(kind, signal), signal);
     }
     async reread(kind) {
-        await this.queue(kind, async () => {
-            this.nextRead(kind);
-            this.readings.set(kind, await this.examine(kind, this.readings.get(kind) ?? SIGNED_OUT));
-        });
+        await this.examine(kind, this.readings.get(kind) ?? SIGNED_OUT, offer);
         await this.report();
     }
+    async recheck(kind, signal) {
+        const known = this.readings.get(kind) ?? SIGNED_OUT;
+        await this.examine(kind, known, async (kind, cli) => ((await signedIn(kind, cli, known, signal)) ? { ...known, signed_in: true } : SIGNED_OUT), signal);
+        if (!signal.aborted)
+            await this.report();
+    }
     report() {
         const sending = this.sending.catch(() => undefined).then(() => this.send());
         this.sending = sending;
@@ -167,39 +222,42 @@ export class Agents {
         this.readings.set(kind, reading);
         this.report().catch(logged);
     }
-    queue(kind, work) {
-        const queued = (this.queues.get(kind) ?? Promise.resolve()).then(work);
+    queue(kind, work, signal) {
+        const queued = (this.queues.get(kind) ?? Promise.resolve()).then(() => {
+            signal?.throwIfAborted();
+            return work();
+        });
         this.queues.set(kind, queued.catch(() => undefined));
-        return queued;
+        return signal === undefined ? queued : Promise.race([queued, ended(signal)]);
     }
-    async ensure(kind) {
-        const failed = await installAdapter(kind);
+    async ensure(kind, signal) {
+        const failed = await installAdapter(kind, signal);
         if (failed !== null)
             throw new Error(failed);
-        const found = await locate(kind);
+        const found = await locate(kind, signal);
         if (found !== null)
             return found;
-        const installing = this.installing.catch(() => undefined).then(() => installCli(kind));
+        const installing = this.installing.catch(() => undefined).then(() => installCli(kind, signal));
         this.installing = installing;
         const failure = await installing;
         if (failure !== null)
             throw new Error(failure);
-        const installed = await locate(kind);
+        const installed = await locate(kind, signal);
         if (installed === null)
             throw new Error(`the login shell does not find ${CLIS[kind].bin} after its install`);
         return installed;
     }
-    async resolve(kind) {
+    async resolve(kind, signal) {
         let cli;
         try {
-            cli = await realpath(await this.ensure(kind));
+            cli = await realpath(await this.ensure(kind, signal));
         }
         catch (error) {
             const failure = causeOf(error);
             process.stderr.write(`kit: ${kind} did not install: ${failure}\n`);
             return { release: null, failure, ...SIGNED_OUT };
         }
-        const release = await versionOf(cli);
+        const release = await versionOf(cli, signal);
         if (release === null)
             return { release: null, failure: `${cli} --version names no version`, ...SIGNED_OUT };
         const minimum = CLIS[kind].minimum;
@@ -207,18 +265,19 @@ export class Agents {
             return { release, minimum, failure: null, ...SIGNED_OUT };
         return { cli, release };
     }
-    async examine(kind, known) {
-        const resolved = await this.resolve(kind);
-        if (!('cli' in resolved))
-            return resolved;
-        return { release: resolved.release, failure: null, ...(await offer(kind, resolved.cli, known)) };
+    async examine(kind, known, read, signal) {
+        const current = this.nextRead(kind);
+        const resolved = await this.queue(kind, () => this.resolve(kind, signal), signal);
+        const reading = 'cli' in resolved ? { release: resolved.release, failure: null, ...(await read(kind, resolved.cli, known)) } : resolved;
+        if (this.reads.get(kind) === current && !signal?.aborted)
+            this.readings.set(kind, reading);
     }
     async load(kind) {
         const known = this.readings.get(kind);
-        if (known !== undefined && known.failure === null)
+        if (known !== undefined && known.failure === null && known.minimum === undefined)
             return;
-        this.nextRead(kind);
-        this.readings.set(kind, await this.examine(kind, SIGNED_OUT));
+        await this.examine(kind, SIGNED_OUT, offer);
+        await this.report();
     }
     async send() {
         const agents = this.desired.agents.flatMap((kind) => {
@@ -229,8 +288,11 @@ export class Agents {
         const body = {
             os: await operatingSystem(),
             kit_version: KIT_VERSION,
+            wire: KIT_WIRE,
+            updates_itself: await updatesItself(),
             agent_base: agentBase(),
             agents,
+            transcription: transcriptionReport(),
             ...(hostKey === null ? {} : { ssh_host_key: hostKey }),
         };
         const state = JSON.stringify(body);

