@ai-codebot/daemon 0.1.0

package/dist/cli.js

@@ -0,0 +1,120 @@
+/**
+ * `codebot-daemon connect …` command wiring (design §3/§4).
+ *
+ * Parses + validates flags, wires the tunnel to the launch manager, and translates
+ * the terminal tunnel exit into a process exit code:
+ *   - 4401 unauth → exit 1 (dead key — don't hammer).
+ *   - 4409 superseded / `--once` done → exit 0 (clean).
+ *
+ * NEVER logs the api key. SIGINT/SIGTERM tears down all live launches first.
+ */
+import { ConfigError, parseConnectArgs } from "./config.js";
+import { LaunchManager } from "./launch.js";
+import { log } from "./logging.js";
+import { DISALLOWED_TOOLS } from "./spawn/disallowed-tools.js";
+import { makeProgress } from "./frames.js";
+import { runTunnel } from "./tunnel.js";
+export const DAEMON_VERSION = "0.1.0";
+// Advertised tools = the N2 toolset minus the blacklist (already excluded). This is
+// the scope-attestation seed the server stores; the broker is the real boundary.
+const ADVERTISED_TOOLS = [
+    "list_dir",
+    "read_file",
+    "write_file",
+    "replace_in_file",
+    "run_tests",
+];
+const USAGE = `codebot-daemon connect --server-url <wss://…/daemon/connect> --api-key <ck_machine_…>
+  [--repo <path>] [--model-url <url>] [--cli claude|codex|auto] [--once] [--insecure]
+
+Dials the cloud relay, runs local coding-agent launches through a 127.0.0.1
+capability broker, and reports results. The machine key may also be supplied via
+CODEBOT_MACHINE_KEY. The real model key is never handed to the agent.
+Disallowed tools (always stripped before spawn): ${DISALLOWED_TOOLS.join(", ")}.`;
+/** Entry for the `connect` subcommand. Returns the process exit code. */
+export async function runConnect(argv) {
+    let cfg;
+    try {
+        cfg = parseConnectArgs(argv);
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            process.stderr.write(`error: ${err.message}\n\n${USAGE}\n`);
+            return 2;
+        }
+        throw err;
+    }
+    const manager = new LaunchManager({
+        cliMode: cfg.cli,
+        modelUrlFallback: cfg.modelUrl,
+    });
+    // Tear down all live launches on signal (no orphan children / 0600 files).
+    const onSignal = (sig) => {
+        log.warn("daemon.signal", { signal: sig });
+        void manager.shutdownAll().finally(() => process.exit(0));
+    };
+    process.once("SIGINT", () => onSignal("SIGINT"));
+    process.once("SIGTERM", () => onSignal("SIGTERM"));
+    log.info("daemon.connect.start", {
+        server_url: cfg.serverUrl,
+        repo: cfg.repo,
+        cli: cfg.cli,
+        once: cfg.once,
+    });
+    const exit = await runTunnel({
+        serverUrl: cfg.serverUrl,
+        apiKey: cfg.apiKey,
+        daemonVersion: DAEMON_VERSION,
+        advertisedTools: ADVERTISED_TOOLS,
+        once: cfg.once,
+        onLaunch: async (launch, send) => {
+            log.info("daemon.launch.received", {
+                launch_id: launch.launch_id,
+                agent_id: launch.agent_id,
+            });
+            let result;
+            try {
+                result = await manager.run(launch, (stage) => {
+                    send(makeProgress(launch.launch_id, stage));
+                });
+            }
+            catch (err) {
+                // Defensive: manager.run already maps failures, but never let a throw escape
+                // without a terminal Result (零静默).
