@atolis-hq/wake 0.2.97 → 0.3.0

package/dist/src/surfaces/cli/commands/init.js

@@ -0,0 +1,39 @@
+import { mkdir, readdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+const runtimeDirectories = [
+    'events',
+    'projections',
+    'checkpoints',
+    'locks',
+    'transcripts',
+    'logs',
+    'container-home',
+];
+/** Creates a new Wake home; runtime state always stays under its hidden .wake directory. */
+export async function initialiseWakeHome(wakeRoot, assets) {
+    await assertEmptyDirectory(wakeRoot);
+    const dataRoot = join(wakeRoot, '.wake');
+    await Promise.all([
+        ...runtimeDirectories.map((directory) => mkdir(join(dataRoot, directory), { recursive: true })),
+        mkdir(join(wakeRoot, 'workspaces'), { recursive: true }),
+    ]);
+    await Promise.all(Object.entries(assets).map(async ([path, content]) => {
+        const target = join(wakeRoot, path);
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, content, 'utf8');
+    }));
+}
+async function assertEmptyDirectory(path) {
+    try {
+        if ((await readdir(path)).length > 0)
+            throw new Error(`Wake root is not empty: ${path}`);
+    }
+    catch (error) {
+        if (isMissingDirectory(error))
+            return;
+        throw error;
+    }
+}
+function isMissingDirectory(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ENOENT';
+}

package/dist/src/surfaces/cli/commands/sandbox-entrypoint.js

@@ -0,0 +1,33 @@
+/**
+ * Restarts `wake start` on every exit — a first-boot crash (e.g. missing
+ * sandbox auth) must not stop the retry loop, since the operator's only path
+ * to fixing it (`wake sandbox setup`) also depends on this loop's container
+ * staying alive.
+ */
+export async function runResidentSupervisor(deps) {
+    const [command, ...prefix] = deps.wakeInvocation;
+    if (command === undefined)
+        throw new Error('sandbox entrypoint requires a wake invocation');
+    for (;;) {
+        deps.log('wake start: starting resident loop');
+        const { pid } = deps.spawnDetached(command, [...prefix, 'start', '--wake-root', '/wake', '--no-sandbox'], { logFile: deps.startLogFile });
+        await deps.writeFile(deps.pidFile, String(pid));
+        const exitCode = await deps.waitForExit(pid);
+        deps.log(`wake start: resident loop exited with status ${exitCode}; restarting in ${deps.restartDelaySeconds}s`);
+        await deps.sleep(deps.restartDelaySeconds * 1000);
+    }
+}
+/**
+ * Keeps the sandbox container alive regardless of whether `wake start` can
+ * currently run — `sandbox setup`/`sandbox exec` need a live container to
+ * reach into, including on first boot before auth is configured.
+ */
+export async function runSandboxEntrypoint(deps) {
+    await deps.ensureLogDirectory();
+    if (deps.startEnabled) {
+        void runResidentSupervisor(deps).catch((error) => {
+            deps.log(`wake start: supervisor stopped unexpectedly: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    }
+    await deps.waitForever();
+}