package/dist/api.js

@@ -1,4 +1,9 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { signInAgain, updateRequired } from './end.js';
 import { readEnrolment } from './home.js';
+import { retryable } from './refusals.js';
+import { relayed } from './relay.js';
+import { KIT_WIRE, KIT_WIRE_HEADER, tooOld } from './wire.js';
 export class HouseRefusal extends Error {
     status;
     text;
@@ -8,27 +13,54 @@ export class HouseRefusal extends Error {
         this.text = text;
     }
 }
+export function finalRefusal(error) {
+    return error instanceof HouseRefusal && retryable(error.text) === false;
+}
 export function retryDelay(attempt) {
+    // Full jitter, doubling from one second to a 30-second cap, spreads the Kits one outage dropped and retries within half a minute of House's return.
     return Math.random() * Math.min(30_000, 1000 * 2 ** attempt);
 }
+export async function retrying(sent, signal, pause = retryDelay) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await sent();
+        }
+        catch (error) {
+            if (!(error instanceof HouseRefusal) || retryable(error.text) !== true)
+                throw error;
+        }
+        // A request House refused as retryable is sent again after the caller's pause, the jittered curve unless it names its own.
+        await delay(pause(attempt), undefined, { signal });
+    }
+}
 export async function post(house, path, body, credential, signal) {
-    const answer = await fetch(new URL(path, house), {
+    const answer = await fetch(relayed(new URL(path, house)), {
         method: 'POST',
         headers: {
             'content-type': 'application/json',
+            [KIT_WIRE_HEADER]: String(KIT_WIRE),
             ...(credential === undefined ? {} : { authorization: `Bearer ${credential}` }),
         },
         body: JSON.stringify(body),
         signal,
     });
     const text = await answer.text();
+    if (!answer.ok && tooOld(text))
+        updateRequired(house);
     if (!answer.ok)
         throw new HouseRefusal(path, answer.status, text);
     return JSON.parse(text);
 }
 async function enrolledPost(path, body, signal) {
     const { house, credential } = (await readEnrolment());
-    return post(house, path, body, credential, signal);
+    try {
+        return await post(house, path, body, credential, signal);
+    }
+    catch (error) {
+        if (error instanceof HouseRefusal && error.status === 401)
+            await signInAgain(credential);
+        throw error;
+    }
 }
 export const house = {
     post: enrolledPost,
@@ -38,9 +70,10 @@ export const house = {
                 return await enrolledPost(path, body);
             }
             catch (error) {
-                if (error instanceof HouseRefusal && error.status < 500)
+                if (finalRefusal(error))
                     throw error;
                 process.stderr.write(`kit: ${path} did not reach House: ${error.message}\n`);
+                // A delivery House did not take is sent again on the jittered curve for as long as it is still current.
                 await new Promise((resolve) => setTimeout(resolve, retryDelay(attempt)));
                 if (!current())
                     throw error;

package/dist/app-git.js

@@ -0,0 +1,64 @@
+import { extname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { run } from './git.js';
+import { kitHome, readOwnAgent } from './home.js';
+import { quoted } from './shell.js';
+function section(house) {
+    return `credential.${new URL('/app/', house).href}`;
+}
+function helper() {
+    const main = fileURLToPath(new URL(`./kit-main${extname(fileURLToPath(import.meta.url))}`, import.meta.url));
+    return `!HOUSE_KIT_HOME=${quoted(resolve(kitHome()))} ${quoted(process.execPath)} ${quoted(main)} git-credential`;
+}
+async function configured(args) {
+    try {
+        return await run(kitHome(), ['config', '--global', ...args]);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function forget(house) {
+    await configured(['--remove-section', section(house)]);
+}
+async function register(house) {
+    await forget(house);
+    for (const value of ['', helper()]) {
+        const ran = await configured(['--add', `${section(house)}.helper`, value]);
+        if (ran === null)
+            return;
+        if (ran.status !== 0)
+            throw new Error(`git config failed: ${ran.stderr.trim()}`);
+    }
+}
+export async function placeAppGit(before, after) {
+    if (before !== null && before.house !== after?.house)
+        await forget(before.house);
+    if (after !== null)
+        await register(after.house);
+}
+export async function forgetAppGit() {
+    const ownAgent = await readOwnAgent();
+    if (ownAgent !== null)
+        await forget(ownAgent.house);
+}
+export async function answerGitCredential(operation) {
+    let asked = '';
+    for await (const chunk of process.stdin)
+        asked += String(chunk);
+    if (operation !== 'get')
+        return;
+    const attributes = new Map(asked
+        .split('\n')
+        .filter((line) => line.includes('='))
+        .map((line) => [line.slice(0, line.indexOf('=')), line.slice(line.indexOf('=') + 1)]));
+    const ownAgent = await readOwnAgent();
+    if (ownAgent === null)
+        return;
+    const house = new URL(ownAgent.house);
+    if (attributes.get('protocol') !== house.protocol.slice(0, -1) || attributes.get('host') !== house.host)
+        return;
+    process.stdout.write(`username=house\npassword=${ownAgent.credential}\n`);
+}