+                result = {
+                    type: "result",
+                    launch_id: launch.launch_id,
+                    status: "failed",
+                    error: `daemon error: ${err.message}`,
+                    cost_usd: null,
+                };
+            }
+            const frame = result;
+            send(frame);
+            log.info("daemon.launch.result", {
+                launch_id: launch.launch_id,
+                status: result.status,
+            });
+        },
+    });
+    if (exit.kind === "unauth") {
+        log.error("daemon.exit.unauthorized", {});
+        return 1;
+    }
+    log.info("daemon.exit", { reason: exit.kind });
+    return 0;
+}
+/** Top-level CLI dispatch. */
+export async function main(argv) {
+    const [sub, ...rest] = argv;
+    if (sub === "connect") {
+        return runConnect(rest);
+    }
+    if (sub === "--help" || sub === "-h" || sub === "help" || sub === undefined) {
+        process.stdout.write(`${USAGE}\n`);
+        return sub === undefined ? 2 : 0;
+    }
+    process.stderr.write(`error: unknown command '${sub}'\n\n${USAGE}\n`);
+    return 2;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAmC,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,oFAAoF;AACpF,iFAAiF;AACjF,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,WAAW;CACZ,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;mDAMqC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAElF,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,gBAAgB,EAAE,GAAG,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEnD,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC/B,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;QAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,cAAc;QAC7B,eAAe,EAAE,gBAAgB;QACjC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC/B,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC3C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9C,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,mCAAmC;gBACnC,MAAM,GAAG;oBACP,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;oBAChD,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAkB,MAAM,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,33 @@
+/**
+ * CLI argument parsing + fail-fast validation for the `connect` subcommand
+ * (design §3). NEVER logs `apiKey`.
+ *
+ *   codebot-daemon connect \
+ *     --server-url <wss://…/daemon/connect> \
+ *     --api-key <ck_machine_…> \
+ *     [--repo <path>] [--model-url <url>] [--cli claude|codex|auto] \
+ *     [--once] [--insecure]
+ *
+ * The api key may also come from `CODEBOT_MACHINE_KEY` (so it never has to appear
+ * in a shell history / process list).
+ */
+export declare const MACHINE_KEY_PREFIX = "ck_machine_";
+export declare const MACHINE_KEY_ENV = "CODEBOT_MACHINE_KEY";
+export type CliKind = "claude" | "codex" | "auto";
+export interface ConnectConfig {
+    readonly serverUrl: string;
+    readonly apiKey: string;
+    readonly repo: string;
+    readonly modelUrl: string | null;
+    readonly cli: CliKind;
+    readonly once: boolean;
+    readonly insecure: boolean;
+}
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Parse + validate the `connect` flags. Fails fast (throws `ConfigError`) on any
+ * invalid input. The api key is read from `--api-key` or `CODEBOT_MACHINE_KEY`.
+ */
+export declare function parseConnectArgs(argv: readonly string[], env?: NodeJS.ProcessEnv): ConnectConfig;

package/dist/config.js

@@ -0,0 +1,132 @@
+/**
+ * CLI argument parsing + fail-fast validation for the `connect` subcommand
+ * (design §3). NEVER logs `apiKey`.
+ *
+ *   codebot-daemon connect \
+ *     --server-url <wss://…/daemon/connect> \
+ *     --api-key <ck_machine_…> \
+ *     [--repo <path>] [--model-url <url>] [--cli claude|codex|auto] \
+ *     [--once] [--insecure]
+ *
+ * The api key may also come from `CODEBOT_MACHINE_KEY` (so it never has to appear
+ * in a shell history / process list).
+ */
+import { resolve } from "node:path";
+export const MACHINE_KEY_PREFIX = "ck_machine_";
+export const MACHINE_KEY_ENV = "CODEBOT_MACHINE_KEY";
+export class ConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfigError";
+    }
+}
+const CLI_KINDS = ["claude", "codex", "auto"];
+/** Parse `--flag value` / `--bool` tokens. Unknown flags are a fail-fast error. */
+function parseRawArgs(argv, booleanFlags) {
+    const out = {};
+    let i = 0;
+    while (i < argv.length) {
+        const tok = argv[i];
+        if (!tok.startsWith("--")) {
+            throw new ConfigError(`unexpected argument '${tok}' (flags must start with --)`);
+        }
+        const flag = tok.slice(2);
+        if (booleanFlags.has(flag)) {
+            out[flag] = true;
+            i += 1;
+            continue;
+        }
+        const value = argv[i + 1];
+        if (value === undefined || value.startsWith("--")) {
+            throw new ConfigError(`flag '--${flag}' requires a value`);
+        }
+        out[flag] = value;
+        i += 2;
+    }
+    return out;
+}
+const KNOWN_FLAGS = new Set([
+    "server-url",
+    "api-key",
+    "repo",
+    "model-url",
+    "cli",
+    "once",
+    "insecure",
+]);
+const BOOLEAN_FLAGS = new Set(["once", "insecure"]);
+/**
+ * Parse + validate the `connect` flags. Fails fast (throws `ConfigError`) on any
+ * invalid input. The api key is read from `--api-key` or `CODEBOT_MACHINE_KEY`.