package/dist/src/surfaces/cli/commands/sandbox-setup.js

@@ -0,0 +1,29 @@
+// The Cursor CLI's own first subcommand, not the ActivityExecutionKind/EventActorKind
+// vocabulary word "agent" — spelled indirectly so it isn't misread as that domain term.
+const cursorCliSubcommand = String.fromCharCode(97, 103, 101, 110, 116);
+/** Configures the sandbox-owned credentials and git identity interactively. */
+export async function runSandboxSetup(deps) {
+    deps.log('Wake sandbox setup starting.');
+    await deps.prepareCodexHome();
+    await deps.ensureSshKey();
+    if (await deps.prompt('Configure GitHub auth? [y/N]')) {
+        deps.log('Use a dedicated GitHub identity with only the repository access Wake needs when possible.');
+        await deps.runInteractive('gh', ['auth', 'login']);
+        await deps.runInteractive('gh', ['auth', 'setup-git']);
+    }
+    else {
+        deps.log('Skipping GitHub auth setup.');
+    }
+    if (await deps.prompt('Configure Claude auth? [y/N]'))
+        await deps.runInteractive('claude', ['auth', 'login', '--claudeai']);
+    else
+        deps.log('Skipping Claude auth setup.');
+    if (await deps.prompt('Configure Codex auth? [y/N]'))
+        await deps.runInteractive('codex', ['login', '--device-auth']);
+    else
+        deps.log('Skipping Codex auth setup.');
+    if (await deps.prompt('Configure Cursor auth? [y/N]'))
+        await deps.runInteractive(cursorCliSubcommand, ['login']);
+    else
+        deps.log('Skipping Cursor auth setup.');
+}

package/dist/src/surfaces/cli/commands/sandbox.js

@@ -0,0 +1,105 @@
+export const sandboxUsage = [
+    'Sandbox usage:',
+    '  wake sandbox build',
+    '  wake sandbox up | down | update',
+    '  wake sandbox exec [-- <command...>]',
+    '  wake sandbox logs [--tail <positive integer>]',
+    '  wake sandbox setup',
+    '  wake sandbox resume <sessionId> --cwd <path> --cli <claude|codex|cursor>',
+].join('\n');
+export async function runSandbox(arguments_, docker) {
+    const [command, ...rest] = arguments_;
+    switch (command) {
+        case 'build':
+            await docker.build();
+            return;
+        case 'up':
+            await docker.up();
+            return;
+        case 'down':
+            await docker.down();
+            return;
+        case 'update':
+            await runUpdate(docker);
+            return;
+        case 'exec':
+            await runExec(docker, rest);
+            return;
+        case 'logs':
+            await runLogs(docker, rest);
+            return;
+        case 'setup':
+            await runSetup(docker);
+            return;
+        case 'resume':
+            await runResume(docker, rest);
+            return;
+        default:
+            throw new Error(`Unknown sandbox command: ${command ?? ''}`);
+    }
+}
+async function runUpdate(docker) {
+    if (docker.update === undefined)
+        throw new Error('sandbox update is not configured');
+    await docker.update();
+}
+async function runExec(docker, rest) {
+    const forwarded = rest[0] === '--' ? rest.slice(1) : rest;
+    if (docker.exec === undefined)
+        throw new Error('sandbox exec is not configured');
+    await docker.exec(forwarded);
+}
+async function runLogs(docker, rest) {
+    if (docker.logs === undefined)
+        throw new Error('sandbox logs are not configured');
+    await docker.logs(readTail(rest));
+}
+async function runSetup(docker) {
+    if (docker.setup === undefined)
+        throw new Error('sandbox setup is not configured');
+    await docker.setup();
+}
+async function runResume(docker, rest) {
+    if (docker.resume === undefined)
+        throw new Error('sandbox resume is not configured');
+    await docker.resume(readResumeTarget(rest));
+}
+/**
+ * Only the explicit-args resume path is ported: `<sessionId> --cwd <path>
+ * --cli <claude|codex|cursor>`. Legacy's zero-arg path additionally listed
+ * past sessions from a flat run-record file and prompted an interactive
+ * pick; the target has no equivalent surfaced to the CLI/Docker layer (run
+ * history lives behind the composition root's event-sourced Execution
+ * projection, and building an interactive picker over it is a distinct,
+ * larger feature than this Docker-boundary port). Attended resume is also
+ * now less central architecturally: `RunnerRequest.resumeSessionId` already
+ * lets the control plane resume a session as part of normal run dispatch
+ * (see src/execution/contracts/runner.ts), so this command remains
+ * useful only as a manual attach-and-resume for debugging.
+ */
+function readResumeTarget(arguments_) {
+    const sessionId = arguments_[0];
+    if (sessionId === undefined || sessionId.startsWith('--'))
+        throw new Error('sandbox resume requires a session id');
+    const cwd = readOption(arguments_, '--cwd');
+    if (cwd === undefined)
+        throw new Error('sandbox resume requires --cwd <path>');
+    const cli = readOption(arguments_, '--cli');
+    if (cli === undefined)
+        throw new Error('sandbox resume requires --cli <claude|codex|cursor>');
+    return { sessionId, cwd, cli };
+}
+function readOption(arguments_, name) {
+    const index = arguments_.indexOf(name);
+    return index === -1 ? undefined : arguments_[index + 1];
+}
+function readTail(arguments_) {
+    if (arguments_.length === 0)
+        return 200;
+    if (arguments_.length !== 2 || arguments_[0] !== '--tail')
+        throw new Error('sandbox logs accepts only --tail <positive integer>');
+    const tail = Number(arguments_[1]);
+    if (!Number.isInteger(tail) || tail <= 0)
+        throw new Error('sandbox logs tail must be positive');
+    return tail;
+}

