@annals/agent-bridge 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/index.js

@@ -0,0 +1,1347 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { program } from "commander";
+
+// src/utils/config.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CONFIG_DIR = join(homedir(), ".agent-bridge");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+function ensureDir() {
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  }
+}
+function loadConfig() {
+  try {
+    const raw = readFileSync(CONFIG_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  ensureDir();
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+}
+function updateConfig(partial) {
+  const existing = loadConfig();
+  saveConfig({ ...existing, ...partial });
+}
+function getConfigPath() {
+  return CONFIG_FILE;
+}
+
+// src/platform/auth.ts
+function loadToken() {
+  return loadConfig().token;
+}
+function saveToken(token) {
+  updateConfig({ token });
+}
+function hasToken() {
+  return !!loadToken();
+}
+
+// src/platform/ws-client.ts
+import { EventEmitter } from "events";
+import WebSocket from "ws";
+import { BRIDGE_PROTOCOL_VERSION } from "@annals/bridge-protocol";
+
+// src/utils/logger.ts
+var RESET = "\x1B[0m";
+var RED = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var BLUE = "\x1B[34m";
+var GRAY = "\x1B[90m";
+var BOLD = "\x1B[1m";
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
+}
+var log = {
+  info(msg, ...args) {
+    console.log(`${GRAY}${timestamp()}${RESET} ${BLUE}INFO${RESET}  ${msg}`, ...args);
+  },
+  success(msg, ...args) {
+    console.log(`${GRAY}${timestamp()}${RESET} ${GREEN}OK${RESET}    ${msg}`, ...args);
+  },
+  warn(msg, ...args) {
+    console.warn(`${GRAY}${timestamp()}${RESET} ${YELLOW}WARN${RESET}  ${msg}`, ...args);
+  },
+  error(msg, ...args) {
+    console.error(`${GRAY}${timestamp()}${RESET} ${RED}ERROR${RESET} ${msg}`, ...args);
+  },
+  debug(msg, ...args) {
+    if (process.env.DEBUG) {
+      console.log(`${GRAY}${timestamp()} DEBUG ${msg}${RESET}`, ...args);
+    }
+  },
+  banner(text) {
+    console.log(`
+${BOLD}${text}${RESET}
+`);
+  }
+};
+
+// src/platform/ws-client.ts
+var HEARTBEAT_INTERVAL = 3e4;
+var INITIAL_RECONNECT_DELAY = 1e3;
+var MAX_RECONNECT_DELAY = 3e4;
+var BridgeWSClient = class extends EventEmitter {
+  ws = null;
+  heartbeatTimer = null;
+  reconnectTimer = null;
+  reconnectDelay = INITIAL_RECONNECT_DELAY;
+  startTime = Date.now();
+  activeSessions = 0;
+  intentionalClose = false;
+  registered = false;
+  opts;
+  constructor(opts) {
+    super();
+    this.opts = opts;
+  }
+  async connect() {
+    return new Promise((resolve, reject) => {
+      this.intentionalClose = false;
+      this.registered = false;
+      try {
+        const wsUrl = new URL(this.opts.url);
+        wsUrl.searchParams.set("agent_id", this.opts.agentId);
+        this.ws = new WebSocket(wsUrl.toString());
+      } catch (err) {
+        reject(new Error(`Failed to create WebSocket: ${err}`));
+        return;
+      }
+      const onFirstRegistered = (msg) => {
+        if (msg.type === "registered") {
+          this.off("_raw", onFirstRegistered);
+          if (msg.status === "ok") {
+            this.registered = true;
+            this.reconnectDelay = INITIAL_RECONNECT_DELAY;
+            this.startHeartbeat();
+            resolve();
+          } else {
+            reject(new Error(`Registration failed: ${msg.error || "unknown"}`));
+          }
+        }
+      };
+      this.on("_raw", onFirstRegistered);
+      this.ws.on("open", () => {
+        log.debug("WebSocket connected, sending register...");
+        const reg = {
+          type: "register",
+          agent_id: this.opts.agentId,
+          token: this.opts.token,
+          bridge_version: String(BRIDGE_PROTOCOL_VERSION),
+          agent_type: this.opts.agentType,
+          capabilities: this.opts.capabilities || []
+        };
+        this.ws.send(JSON.stringify(reg));
+      });
+      this.ws.on("message", (data) => {
+        try {
+          const msg = JSON.parse(data.toString());
+          this.emit("_raw", msg);
+          if (this.registered) {
+            this.emit("message", msg);
+          }
+        } catch {
+          log.debug("Failed to parse message from worker");
+        }
+      });
+      this.ws.on("close", (code, reason) => {
+        this.stopHeartbeat();
+        this.registered = false;
+        if (this.intentionalClose) {
+          log.info("Connection closed");
+          this.emit("close");
+        } else {
+          log.warn(`Connection lost (${code}: ${reason}), reconnecting in ${this.reconnectDelay}ms...`);
+          this.emit("disconnect");
+          this.scheduleReconnect();
+        }
+      });
+      this.ws.on("error", (err) => {
+        log.error(`WebSocket error: ${err.message}`);
+        this.emit("error", err);
+      });
+      setTimeout(() => {
+        if (!this.registered) {
+          this.off("_raw", onFirstRegistered);
+          reject(new Error("Registration timed out"));
+          this.ws?.close();
+        }