+ */
+export function parseConnectArgs(argv, env = process.env) {
+    const raw = parseRawArgs(argv, BOOLEAN_FLAGS);
+    for (const flag of Object.keys(raw)) {
+        if (!KNOWN_FLAGS.has(flag)) {
+            throw new ConfigError(`unknown flag '--${flag}'`);
+        }
+    }
+    const serverUrl = typeof raw["server-url"] === "string" ? raw["server-url"] : "";
+    if (!serverUrl) {
+        throw new ConfigError("--server-url is required");
+    }
+    const insecure = raw["insecure"] === true;
+    if (!isValidServerUrl(serverUrl, insecure)) {
+        throw new ConfigError(insecure
+            ? "--server-url must be a ws:// or wss:// URL"
+            : "--server-url must be a wss:// URL (use --insecure for a localhost ws:// dev relay)");
+    }
+    const apiKey = (typeof raw["api-key"] === "string" ? raw["api-key"] : "") ||
+        env[MACHINE_KEY_ENV] ||
+        "";
+    if (!apiKey) {
+        throw new ConfigError(`--api-key is required (or set ${MACHINE_KEY_ENV})`);
+    }
+    if (!apiKey.startsWith(MACHINE_KEY_PREFIX)) {
+        // Note: we validate the PREFIX, never the value, and never echo the key.
+        throw new ConfigError(`--api-key must start with '${MACHINE_KEY_PREFIX}'`);
+    }
+    const repoRaw = typeof raw["repo"] === "string" ? raw["repo"] : process.cwd();
+    const repo = resolve(repoRaw);
+    const modelUrl = typeof raw["model-url"] === "string" ? raw["model-url"] : null;
+    if (modelUrl !== null && !isValidHttpUrl(modelUrl)) {
+        throw new ConfigError("--model-url must be an http(s):// URL");
+    }
+    const cliRaw = typeof raw["cli"] === "string" ? raw["cli"] : "auto";
+    if (!CLI_KINDS.includes(cliRaw)) {
+        throw new ConfigError(`--cli must be one of ${CLI_KINDS.join("|")}`);
+    }
+    return {
+        serverUrl,
+        apiKey,
+        repo,
+        modelUrl,
+        cli: cliRaw,
+        once: raw["once"] === true,
+        insecure,
+    };
+}
+function isValidServerUrl(value, insecure) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === "wss:")
+        return true;
+    if (insecure && url.protocol === "ws:")
+        return true;
+    return false;
+}
+function isValidHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === "http:" || url.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAcrD,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,SAAS,GAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAMlE,mFAAmF;AACnF,SAAS,YAAY,CACnB,IAAuB,EACvB,YAAiC;IAEjC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CACnB,wBAAwB,GAAG,8BAA8B,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAClB,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,YAAY;IACZ,SAAS;IACT,MAAM;IACN,WAAW;IACX,KAAK;IACL,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACnB,QAAQ;YACN,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,oFAAoF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,eAAe,CAAC;QACpB,EAAE,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,WAAW,CAAC,iCAAiC,eAAe,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,IAAI,WAAW,CAAC,8BAA8B,kBAAkB,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAiB,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,wBAAwB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,SAAS;QACT,MAAM;QACN,IAAI;QACJ,QAAQ;QACR,GAAG,EAAE,MAAiB;QACtB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;QAC1B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAiB;IACxD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/frames.d.ts

@@ -0,0 +1,311 @@
+/**
+ * Wire frame protocol for `/daemon/connect` — TS mirror of the server's
+ * `daemon_frames.py` (PR2). Field-for-field, snake_case keys.
+ *
+ * Directionality (matches the Python contract):
+ *   - Server -> daemon (INBOUND, zod-validated at the boundary):
+ *       HelloAck, Launch, Ping, ServerError
+ *   - Daemon -> server (OUTBOUND, constructed by us, trusted):
+ *       Hello, Progress, Result, Pong
+ *
+ * The server validates the daemon->server direction; we validate the
+ * server->daemon direction. `parseInbound` is the boundary validator: an unknown
+ * `type` or a malformed field throws a `ZodError` the receive loop catches and
+ * ignores (never crashes the loop) — mirroring `parse_inbound`.
+ *
+ * Secrets: `ModelOverride.api_key` is a custom-provider credential — NEVER logged.