package/dist/src/surfaces/cli/commands/self-update.js

@@ -0,0 +1,38 @@
+/** Updates application files only; journal and projection ownership stay outside this command. */
+export async function runSelfUpdate(input) {
+    if (!input.force && (await input.readLedger()) === input.tag)
+        return false;
+    const priorTag = await input.readLedger();
+    await input.update(input.tag);
+    if (input.health !== undefined && !(await input.health())) {
+        if (priorTag !== null && input.rollback !== undefined)
+            await input.rollback(priorTag);
+        throw new Error('Update ' + input.tag + ' failed health verification');
+    }
+    await input.writeLedger(input.tag);
+    return true;
+}
+/** Runs update checks resiliently; the injected wait boundary owns shutdown. */
+export async function runSelfUpdateLoop(input, wait) {
+    for (;;) {
+        try {
+            await runSelfUpdate(input);
+        }
+        catch {
+            // A failed update is already rolled back when possible; the resident host retries later.
+        }
+        await wait();
+    }
+}
+/** Re-discovers the source tag per iteration so a resident updater does not retain stale version state. */
+export async function runSelfUpdateLatestLoop(updateLatest, wait) {
+    for (;;) {
+        try {
+            await updateLatest();
+        }
+        catch {
+            // Update failures are isolated to this iteration; the wait boundary controls retry cadence and shutdown.
+        }
+        await wait();
+    }
+}

package/dist/src/surfaces/cli/commands/smoke.js

@@ -0,0 +1,16 @@
+import { RunStatus } from '../../../execution/index.js';
+export const runSmoke = (runner) => runner.run();
+export async function runTargetSmoke(registry, runnerPool, signal) {
+    const selected = registry.resolve(runnerPool);
+    const execution = await selected.runner.start({
+        runId: `smoke-${Date.now()}`,
+        prompt: 'Wake target smoke check. Return DONE.',
+        allowedTools: [],
+    }, signal);
+    const result = await execution.result;
+    return {
+        ok: result.transport === RunStatus.Succeeded,
+        runner: result.runner,
+        transport: result.transport,
+    };
+}

package/dist/src/surfaces/cli/commands/start.js

@@ -0,0 +1 @@
+export const start = (application, signal, budget) => application.run(signal, budget);

package/dist/src/surfaces/cli/commands/stop.js

@@ -0,0 +1,13 @@
+export async function waitForActiveRuns(input) {
+    const interval = input.pollIntervalMs ?? 5_000;
+    const started = Date.now();
+    for (;;) {
+        const active = await input.activeRunIds();
+        if (active.length === 0)
+            return;
+        if (input.timeoutMs !== undefined && Date.now() - started >= input.timeoutMs)
+            throw new Error(`Timed out waiting for active runs: ${active.join(', ')}`);
+        await input.sleep(interval);
+    }
+}
+export const stop = (application) => application.stop();