+      }, 15e3);
+    });
+  }
+  send(msg) {
+    if (this.ws && this.ws.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify(msg));
+    } else {
+      log.warn("Cannot send: WebSocket not connected");
+    }
+  }
+  onMessage(cb) {
+    this.on("message", cb);
+  }
+  setActiveSessions(count) {
+    this.activeSessions = count;
+  }
+  close() {
+    this.intentionalClose = true;
+    this.stopHeartbeat();
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.ws) {
+      this.ws.close();
+      this.ws = null;
+    }
+  }
+  get isConnected() {
+    return this.registered && this.ws?.readyState === WebSocket.OPEN;
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      this.send({
+        type: "heartbeat",
+        active_sessions: this.activeSessions,
+        uptime_ms: Date.now() - this.startTime
+      });
+    }, HEARTBEAT_INTERVAL);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  scheduleReconnect() {
+    if (this.reconnectTimer) return;
+    this.reconnectTimer = setTimeout(async () => {
+      this.reconnectTimer = null;
+      if (this.ws) {
+        try {
+          this.ws.close();
+        } catch {
+        }
+        this.ws = null;
+      }
+      try {
+        log.info("Attempting reconnect...");
+        await this.connect();
+        log.success("Reconnected to bridge worker");
+        this.emit("reconnect");
+      } catch (err) {
+        log.error(`Reconnect failed: ${err}`);
+        this.reconnectDelay = Math.min(this.reconnectDelay * 2, MAX_RECONNECT_DELAY);
+        this.scheduleReconnect();
+      }
+    }, this.reconnectDelay);
+  }
+};
+
+// src/bridge/manager.ts
+import { BridgeErrorCode } from "@annals/bridge-protocol";
+
+// src/bridge/session-pool.ts
+var SessionPool = class {
+  sessions = /* @__PURE__ */ new Map();
+  get(sessionId) {
+    const entry = this.sessions.get(sessionId);
+    if (entry) {
+      entry.lastActiveAt = Date.now();
+    }
+    return entry?.handle;
+  }
+  set(sessionId, handle) {
+    const now = Date.now();
+    this.sessions.set(sessionId, {
+      sessionId,
+      handle,
+      createdAt: now,
+      lastActiveAt: now
+    });
+  }
+  delete(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  has(sessionId) {
+    return this.sessions.has(sessionId);
+  }
+  get size() {
+    return this.sessions.size;
+  }
+  clear() {
+    for (const [id, entry] of this.sessions) {
+      log.debug(`Cleaning up session ${id}`);
+      entry.handle.kill();
+    }
+    this.sessions.clear();
+  }
+  keys() {
+    return this.sessions.keys();
+  }
+};
+
+// src/bridge/manager.ts
+var BridgeManager = class {
+  wsClient;
+  adapter;
+  adapterConfig;
+  pool = new SessionPool();
+  constructor(opts) {
+    this.wsClient = opts.wsClient;
+    this.adapter = opts.adapter;
+    this.adapterConfig = opts.adapterConfig;
+  }
+  start() {
+    this.wsClient.onMessage((msg) => this.handleWorkerMessage(msg));
+    log.info(`Bridge manager started with ${this.adapter.displayName} adapter`);
+  }
+  stop() {
+    this.pool.clear();
+    log.info("Bridge manager stopped");
+  }
+  get sessionCount() {
+    return this.pool.size;
+  }
+  handleWorkerMessage(msg) {
+    switch (msg.type) {
+      case "message":
+        this.handleMessage(msg);
+        break;
+      case "cancel":
+        this.handleCancel(msg);
+        break;
+      case "registered":
+        break;
+      default:
+        log.warn(`Unknown message type from worker: ${msg.type}`);
+    }
+  }
+  handleMessage(msg) {
+    const { session_id, request_id, content, attachments } = msg;
+    log.info(`Message received: session=${session_id.slice(0, 8)}... request=${request_id.slice(0, 8)}...`);
+    let handle = this.pool.get(session_id);
+    if (!handle) {
+      try {
+        handle = this.adapter.createSession(session_id, this.adapterConfig);
+        this.pool.set(session_id, handle);
+        this.updateSessionCount();
+      } catch (err) {
+        log.error(`Failed to create session: ${err}`);
+        this.sendError(session_id, request_id, BridgeErrorCode.ADAPTER_CRASH, `Failed to create session: ${err}`);
+        return;
+      }
+    }
+    this.wireSession(handle, session_id, request_id);
+    try {
+      handle.send(content, attachments);
+    } catch (err) {
+      log.error(`Failed to send to adapter: ${err}`);
+      this.sendError(session_id, request_id, BridgeErrorCode.ADAPTER_CRASH, `Adapter send failed: ${err}`);
+    }
+  }
+  wireSession(handle, sessionId, requestId) {
+    handle.onChunk((delta) => {
+      const chunk = {
+        type: "chunk",
+        session_id: sessionId,
+        request_id: requestId,
+        delta
+      };
+      this.wsClient.send(chunk);
+    });
+    handle.onDone(() => {
+      const done = {
+        type: "done",
+        session_id: sessionId,
+        request_id: requestId
+      };
+      this.wsClient.send(done);
+      log.info(`Request done: session=${sessionId.slice(0, 8)}... request=${requestId.slice(0, 8)}...`);
+    });
+    handle.onError((err) => {
+      log.error(`Adapter error (session=${sessionId.slice(0, 8)}...): ${err.message}`);