+ */
+import { z } from "zod";
+/**
+ * Largest frame we accept (design §8.7 / `daemon_frames.MAX_FRAME_BYTES`): 256 KiB.
+ * Used as the `ws` `maxPayload`. Must equal the server's ceiling field-for-field.
+ */
+export declare const MAX_FRAME_BYTES: number;
+/** Terminal launch outcomes a daemon may report (`Result.status`). */
+export declare const RESULT_STATUSES: readonly ["succeeded", "failed", "timed_out"];
+export type ResultStatus = (typeof RESULT_STATUSES)[number];
+/** Custom-provider model override carried on a Launch (C4/C8). `apiKey` is secret. */
+export declare const ModelOverrideSchema: z.ZodObject<{
+    kind: z.ZodDefault<z.ZodLiteral<"custom">>;
+    api_url: z.ZodString;
+    api_key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    api_key: string;
+    kind: "custom";
+    api_url: string;
+}, {
+    api_key: string;
+    api_url: string;
+    kind?: "custom" | undefined;
+}>;
+export type ModelOverride = z.infer<typeof ModelOverrideSchema>;
+export declare const HelloAckSchema: z.ZodObject<{
+    type: z.ZodLiteral<"hello_ack">;
+    machine_id: z.ZodString;
+    server_time: z.ZodString;
+    heartbeat_interval_s: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "hello_ack";
+    machine_id: string;
+    server_time: string;
+    heartbeat_interval_s: number;
+}, {
+    type: "hello_ack";
+    machine_id: string;
+    server_time: string;
+    heartbeat_interval_s: number;
+}>;
+export type HelloAck = z.infer<typeof HelloAckSchema>;
+export declare const LaunchSchema: z.ZodObject<{
+    type: z.ZodLiteral<"launch">;
+    launch_id: z.ZodString;
+    agent_id: z.ZodString;
+    prompt: z.ZodString;
+    repo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model_override: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        kind: z.ZodDefault<z.ZodLiteral<"custom">>;
+        api_url: z.ZodString;
+        api_key: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        api_key: string;
+        kind: "custom";
+        api_url: string;
+    }, {
+        api_key: string;
+        api_url: string;
+        kind?: "custom" | undefined;
+    }>>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    deadline_s: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "launch";
+    launch_id: string;
+    agent_id: string;
+    prompt: string;
+    capabilities: string[];
+    deadline_s: number;
+    repo?: string | null | undefined;
+    model_override?: {
+        api_key: string;
+        kind: "custom";
+        api_url: string;
+    } | null | undefined;
+}, {
+    type: "launch";
+    launch_id: string;
+    agent_id: string;
+    prompt: string;
+    deadline_s: number;
+    repo?: string | null | undefined;
+    model_override?: {
+        api_key: string;
+        api_url: string;
+        kind?: "custom" | undefined;
+    } | null | undefined;
+    capabilities?: string[] | undefined;
+}>;
+export type Launch = z.infer<typeof LaunchSchema>;
+export declare const PingSchema: z.ZodObject<{
+    type: z.ZodLiteral<"ping">;
+    nonce: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "ping";
+    nonce: string;
+}, {
+    type: "ping";
+    nonce: string;
+}>;
+export type Ping = z.infer<typeof PingSchema>;
+export declare const ServerErrorSchema: z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    detail: z.ZodString;
+    launch_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    type: "error";
+    detail: string;
+    launch_id?: string | null | undefined;
+}, {
+    code: string;
+    type: "error";
+    detail: string;
+    launch_id?: string | null | undefined;
+}>;
+export type ServerError = z.infer<typeof ServerErrorSchema>;
+/** Discriminated union of every frame the SERVER may send us (inbound). */
+export declare const InboundFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"hello_ack">;
+    machine_id: z.ZodString;
+    server_time: z.ZodString;
+    heartbeat_interval_s: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "hello_ack";
+    machine_id: string;
+    server_time: string;
+    heartbeat_interval_s: number;
+}, {
+    type: "hello_ack";
+    machine_id: string;
+    server_time: string;
+    heartbeat_interval_s: number;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"launch">;
+    launch_id: z.ZodString;
+    agent_id: z.ZodString;
+    prompt: z.ZodString;
+    repo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model_override: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        kind: z.ZodDefault<z.ZodLiteral<"custom">>;
+        api_url: z.ZodString;
+        api_key: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        api_key: string;