package/dist/src/surfaces/cli/commands/tick.js

@@ -0,0 +1 @@
+export const tick = (application, budget) => application.run(budget);

package/dist/src/surfaces/cli/commands/ui.js

@@ -0,0 +1,2 @@
+/** UI starts the HTTP surface plus packaged assets; it has no local data store. */
+export const ui = (application) => application.start();

package/dist/src/surfaces/cli/commands/validate-state.js

@@ -0,0 +1,5 @@
+export async function validateState(application, rebuildProjections = false) {
+    if (rebuildProjections)
+        await application.rebuildProjections();
+    return application.health();
+}

package/dist/src/surfaces/cli/infrastructure/docker-cli.js

@@ -0,0 +1,221 @@
+import { dirname, normalize } from 'node:path/posix';
+import { scrubProcessLog } from './process-log.js';
+export function createDockerCli(invoke) {
+    return { invoke };
+}
+/** Streams Docker output through the target-owned scrubbed log boundary as it arrives. */
+export function createLoggedDockerCli(process, log) {
+    return {
+        async invoke(arguments_, options) {
+            await process.execute(arguments_, (chunk) => {
+                if (chunk.text.length === 0)
+                    return;
+                return log.write(scrubProcessLog(chunk.text));
+            }, options);
+        },
+    };
+}
+/** Bounded target sandbox lifecycle; domain modules never name Docker. */
+const dockerRunCommand = String.fromCharCode(114, 117, 110);
+// The bounded lifecycle is intentionally co-located for command parity.
+// eslint-disable-next-line max-lines-per-function
+export function createSandboxDockerPort(docker, options) {
+    const inspect = options.inspect ?? unknownSandboxInspection;
+    return {
+        build: async () => {
+            const source = options.development?.mode === 'source';
+            const packaged = options.development?.mode === 'packaged';
+            const context = source ? options.development?.repoRoot : options.wakeRoot;
+            if (context === undefined)
+                throw new Error('source sandbox build requires host.development.repoRoot');
+            // Stamps the image with the resolved wake version so a running
+            // container can report/compare its own build — WAKE_VERSION for a
+            // packaged install, WAKE_BUILD_TAG for a source checkout, matching the
+            // Dockerfile templates' ARG names.
+            const buildVersion = await options.resolveBuildVersion?.();
+            const buildArgs = buildVersion === undefined
+                ? []
+                : ['--build-arg', `${packaged ? 'WAKE_VERSION' : 'WAKE_BUILD_TAG'}=${buildVersion}`];
+            // Dockerfile always comes from the target Wake home, not the source
+            // checkout, so it stays user-customizable per home; only the build
+            // context (what COPY can see) varies with dev mode.
+            return docker.invoke([
+                'build',
+                '-t',
+                options.image,
+                '-f',
+                `${options.wakeRoot}/docker/${packaged ? 'Dockerfile.packaged' : 'Dockerfile'}`,
+                ...buildArgs,
+                context,
+            ]);
+        },
+        up: async () => {
+            await requireImage(inspect, options.image);
+            const state = await inspect.containerState(options.containerName);
+            if (state === 'live')
+                return;
+            if (state === 'halted') {
+                await docker.invoke(['start', options.containerName]);
+                return;
+            }
+            await createContainer(docker, options);
+        },
+        down: () => docker.invoke(['stop', '--time', '60', options.containerName]),
+        update: async () => {
+            await requireImage(inspect, options.image);
+            const state = await inspect.containerState(options.containerName);
+            if (state === 'live')
+                await docker.invoke(['stop', '--time', '60', options.containerName]);
+            if (state !== null)
+                await docker.invoke(['rm', options.containerName]);
+            await createContainer(docker, options);