+      this.sendError(sessionId, requestId, BridgeErrorCode.ADAPTER_CRASH, err.message);
+    });
+  }
+  handleCancel(msg) {
+    const { session_id } = msg;
+    log.info(`Cancel received: session=${session_id.slice(0, 8)}...`);
+    const handle = this.pool.get(session_id);
+    if (handle) {
+      handle.kill();
+      this.adapter.destroySession(session_id);
+      this.pool.delete(session_id);
+      this.updateSessionCount();
+    }
+  }
+  sendError(sessionId, requestId, code, message) {
+    const err = {
+      type: "error",
+      session_id: sessionId,
+      request_id: requestId,
+      code,
+      message
+    };
+    this.wsClient.send(err);
+  }
+  updateSessionCount() {
+    this.wsClient.setActiveSessions(this.pool.size);
+  }
+};
+
+// src/adapters/openclaw.ts
+import WebSocket2 from "ws";
+import { randomUUID } from "crypto";
+
+// src/adapters/base.ts
+var AgentAdapter = class {
+};
+
+// src/adapters/openclaw.ts
+var DEFAULT_GATEWAY_URL = "ws://127.0.0.1:18789";
+var OpenClawSession = class {
+  constructor(sessionId, config) {
+    this.config = config;
+    this.gatewayUrl = config.gatewayUrl || DEFAULT_GATEWAY_URL;
+    this.gatewayToken = config.gatewayToken || "";
+    this.sessionKey = `bridge:${sessionId}`;
+  }
+  chunkCallbacks = [];
+  doneCallbacks = [];
+  errorCallbacks = [];
+  fullText = "";
+  ws = null;
+  isConnected = false;
+  gatewayUrl;
+  gatewayToken;
+  sessionKey;
+  send(message, _attachments) {
+    if (this.ws && this.ws.readyState === WebSocket2.OPEN && this.isConnected) {
+      this.sendAgentRequest(message);
+      return;
+    }
+    this.fullText = "";
+    this.connectAndSend(message);
+  }
+  onChunk(cb) {
+    this.chunkCallbacks.push(cb);
+  }
+  onDone(cb) {
+    this.doneCallbacks.push(cb);
+  }
+  onError(cb) {
+    this.errorCallbacks.push(cb);
+  }
+  kill() {
+    if (this.ws) {
+      this.ws.close();
+      this.ws = null;
+    }
+    this.isConnected = false;
+  }
+  connectAndSend(message) {
+    try {
+      this.ws = new WebSocket2(this.gatewayUrl);
+    } catch (err) {
+      this.emitError(new Error(`Failed to connect to OpenClaw: ${err}`));
+      return;
+    }
+    this.ws.on("open", () => {
+      log.debug(`OpenClaw WS connected to ${this.gatewayUrl}`);
+      const connectMsg = {
+        type: "req",
+        id: randomUUID(),
+        method: "connect",
+        params: {
+          minProtocol: 3,
+          maxProtocol: 3,
+          client: {
+            id: "gateway-client",
+            displayName: "Agent Bridge CLI",
+            version: "0.1.0",
+            platform: "node",
+            mode: "backend"
+          },
+          role: "operator",
+          scopes: ["operator.read", "operator.write"],
+          caps: [],
+          commands: [],
+          permissions: {},
+          auth: { token: this.gatewayToken }
+        }
+      };
+      this.ws.send(JSON.stringify(connectMsg));
+    });
+    this.ws.on("message", (data) => {
+      this.handleMessage(data.toString(), message);
+    });
+    this.ws.on("error", (err) => {
+      this.emitError(new Error(`OpenClaw WebSocket error: ${err.message}`));
+    });
+    this.ws.on("close", () => {
+      this.isConnected = false;
+    });
+  }
+  handleMessage(raw, pendingMessage) {
+    let msg;
+    try {
+      msg = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (msg.type === "event" && msg.event !== "agent") {
+      return;
+    }
+    if (msg.type === "res" && !this.isConnected) {
+      if (msg.ok && msg.payload?.type === "hello-ok") {
+        this.isConnected = true;
+        log.debug("OpenClaw handshake complete");
+        if (pendingMessage) {
+          this.sendAgentRequest(pendingMessage);
+        }
+      } else {
+        this.emitError(
+          new Error(`OpenClaw auth failed: ${msg.error?.message || "unknown"}`)
+        );
+        this.ws?.close();
+      }
+      return;
+    }
+    if (msg.type === "event" && msg.event === "agent" && msg.payload) {
+      const { stream, data } = msg.payload;
+      if (stream === "assistant" && data?.text) {
+        const prevLen = this.fullText.length;
+        this.fullText = data.text;
+        if (this.fullText.length > prevLen) {
+          const delta = this.fullText.slice(prevLen);
+          for (const cb of this.chunkCallbacks) cb(delta);
+        }
+      }
+      if (stream === "lifecycle" && data?.phase === "end") {
+        for (const cb of this.doneCallbacks) cb();
+      }
+      return;
+    }
+    if (msg.type === "res" && this.isConnected) {
+      if (msg.ok && msg.payload) {
+        if (msg.payload.status === "accepted") {
+          return;
+        }
+        if (msg.payload.response) {
+          for (const cb of this.chunkCallbacks) cb(msg.payload.response);
+        }
+        for (const cb of this.doneCallbacks) cb();
+      } else {
+        this.emitError(
+          new Error(`OpenClaw error: ${msg.error?.message || "unknown"}`)
+        );
+      }
+      return;
+    }
+    if (msg.type === "error") {
