@aglit-ai/cli 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/model-connections.cjs

@@ -0,0 +1,109 @@
+'use strict';
+/** UI-free selection policy lives in runtime-api; the CLI prompts only on its
+ * explicit choice-required result, then persists the choice through native control. */
+async function listModelConnections(control) {
+  try {
+    const view = await control('models-list');
+    if (!view || !Array.isArray(view.connections) || !view.selection || typeof view.selection.status !== 'string') throw Error('Invalid discovery response');
+    return view;
+  } catch {
+    return { connections: [], selection: { status: 'discovery-unavailable', connection_id: null },
+      warnings: ['Model endpoint discovery is unavailable. Existing provider settings are unchanged; retry aglit models list later.'] };
+  }
+}
+async function chooseModelConnection(control, { provider, question } = {}) {
+  let view = await listModelConnections(control);
+  if (view.selection.status === 'discovery-unavailable') return { view, connectionId: null, unavailable: true };
+  // Init/choose is an explicit connection action. Passive models-list never
+  // prompts; reconnect only the saved/chosen endpoint, never every known host.
+  if (['preferred-unavailable','setup-required'].includes(view.selection.status)) {
+    const remote = view.connections.filter(value => value.kind === 'remote');
+    let target = view.preferred_connection_id ? remote.find(value => value.id === view.preferred_connection_id) : remote.length === 1 ? remote[0] : undefined;
+    let chosen = false;
+    if (!target && !view.preferred_connection_id && remote.length > 1) {
+      if (!question) throw Error('More than one model connection is available. Run aglit models choose.');
+      const answer = (await question(remote.map((value,index)=>`${index+1}. ${value.name}`).join('\n')+'\nModel connection: ')).trim();
+      if (!/^[1-9]\d*$/.test(answer) || !remote[Number(answer)-1]) throw Error('Choose a listed model connection');
+      target = remote[Number(answer)-1]; chosen = true;
+    }
+    if (target) {
+      view = await modelCommand(control,'register',undefined,{device:target.device_id,fingerprint:target.identity_fingerprint,name:target.name},question);
+      if (chosen) view = await control('models-prefer',{connection_id:target.id});
+    }
+  }
+  let selection = view.selection;
+  if (provider && provider !== 'auto' && provider !== 'aglit') {
+    const candidates = view.connections.filter(value => value.available && value.models.some(model => model.provider === provider));
+    if (candidates.length === 1) {
+      view = await control('models-prefer', { connection_id: candidates[0].id }); selection = view.selection;
+    } else if (!candidates.length) throw Error('No connected account supplies that provider');
+    else { view = { ...view, connections: candidates }; selection = { status: 'choice-required', connection_id: null }; }
+  }
+  if (selection.status === 'choice-required') {
+    if (!question) throw Error('More than one model connection is available. Run aglit models choose or aglit models prefer CONNECTION_ID.');
+    const choices = view.connections.filter(value => value.available && value.models.length);
+    const answer = await question(choices.map((value,index)=>`${index+1}. ${value.name}`).join('\n')+'\nModel connection: ');
+    if (!/^[1-9]\d*$/.test(answer.trim()) || !choices[Number(answer.trim())-1]) throw Error('Choose a listed model connection');
+    view = await control('models-prefer', { connection_id: choices[Number(answer.trim())-1].id }); selection = view.selection;
+  }
+  if (selection.status === 'preferred-unavailable') throw Error('Your saved model connection is unavailable. Reconnect it or explicitly choose another with aglit models prefer CONNECTION_ID.');
+  if (selection.status !== 'selected') throw Error('No model connection is ready. Connect a local provider or register an Aglit model endpoint.');
+  return { view, connectionId: selection.connection_id };
+}
+function validateModelCommand(command, id, values) {
+  const allowed = {list:['json'],test:['connection','model','harness'],choose:[],pool:['name','connections'],publish:['connection','model'],unpublish:['connection','model'],unserve:[],register:['device','fingerprint','name','challenge','code'],prefer:[],remove:[]};
+  if (!Object.hasOwn(allowed,command) || Object.keys(values).some(key=>!allowed[command].includes(key)) ||
+      (!['prefer','remove','pool'].includes(command) && id) || (['prefer','remove','pool'].includes(command) && !id)) throw Error('Invalid model command or options');
+  if (command === 'pool' && (!/^[A-Za-z0-9._-]{1,80}$/.test(id) || !values.name?.trim() || values.name.length > 100 ||
+      typeof values.connections !== 'string' || values.connections.length > 6400 || !values.connections.split(',').every(value => /^local:[A-Za-z0-9._:-]{1,180}$/.test(value) && !value.startsWith('local:pool:'))))
+    throw Error('Use aglit models pool POOL_ID --name NAME --connections local:ACCOUNT_A,local:ACCOUNT_B');