+        kind: "custom";
+        api_url: string;
+    }, {
+        api_key: string;
+        api_url: string;
+        kind?: "custom" | undefined;
+    }>>>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    deadline_s: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "launch";
+    launch_id: string;
+    agent_id: string;
+    prompt: string;
+    capabilities: string[];
+    deadline_s: number;
+    repo?: string | null | undefined;
+    model_override?: {
+        api_key: string;
+        kind: "custom";
+        api_url: string;
+    } | null | undefined;
+}, {
+    type: "launch";
+    launch_id: string;
+    agent_id: string;
+    prompt: string;
+    deadline_s: number;
+    repo?: string | null | undefined;
+    model_override?: {
+        api_key: string;
+        api_url: string;
+        kind?: "custom" | undefined;
+    } | null | undefined;
+    capabilities?: string[] | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"ping">;
+    nonce: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "ping";
+    nonce: string;
+}, {
+    type: "ping";
+    nonce: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    detail: z.ZodString;
+    launch_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    type: "error";
+    detail: string;
+    launch_id?: string | null | undefined;
+}, {
+    code: string;
+    type: "error";
+    detail: string;
+    launch_id?: string | null | undefined;
+}>]>;
+export type InboundFrame = z.infer<typeof InboundFrameSchema>;
+export declare const HELLO_MAX_TOOL_LEN = 200;
+export declare const HELLO_MAX_TOOLS = 100;
+export declare const HELLO_MAX_VERSION_LEN = 200;
+export declare const HelloSchema: z.ZodObject<{
+    type: z.ZodLiteral<"hello">;
+    daemon_version: z.ZodString;
+    advertised_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: "hello";
+    daemon_version: string;
+    advertised_tools: string[];
+}, {
+    type: "hello";
+    daemon_version: string;
+    advertised_tools?: string[] | undefined;
+}>;
+export type Hello = z.infer<typeof HelloSchema>;
+export declare const ProgressSchema: z.ZodObject<{
+    type: z.ZodLiteral<"progress">;
+    launch_id: z.ZodString;
+    stage: z.ZodString;
+    message: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    type: "progress";
+    launch_id: string;
+    stage: string;
+}, {
+    type: "progress";
+    launch_id: string;
+    stage: string;
+    message?: string | undefined;
+}>;
+export type Progress = z.infer<typeof ProgressSchema>;
+export declare const ResultSchema: z.ZodObject<{
+    type: z.ZodLiteral<"result">;
+    launch_id: z.ZodString;
+    status: z.ZodEnum<["succeeded", "failed", "timed_out"]>;
+    text: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    diff: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    files: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString, "many">>>;
+    cost_usd: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    tokens: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    type: "result";
+    status: "succeeded" | "failed" | "timed_out";
+    launch_id: string;
+    error?: string | null | undefined;
+    diff?: string | null | undefined;
+    files?: string[] | null | undefined;
+    text?: string | null | undefined;
+    cost_usd?: number | null | undefined;
+    tokens?: number | null | undefined;
+}, {
+    type: "result";
+    status: "succeeded" | "failed" | "timed_out";
+    launch_id: string;
+    error?: string | null | undefined;
+    diff?: string | null | undefined;
+    files?: string[] | null | undefined;
+    text?: string | null | undefined;
+    cost_usd?: number | null | undefined;
+    tokens?: number | null | undefined;
+}>;
+export type Result = z.infer<typeof ResultSchema>;
+export declare const PongSchema: z.ZodObject<{
+    type: z.ZodLiteral<"pong">;
+    nonce: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "pong";
+    nonce: string;
+}, {
+    type: "pong";
+    nonce: string;
+}>;
+export type Pong = z.infer<typeof PongSchema>;
+export type OutboundFrame = Hello | Progress | Result | Pong;
+/**
+ * Validate one decoded server->daemon message at the boundary (mirrors
+ * `parse_inbound`). Throws `ZodError` on an unknown `type` or any malformed
+ * field; the receive loop catches it, logs, and ignores the frame.
+ */
+export declare function parseInbound(raw: unknown): InboundFrame;
+export declare function makeHello(daemonVersion: string, advertisedTools?: string[]): Hello;
+export declare function makePong(nonce: string): Pong;
+export declare function makeProgress(launchId: string, stage: string, message?: string): Progress;