+      this.emitError(new Error(`OpenClaw error: ${msg.message || "unknown"}`));
+    }
+  }
+  sendAgentRequest(message) {
+    const req = {
+      type: "req",
+      id: randomUUID(),
+      method: "agent",
+      params: {
+        message,
+        sessionKey: this.sessionKey,
+        idempotencyKey: `idem-${Date.now()}-${randomUUID().slice(0, 8)}`
+      }
+    };
+    try {
+      this.ws.send(JSON.stringify(req));
+    } catch (err) {
+      this.emitError(new Error(`Failed to send to OpenClaw: ${err}`));
+    }
+  }
+  emitError(err) {
+    if (this.errorCallbacks.length > 0) {
+      for (const cb of this.errorCallbacks) cb(err);
+    } else {
+      log.error(err.message);
+    }
+  }
+};
+var OpenClawAdapter = class extends AgentAdapter {
+  type = "openclaw";
+  displayName = "OpenClaw Gateway";
+  sessions = /* @__PURE__ */ new Map();
+  config;
+  constructor(config = {}) {
+    super();
+    this.config = config;
+  }
+  async isAvailable() {
+    const url = this.config.gatewayUrl || DEFAULT_GATEWAY_URL;
+    return new Promise((resolve) => {
+      let ws;
+      const timer = setTimeout(() => {
+        ws?.close();
+        resolve(false);
+      }, 5e3);
+      try {
+        ws = new WebSocket2(url);
+      } catch {
+        clearTimeout(timer);
+        resolve(false);
+        return;
+      }
+      ws.on("open", () => {
+        clearTimeout(timer);
+        ws.close();
+        resolve(true);
+      });
+      ws.on("error", () => {
+        clearTimeout(timer);
+        resolve(false);
+      });
+    });
+  }
+  createSession(id, config) {
+    const merged = { ...this.config, ...config };
+    const session = new OpenClawSession(id, merged);
+    this.sessions.set(id, session);
+    return session;
+  }
+  destroySession(id) {
+    const session = this.sessions.get(id);
+    if (session) {
+      session.kill();
+      this.sessions.delete(id);
+    }
+  }
+};
+
+// src/utils/process.ts
+import { spawn } from "child_process";
+
+// src/utils/sandbox.ts
+import { execSync } from "child_process";
+import { join as join2 } from "path";
+var SRT_PACKAGE = "@anthropic-ai/sandbox-runtime";
+var SENSITIVE_PATHS = [
+  // SSH & crypto keys
+  "~/.ssh",
+  "~/.gnupg",
+  // Cloud provider credentials
+  "~/.aws",
+  "~/.config/gcloud",
+  "~/.azure",
+  "~/.kube",
+  // Claude Code — fine-grained: block credentials & privacy, allow skills/agents
+  "~/.claude.json",
+  // API key
+  "~/.claude/projects",
+  // per-project memory (may contain secrets from other projects)
+  "~/.claude/history.jsonl",
+  // conversation history (privacy)
+  "~/.claude/settings.json",
+  // may contain sensitive config
+  "~/.claude/sessions",
+  // session data
+  "~/.claude/ide",
+  // IDE integration data
+  // NOT blocked (needed for functionality):
+  //   ~/.claude/skills/    — skill code & prompts
+  //   ~/.claude/agents/    — custom agent definitions
+  //   ~/.claude/commands/  — custom commands
+  //   ~/.claude/hooks/     — event hooks
+  // Other AI agent configs (contain API keys / tokens)
+  "~/.openclaw",
+  "~/.agent-bridge",
+  "~/.codex",
+  // Package manager tokens
+  "~/.npmrc",
+  "~/.yarnrc",
+  "~/.config/pip",
+  // Git credentials & config
+  "~/.gitconfig",
+  "~/.netrc",
+  "~/.git-credentials",
+  // Docker
+  "~/.docker",
+  // macOS Keychain databases
+  "~/Library/Keychains"
+];
+var SANDBOX_PRESETS = {
+  claude: {
+    denyRead: [...SENSITIVE_PATHS],
+    allowWrite: [".", "/tmp"],
+    denyWrite: [".env", ".env.*"]
+  },
+  codex: {
+    denyRead: [...SENSITIVE_PATHS],
+    allowWrite: [".", "/tmp"],
+    denyWrite: [".env", ".env.*"]
+  },
+  gemini: {
+    denyRead: [...SENSITIVE_PATHS],
+    allowWrite: [".", "/tmp"],
+    denyWrite: [".env", ".env.*"]
+  },
+  openclaw: {
+    denyRead: [...SENSITIVE_PATHS],
+    allowWrite: ["/tmp"],
+    denyWrite: [".env", ".env.*"]
+  }
+};
+var sandboxManager = null;
+var sandboxInitialized = false;
+async function importSandboxManager() {
+  try {
+    const globalRoot = execSync("npm root -g", { encoding: "utf-8" }).trim();
+    const srtPath = join2(globalRoot, "@anthropic-ai/sandbox-runtime/dist/index.js");
+    const mod = await import(srtPath);
+    return mod.SandboxManager;
+  } catch {
+    log.debug("Failed to import SandboxManager from global npm");
+    return null;
+  }
+}
+var _importOverride = null;
+async function resolveManager() {
+  if (_importOverride) return _importOverride();
+  return importSandboxManager();
+}
+function getSandboxPreset(agentType) {
+  return SANDBOX_PRESETS[agentType] ?? SANDBOX_PRESETS.claude;
+}
+async function initSandbox(agentType) {
+  let mgr = await resolveManager();
+  if (!mgr) {
+    log.info("Sandbox runtime (srt) not found, installing...");
+    const installed = installSandboxRuntime();
+    if (!installed) return false;
+    mgr = await resolveManager();
+    if (!mgr) {
+      log.error("srt installed but SandboxManager not found. Try restarting your terminal.");
+      return false;
+    }
+  }
+  if (!mgr.isSupportedPlatform()) {
+    log.warn("Sandbox is not supported on this platform (requires macOS)");