+  if (command === 'register' && (!/^[A-Za-z0-9._:-]{1,180}$/.test(values.device || '') || !/^[a-f0-9]{64}$/.test(values.fingerprint || '')))
+    throw Error('Use --device DEVICE_ID and --fingerprint with the endpoint SHA-256 fingerprint');
+  if (Boolean(values.challenge) !== Boolean(values.code) || values.code && !/^[0-9]{4,12}$/.test(values.code) ||
+      values.challenge && (!/^[A-Za-z0-9._:-]{1,256}$/.test(values.challenge))) throw Error('Supply both --challenge and a numeric --code');
+  if (id && !/^[A-Za-z0-9._:-]{1,200}$/.test(id)) throw Error('Invalid model connection ID');
+  if (['publish','unpublish'].includes(command) && (!/^local:[A-Za-z0-9._:-]{1,180}$/.test(values.connection||'') || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/.test(values.model||''))) throw Error('Choose a local --connection and --model');
+  if (command === 'remove' && !id.startsWith('remote:')) throw Error('A registered remote connection ID is required');
+}
+async function modelCommand(control, command, id, values, question) {
+  validateModelCommand(command,id,values);
+  if (command === 'list') return listModelConnections(control);
+  if (command === 'test') {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/.test(values.model || '') || values.connection && !/^[A-Za-z0-9._:-]{1,200}$/.test(values.connection)) throw Error('Use aglit models test --model MODEL_ID [--connection CONNECTION_ID]');
+    return control('models-test', { model_id: values.model, ...(values.connection ? { connection_id: values.connection } : {}), ...(values.harness ? { harness: 'true' } : {}) });
+  }
+  if (command === 'pool') return control('models-pool-save', { pool_id: 'local:pool:' + id, name: values.name,
+    connection_ids: JSON.stringify(values.connections.split(',')) });
+  if (command === 'register') {
+    if (!values.device || !values.fingerprint || id) throw Error('Use aglit models register --device DEVICE_ID --fingerprint SHA256 [--name NAME]');
+    if (Boolean(values.challenge) !== Boolean(values.code) || values.code && !/^[0-9]{4,12}$/.test(values.code)) throw Error('Supply both --challenge and a numeric --code');
+    const fields = {device_id:values.device,identity_fingerprint:values.fingerprint,name:values.name||values.device, ...(values.challenge ? {challenge_id:values.challenge,code:values.code} : {})};
+    let result = await control('models-register',fields);
+    let consoleUrl;
+    if (typeof result.console_url === 'string') {
+      try { const url = new URL(result.console_url);
+        if ((url.protocol === 'https:' || process.env.NODE_ENV === 'development' && url.protocol === 'http:' && url.hostname === '127.0.0.1') &&
+            !url.username && !url.password && !url.search && !url.hash && url.pathname === '/employees/' + encodeURIComponent(values.device)) consoleUrl = url.href;
+      } catch { /* Never present an unvalidated authentication destination. */ }
+    }
+    const instructions = `A security-code dialog appears on ${fields.name}. Check that device.` +
+      (consoleUrl ? ` Open its console on that device if needed: ${consoleUrl}` : '');
+    if (result.authentication_required && result.challenge_id && question) {
+      const code = (await question(instructions + '\nRemote Access authentication code: ')).trim();
+      if (!/^[0-9]{4,12}$/.test(code)) throw Error('A numeric Remote Access code is required');
+      result = await control('models-register',{...fields,challenge_id:result.challenge_id,code});
+    }
+    if (result.authentication_required) throw Error(instructions + ' Complete registration with --challenge CHALLENGE_ID --code CODE' +
+      (result.challenge_id ? ' (challenge '+result.challenge_id+')' : ''));
+    return result;
+  }
+  if (command === 'prefer' || command === 'remove') {
+    if (!id || !/^[A-Za-z0-9._:-]{1,200}$/.test(id)) throw Error('A model connection ID is required');
+    return control(command==='prefer'?'models-prefer':'models-remove',{connection_id:command==='prefer'&&id==='auto'?'':id});
+  }
+  if (command === 'publish' || command === 'unpublish') return control('models-publish',{connection_id:values.connection,model_id:values.model,published:String(command==='publish')});
+  if (command === 'unserve') return control('models-unpublish-all');
+  if (command === 'choose') return (await chooseModelConnection(control,{question})).view;
+  throw Error('Use aglit models list|register|prefer|remove|publish|unpublish|unserve|choose');
+}
+module.exports={chooseModelConnection,listModelConnections,modelCommand,validateModelCommand};

package/src/runtime-download.cjs

@@ -0,0 +1,77 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const { execFile } = require('node:child_process');
+const { promisify } = require('node:util');
+const run = promisify(execFile);
+const need = (value, message) => { if (!value) throw Error(message); };
+
+// Read a single payload from a verified npm tarball. Native tar writes only to
+// stdout: package paths, links and lifecycle scripts never write into the guest.