+    return false;
+  }
+  const filesystem = getSandboxPreset(agentType);
+  try {
+    await mgr.initialize({
+      network: { allowedDomains: ["placeholder.example.com"], deniedDomains: [] },
+      filesystem
+    });
+    mgr.updateConfig({
+      network: { deniedDomains: [] },
+      filesystem
+    });
+    sandboxManager = mgr;
+    sandboxInitialized = true;
+    log.success("Sandbox enabled (srt programmatic API)");
+    return true;
+  } catch (err) {
+    log.error(`Failed to initialize sandbox: ${err}`);
+    return false;
+  }
+}
+async function wrapWithSandbox(command, filesystemOverride) {
+  if (!sandboxInitialized || !sandboxManager) return null;
+  if (filesystemOverride) {
+    sandboxManager.updateConfig({
+      filesystem: filesystemOverride
+    });
+  }
+  try {
+    return await sandboxManager.wrapWithSandbox(command);
+  } catch (err) {
+    log.error(`wrapWithSandbox failed: ${err}`);
+    return null;
+  }
+}
+async function resetSandbox() {
+  if (sandboxManager) {
+    try {
+      await sandboxManager.reset();
+    } catch {
+    }
+    sandboxManager = null;
+    sandboxInitialized = false;
+  }
+}
+function shellQuote(s) {
+  if (/^[a-zA-Z0-9_\-./=:@]+$/.test(s)) return s;
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function buildCommandString(command, args) {
+  return [command, ...args.map(shellQuote)].join(" ");
+}
+function installSandboxRuntime() {
+  log.info(`Installing ${SRT_PACKAGE}...`);
+  try {
+    execSync(`npm install -g ${SRT_PACKAGE}`, { stdio: "inherit" });
+    log.success(`${SRT_PACKAGE} installed successfully`);
+    return true;
+  } catch {
+    log.error(`Failed to install ${SRT_PACKAGE}. You can install it manually:`);
+    log.error(`  npm install -g ${SRT_PACKAGE}`);
+    return false;
+  }
+}
+
+// src/utils/process.ts
+async function spawnAgent(command, args, options) {
+  const { sandboxEnabled, sandboxFilesystem, ...spawnOptions } = options ?? {};
+  let finalCommand;
+  let finalArgs;
+  if (sandboxEnabled) {
+    const cmdString = buildCommandString(command, args);
+    const wrapped = await wrapWithSandbox(cmdString, sandboxFilesystem);
+    if (wrapped) {
+      finalCommand = "bash";
+      finalArgs = ["-c", wrapped];
+    } else {
+      finalCommand = command;
+      finalArgs = args;
+    }
+  } else {
+    finalCommand = command;
+    finalArgs = args;
+  }
+  const child = spawn(finalCommand, finalArgs, {
+    stdio: ["pipe", "pipe", "pipe"],
+    ...spawnOptions
+  });
+  return {
+    child,
+    stdout: child.stdout,
+    stderr: child.stderr,
+    stdin: child.stdin,
+    kill() {
+      if (!child.killed) {
+        child.kill("SIGTERM");
+        setTimeout(() => {
+          if (!child.killed) {
+            child.kill("SIGKILL");
+          }
+        }, 5e3);
+      }
+    }
+  };
+}
+
+// src/adapters/claude.ts
+import { createInterface } from "readline";
+
+// src/utils/which.ts
+import { execFile } from "child_process";
+var ALLOWED_COMMANDS = /^[a-zA-Z0-9._-]+$/;
+function which(command) {
+  if (!ALLOWED_COMMANDS.test(command)) {
+    return Promise.resolve(null);
+  }
+  return new Promise((resolve) => {
+    execFile("which", [command], (err, stdout) => {
+      if (err || !stdout.trim()) {
+        resolve(null);
+      } else {
+        resolve(stdout.trim());
+      }
+    });
+  });
+}
+
+// src/utils/session-workspace.ts
+import { mkdirSync as mkdirSync2, rmSync, existsSync as existsSync2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { join as join3 } from "path";
+import { tmpdir } from "os";
+var SESSIONS_BASE = join3(tmpdir(), "agent-bridge-sessions");
+function isGitRepo(dir) {
+  try {
+    execSync2("git rev-parse --git-dir", { cwd: dir, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createSessionWorkspace(sessionId, projectPath) {
+  const sessionDir = join3(SESSIONS_BASE, sessionId);
+  if (projectPath && isGitRepo(projectPath)) {
+    try {
+      execSync2(
+        `git worktree add --detach ${JSON.stringify(sessionDir)}`,
+        { cwd: projectPath, stdio: "ignore" }
+      );
+      log.debug(`Created git worktree for session ${sessionId.slice(0, 8)}...`);
+      return { path: sessionDir, isWorktree: true };
+    } catch (err) {
+      log.warn(`Failed to create git worktree: ${err}. Falling back to temp directory.`);
+    }
+  }
+  mkdirSync2(sessionDir, { recursive: true });
+  log.debug(`Created temp workspace for session ${sessionId.slice(0, 8)}...`);
+  return { path: sessionDir, isWorktree: false };
+}
+function destroySessionWorkspace(sessionId, projectPath) {
+  const sessionDir = join3(SESSIONS_BASE, sessionId);
+  if (!existsSync2(sessionDir)) return;
+  if (projectPath) {
+    try {
+      execSync2(
+        `git worktree remove --force ${JSON.stringify(sessionDir)}`,
+        { cwd: projectPath, stdio: "ignore" }
+      );
+      log.debug(`Removed git worktree for session ${sessionId.slice(0, 8)}...`);
+      return;
+    } catch {
+    }
+  }
+  rmSync(sessionDir, { recursive: true, force: true });
+  log.debug(`Removed temp workspace for session ${sessionId.slice(0, 8)}...`);
+}
+
+// src/adapters/claude.ts
+var IDLE_TIMEOUT = 5 * 60 * 1e3;
+var ClaudeSession = class {
+  constructor(sessionId, config, sandboxFilesystem) {
+    this.sessionId = sessionId;
+    this.config = config;
+    this.sandboxFilesystem = sandboxFilesystem;
+  }
+  chunkCallbacks = [];
+  doneCallbacks = [];
+  errorCallbacks = [];
+  process = null;
+  idleTimer = null;
+  config;
+  sandboxFilesystem;
+  send(message, _attachments) {
+    this.resetIdleTimer();
+    const args = ["-p", message, "--output-format", "stream-json", "--verbose", "--max-turns", "1"];
+    if (this.config.project) {
+      args.push("--project", this.config.project);
+    }
+    this.launchProcess(args);
+  }
+  async launchProcess(args) {
+    try {
+      this.process = await spawnAgent("claude", args, {
+        stdio: ["ignore", "pipe", "pipe"],
+        sandboxEnabled: this.config.sandboxEnabled,
+        sandboxFilesystem: this.sandboxFilesystem
+      });
+    } catch (err) {
+      this.emitError(new Error(`Failed to spawn claude: ${err}`));
+      return;
+    }
+    const rl = createInterface({ input: this.process.stdout });
+    rl.on("line", (line) => {
+      this.resetIdleTimer();
+      if (!line.trim()) return;
+      try {
+        const event = JSON.parse(line);
+        this.handleEvent(event);
+      } catch {
+        log.debug(`Claude non-JSON line: ${line}`);
+      }
+    });
+    this.process.stderr.on("data", (data) => {
+      const text = data.toString().trim();
+      if (text) log.debug(`Claude stderr: ${text}`);
+    });
+    this.process.child.on("exit", (code) => {
+      if (code !== 0 && code !== null) {
+        this.emitError(new Error(`Claude process exited with code ${code}`));
+      }
+    });
+  }
+  onChunk(cb) {
+    this.chunkCallbacks.push(cb);
+  }
+  onDone(cb) {
+    this.doneCallbacks.push(cb);
+  }
+  onError(cb) {
+    this.errorCallbacks.push(cb);
+  }
+  kill() {
+    this.clearIdleTimer();
+    if (this.process) {
+      this.process.kill();
+      this.process = null;
+    }
+  }
+  handleEvent(event) {
+    if (event.type === "assistant" && event.subtype === "text_delta" && event.delta?.text) {
+      for (const cb of this.chunkCallbacks) cb(event.delta.text);
+      return;
+    }
+    if (event.type === "content_block_delta" && event.delta?.type === "text_delta" && event.delta?.text) {
+      for (const cb of this.chunkCallbacks) cb(event.delta.text);
+      return;
+    }
+    if (event.type === "assistant" && event.message?.content) {
+      for (const block of event.message.content) {
+        if (block.type === "text" && block.text) {
+          for (const cb of this.chunkCallbacks) cb(block.text);
+        }
+      }
+      return;
+    }
+    if (event.type === "result") {
+      if (event.result?.type === "string" || typeof event.result === "string") {
+        const text = event.result;
+        if (text) {
+          for (const cb of this.chunkCallbacks) cb(text);
+        }
+      }
+      for (const cb of this.doneCallbacks) cb();
+      return;
+    }
+    if (event.type === "assistant" && event.subtype === "end") {
+      for (const cb of this.doneCallbacks) cb();
+      return;
+    }
+  }
+  resetIdleTimer() {
+    this.clearIdleTimer();
+    this.idleTimer = setTimeout(() => {
+      log.warn(`Claude session ${this.sessionId} idle timeout, killing process`);
+      this.kill();
+    }, IDLE_TIMEOUT);
+  }
+  clearIdleTimer() {
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+  }
+  emitError(err) {
+    if (this.errorCallbacks.length > 0) {
+      for (const cb of this.errorCallbacks) cb(err);
+    } else {
+      log.error(err.message);
+    }
+  }
+};
+var ClaudeAdapter = class extends AgentAdapter {
+  type = "claude";
+  displayName = "Claude Code";
+  sessions = /* @__PURE__ */ new Map();
+  config;
+  constructor(config = {}) {
+    super();
+    this.config = config;
+  }
+  async isAvailable() {
+    return !!await which("claude");
+  }
+  createSession(id, config) {
+    const merged = { ...this.config, ...config };
+    let workspace = null;
+    let sessionConfig = merged;
+    let sandboxFilesystem;
+    if (merged.sandboxEnabled && merged.project) {
+      workspace = createSessionWorkspace(id, merged.project);
+      const projectPath = workspace.isWorktree ? workspace.path : merged.project;
+      const preset = getSandboxPreset("claude");
+      sandboxFilesystem = {
+        denyRead: preset.denyRead,
+        allowWrite: [workspace.path, "/tmp"],
+        denyWrite: preset.denyWrite
+      };
+      sessionConfig = {
+        ...merged,
+        project: projectPath
+      };
+      log.info(`Session ${id.slice(0, 8)}... workspace: ${workspace.path} (${workspace.isWorktree ? "git worktree" : "temp dir"})`);
+    }
+    const session = new ClaudeSession(id, sessionConfig, sandboxFilesystem);
+    this.sessions.set(id, { session, workspace });
+    return session;
+  }
+  destroySession(id) {
+    const entry = this.sessions.get(id);
+    if (entry) {
+      entry.session.kill();