+async function packageFile(manifest, file, maximum, signal = AbortSignal.timeout(120000)) {
+  const url = new URL(manifest.dist.tarball);
+  need(url.protocol === 'https:' && url.hostname === 'registry.npmjs.org' && !url.port && !url.username && !url.password &&
+    /^sha512-[A-Za-z0-9+/]{86}==$/.test(manifest.dist.integrity), 'Untrusted runtime npm package');
+  need(['runtime/desktop-runtime.json', 'runtime/part.bin'].includes(file), 'Unknown runtime payload');
+  const directory = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'aglit-runtime-'));
+  const archive = path.join(directory, 'package.tgz');
+  try {
+    const response = await fetch(url, {redirect: 'error', signal: AbortSignal.any([signal, AbortSignal.timeout(120000)])});
+    need(response.ok && response.body, 'Runtime npm download unavailable');
+    const fd = fs.openSync(archive, 'wx', 0o600), digest = crypto.createHash('sha512');
+    let size = 0;
+    try {
+      for await (const chunk of response.body) {
+        size += chunk.length; need(size <= maximum + 2 * 1024 ** 2, 'Runtime npm package exceeds limit');
+        digest.update(chunk);
+        let offset = 0;
+        while (offset < chunk.length) offset += fs.writeSync(fd, chunk, offset, chunk.length - offset);
+      }
+      need('sha512-' + digest.digest('base64') === manifest.dist.integrity, 'Runtime npm integrity differs');
+    } finally { fs.closeSync(fd); }
+    const tar = process.platform === 'win32' ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/tar.exe') : '/usr/bin/tar';
+    const {stdout} = await run(tar, ['-xOf', archive, 'package/' + file], {encoding: 'buffer', maxBuffer: maximum + 1, timeout: 30000, windowsHide: true});
+    need(stdout.length > 0 && stdout.length <= maximum, 'Runtime payload exceeds limit');
+    return stdout;
+  } finally { fs.rmSync(directory, {recursive: true, force: true}); }
+}
+
+// The same verified part stream feeds normal downloads and native baseline
+// admission, whose existing descriptor custody stays owned by its native worker.
+async function* archiveParts({descriptor, parts, signal}) {
+  need(parts.length === descriptor.chunks.length && parts.length > 0 && parts.length <= 32, 'Runtime part graph differs');
+  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
+  let received = 0;
+  for (const [index, part] of descriptor.chunks.entries()) {
+    need(parts[index].name === part.package && parts[index].version === part.version, 'Runtime part identity differs');
+    const bytes = await packageFile(parts[index], part.file, part.size, signal);
+    need(bytes.length === part.size && crypto.createHash('sha256').update(bytes).digest('hex') === part.sha256 &&
+      crypto.createHash('sha512').update(bytes).digest('base64') === part.sha512, 'Runtime part checksum differs');
+    received += bytes.length; sha256.update(bytes); sha512.update(bytes);
+    yield bytes;
+  }
+  need(received === descriptor.archive.size && sha256.digest('hex') === descriptor.archive.sha256 &&
+    sha512.digest('base64') === descriptor.archive.sha512, 'Runtime archive checksum differs');
+}
+
+async function downloadArchive({descriptor, parts, destination, onProgress = () => {}}) {
+  const fd = fs.openSync(destination, 'wx', 0o600), owned = fs.fstatSync(fd);
+  let received = 0, verified = false;
+  try {
+    for await (const bytes of archiveParts({descriptor, parts})) {
+      let offset = 0;
+      while (offset < bytes.length) offset += fs.writeSync(fd, bytes, offset, bytes.length - offset);
+      received += bytes.length; onProgress(received);
+    }
+    fs.fsyncSync(fd); verified = true;
+  } finally {
+    fs.closeSync(fd);
+    if (!verified) {
+      const current = fs.lstatSync(destination);
+      if (current.dev === owned.dev && current.ino === owned.ino && current.isFile() && !current.isSymbolicLink()) fs.unlinkSync(destination);
+    }
+  }
+}
+module.exports = {packageFile, archiveParts, downloadArchive};