+      if (entry.workspace) {
+        destroySessionWorkspace(id, this.config.project);
+      }
+      this.sessions.delete(id);
+    }
+  }
+};
+
+// src/adapters/codex.ts
+var CodexAdapter = class extends AgentAdapter {
+  type = "codex";
+  displayName = "Codex CLI";
+  async isAvailable() {
+    return false;
+  }
+  createSession(_id, _config) {
+    throw new Error("Codex adapter not yet implemented");
+  }
+  destroySession(_id) {
+  }
+};
+
+// src/adapters/gemini.ts
+var GeminiAdapter = class extends AgentAdapter {
+  type = "gemini";
+  displayName = "Gemini CLI";
+  async isAvailable() {
+    return false;
+  }
+  createSession(_id, _config) {
+    throw new Error("Gemini adapter not yet implemented");
+  }
+  destroySession(_id) {
+  }
+};
+
+// src/utils/openclaw-config.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+var OPENCLAW_CONFIG_PATH = join4(homedir2(), ".openclaw", "openclaw.json");
+function readOpenClawToken(configPath) {
+  const path = configPath || OPENCLAW_CONFIG_PATH;
+  try {
+    const raw = readFileSync2(path, "utf-8");
+    const config = JSON.parse(raw);
+    const token = config?.gateway?.auth?.token;
+    if (typeof token === "string" && token.length > 0) {
+      return token;
+    }
+    log.warn("OpenClaw config found but gateway.auth.token is missing or empty");
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/connect.ts
+var DEFAULT_BRIDGE_URL = "wss://bridge.agents.hot/ws";
+function createAdapter(type, config) {
+  switch (type) {
+    case "openclaw":
+      return new OpenClawAdapter(config);
+    case "claude":
+      return new ClaudeAdapter(config);
+    case "codex":
+      return new CodexAdapter(config);
+    case "gemini":
+      return new GeminiAdapter(config);
+    default:
+      throw new Error(`Unknown agent type: ${type}. Supported: openclaw, claude, codex, gemini`);
+  }
+}
+function registerConnectCommand(program2) {
+  program2.command("connect [type]").description("Connect a local agent to the Agents.Hot platform").option("--setup <url>", "One-click setup from agents.hot connect ticket URL").option("--agent-id <id>", "Agent ID registered on Agents.Hot").option("--project <path>", "Project path (for claude adapter)").option("--gateway-url <url>", "OpenClaw gateway URL (for openclaw adapter)").option("--gateway-token <token>", "OpenClaw gateway token").option("--bridge-url <url>", "Bridge Worker WebSocket URL").option("--sandbox", "Run agent inside a sandbox (requires srt)").option("--no-sandbox", "Disable sandbox even if enabled in config").action(async (type, opts) => {
+    const config = loadConfig();
+    if (opts.setup) {
+      log.info("Fetching configuration from connect ticket...");
+      try {
+        const response = await fetch(opts.setup);
+        if (!response.ok) {
+          const body = await response.json().catch(() => ({ message: response.statusText }));
+          log.error(`Ticket redemption failed: ${body.message || response.statusText}`);
+          if (response.status === 404) {
+            log.error("The ticket may have expired or already been used.");
+          }
+          process.exit(1);
+        }
+        const ticketData = await response.json();
+        let gatewayToken = opts.gatewayToken;
+        if (ticketData.agent_type === "openclaw" && !gatewayToken) {
+          const localToken = readOpenClawToken();
+          if (localToken) {
+            gatewayToken = localToken;
+            log.success("Auto-detected OpenClaw gateway token from ~/.openclaw/openclaw.json");
+          } else {
+            log.warn("Could not auto-detect OpenClaw token. Use --gateway-token to provide it manually.");
+          }
+        }
+        updateConfig({
+          agentId: ticketData.agent_id,
+          token: ticketData.bridge_token,
+          defaultAgentType: ticketData.agent_type,
+          bridgeUrl: ticketData.bridge_url,
+          gatewayToken
+        });
+        log.success("Configuration saved to ~/.agent-bridge/config.json");
+        opts.agentId = ticketData.agent_id;
+        opts.bridgeUrl = ticketData.bridge_url;
+        opts.gatewayToken = gatewayToken;
+        type = ticketData.agent_type;
+      } catch (err) {
+        if (err instanceof Error && err.message.includes("fetch")) {
+          log.error(`Failed to fetch ticket: ${err.message}`);
+        } else {
+          throw err;
+        }
+        process.exit(1);
+      }
+    }
+    const agentType = type || config.defaultAgentType;
+    if (!agentType) {
+      log.error("Agent type is required. Use: agent-bridge connect <type> or agent-bridge connect --setup <url>");
+      process.exit(1);
+    }
+    const agentId = opts.agentId || config.agentId;
+    if (!agentId) {
+      log.error("--agent-id is required. Use --setup for automatic configuration.");
+      process.exit(1);
+    }
+    const token = opts.setup ? loadConfig().token : loadToken() || config.token;
+    if (!token) {
+      log.error("Not authenticated. Run `agent-bridge login` or use `agent-bridge connect --setup <url>`.");
+      process.exit(1);
+    }
+    const bridgeUrl = opts.bridgeUrl || config.bridgeUrl || DEFAULT_BRIDGE_URL;
+    const sandboxEnabled = opts.sandbox ?? config.sandbox ?? false;
+    if (sandboxEnabled) {
+      const ok = await initSandbox(agentType);
+      if (!ok) {
+        log.warn("Sandbox not available on this platform, continuing without sandbox");
+      }
+    }
+    const adapterConfig = {
+      project: opts.project,
+      gatewayUrl: opts.gatewayUrl || config.gatewayUrl,
+      gatewayToken: opts.gatewayToken || config.gatewayToken,
+      sandboxEnabled
+    };
+    const adapter = createAdapter(agentType, adapterConfig);
+    log.info(`Checking ${adapter.displayName} availability...`);
+    const available = await adapter.isAvailable();
+    if (!available) {
+      if (agentType === "codex" || agentType === "gemini") {
+        log.error(`${adapter.displayName} adapter is not yet implemented. Supported adapters: openclaw, claude`);
+      } else {
+        log.error(`${adapter.displayName} is not available. Make sure it is installed and running.`);
+      }
+      process.exit(1);
+    }
+    log.success(`${adapter.displayName} is available`);
+    log.info(`Connecting to bridge worker at ${bridgeUrl}...`);
+    const wsClient = new BridgeWSClient({
+      url: bridgeUrl,
+      token,
+      agentId,
+      agentType
+    });
+    try {
+      await wsClient.connect();
+    } catch (err) {
+      log.error(`Failed to connect to bridge worker: ${err}`);
+      process.exit(1);
+    }
+    log.success(`Registered as agent "${agentId}" (${agentType})`);
+    const manager = new BridgeManager({
+      wsClient,
+      adapter,
+      adapterConfig
+    });
+    manager.start();
+    log.banner(`Agent bridge is running. Press Ctrl+C to stop.`);
+    const shutdown = () => {
+      log.info("Shutting down...");
+      manager.stop();
+      wsClient.close();
+      resetSandbox();
+      process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    wsClient.on("reconnect", () => {
+      manager.stop();
+      manager.start();
+    });
+  });
+}
+
+// src/commands/login.ts
+import { createInterface as createInterface2 } from "readline";
+function readLine(prompt) {
+  const rl = createInterface2({
+    input: process.stdin,
+    output: process.stderr
+  });
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function registerLoginCommand(program2) {
+  program2.command("login").description("Authenticate with the Agents.Hot platform").option("--token <token>", "Provide token directly (skip interactive prompt)").action(async (opts) => {
+    if (hasToken()) {
+      log.info("You are already logged in. Use --token to update your token.");
+    }
+    let token = opts.token;
+    if (!token) {
+      log.banner("Agent Bridge Login");
+      console.log("1. Visit https://agents.hot/dashboard/settings to get your CLI token");
+      console.log("2. Copy the token and paste it below\n");
+      token = await readLine("Token: ");
+    }
+    if (!token) {
+      log.error("No token provided");
+      process.exit(1);
+    }
+    saveToken(token);
+    log.success(`Token saved to ${getConfigPath()}`);
+  });
+}
+
+// src/commands/status.ts
+function registerStatusCommand(program2) {
+  program2.command("status").description("Check authentication and connection status").action(async () => {
+    log.banner("Agent Bridge Status");
+    const config = loadConfig();
+    const configPath = getConfigPath();
+    console.log(`Config: ${configPath}`);
+    if (!hasToken()) {
+      console.log("Auth:   Not logged in");
+      console.log("\nRun `agent-bridge login` to authenticate.");
+      return;
+    }
+    const token = loadToken();
+    const maskedToken = token.slice(0, 8) + "..." + token.slice(-4);
+    console.log(`Auth:   Logged in (token: ${maskedToken})`);
+    if (config.defaultAgentType) {
+      console.log(`Agent:  ${config.defaultAgentType}`);
+    }
+    if (config.bridgeUrl) {
+      console.log(`Bridge: ${config.bridgeUrl}`);
+    }
+    if (config.gatewayUrl) {
+      console.log(`Gateway: ${config.gatewayUrl}`);
+    }
+    console.log("\nTo connect an agent, run:");
+    console.log("  agent-bridge connect <type> --agent-id <id>");
+    console.log("\nSupported types: openclaw, claude, codex, gemini");
+  });
+}
+
+// src/index.ts
+program.name("agent-bridge").description("Connect local AI agents to the Skills.Hot platform").version("0.1.0");
+registerConnectCommand(program);
+registerLoginCommand(program);
+registerStatusCommand(program);
+program.parse();

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@annals/agent-bridge",
+  "version": "0.1.0",
+  "description": "CLI bridge connecting local AI agents to the Agents.Hot platform",
+  "type": "module",
+  "bin": {
+    "agent-bridge": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch"
+  },
+  "dependencies": {
+    "@annals/bridge-protocol": "^0.1.0",
+    "commander": "^13.0.0",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.5.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0"
+  },
+  "files": ["dist"],
+  "license": "MIT"
+}