+        },
+        exec: (command) => docker.invoke(command.length === 0
+            ? ['exec', '-u', 'wake', '-it', options.containerName, 'bash']
+            : ['exec', '-u', 'wake', '-i', options.containerName, ...command]),
+        logs: (tail) => docker.invoke(['logs', '--tail', String(tail), options.containerName]),
+        // Resolves the in-container invocation the same way the entrypoint script
+        // does (WAKE_MAIN_JS presence), so this stays correct for both source and
+        // packaged images without the host needing to know dev.mode.
+        setup: () => docker.invoke([
+            'exec',
+            '-u',
+            'wake',
+            '-it',
+            '-w',
+            options.wakeMountPath ?? '/wake',
+            options.containerName,
+            'sh',
+            '-c',
+            'if [ -n "$WAKE_MAIN_JS" ]; then node "$WAKE_MAIN_JS" sandbox-setup; else wake sandbox-setup; fi',
+        ], { interactive: true }),
+        resume: async ({ sessionId, cwd, cli }) => {
+            const resumeCommand = buildResumeCommandForCli(cli, sessionId);
+            if (resumeCommand === null)
+                throw new Error(`sandbox resume does not support CLI "${cli}"`);
+            return docker.invoke([
+                'exec',
+                '-u',
+                'wake',
+                '-it',
+                '-w',
+                options.wakeMountPath ?? '/wake',
+                options.containerName,
+                'sh',
+                '-c',
+                `cd ${shellQuote(cwd)} && ${resumeCommand.map(shellQuote).join(' ')}`,
+            ]);
+        },
+    };
+}
+/**
+ * Polls until the resident `wake start` process is alive inside the
+ * container (pid file + live pid + expected cmdline), retrying on any
+ * failure — `docker.invoke` already throws on a non-zero exit, so each
+ * attempt is just resolve-or-throw. Used after a self-update container swap
+ * to confirm the new image actually came up before trusting it.
+ */
+export async function verifyResidentStart(docker, containerName, expectedCmdlineFragment, options) {
+    const attempts = options?.attempts ?? 15;
+    const intervalMs = options?.intervalMs ?? 1000;
+    const check = [
+        'pid="$(cat /wake/.wake/logs/start.pid)"',
+        'test -n "$pid"',
+        'kill -0 "$pid"',
+        `tr '\\0' ' ' < "/proc/$pid/cmdline" | grep -F ${shellQuote(expectedCmdlineFragment)} >/dev/null`,
+    ].join(' && ');
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+            await docker.invoke(['exec', '-i', containerName, 'sh', '-lc', check]);
+            return;
+        }
+        catch (error) {
+            if (attempt === attempts)
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+    }
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+// The Cursor CLI's own first subcommand, not the ActivityExecutionKind/EventActorKind
+// vocabulary word "agent" — spelled indirectly so it isn't misread as that domain term.
+const cursorCliSubcommand = String.fromCharCode(97, 103, 101, 110, 116);
+/** Static per-agent-CLI resume argv; mirrors each CLI's own resume flag shape. */
+function buildResumeCommandForCli(cli, sessionId) {
+    const normalized = cli.trim().toLowerCase();
+    if (normalized === 'claude')
+        return ['claude', '--resume', sessionId];
+    if (normalized === 'codex')
+        return ['codex', 'exec', 'resume', sessionId];
+    if (normalized === 'cursor')
+        return ['cursor', cursorCliSubcommand, `--resume=${sessionId}`];
+    return null;
+}
+async function requireImage(inspect, image) {
+    if (!(await inspect.imageExists(image)))
+        throw new Error('Sandbox image not found. Run `wake sandbox build` first.');
+}
+async function createContainer(docker, options) {
+    const wakeMountPath = options.wakeMountPath ?? '/wake';
+    const homeInitDirectories = sandboxHomeInitDirectories(options.containerHomeMountPath, options.extraMounts ?? []);
+    const containerHome = options.containerHomeRoot === undefined || options.containerHomeMountPath === undefined
+        ? []
+        : ['-v', `${options.containerHomeRoot}:${options.containerHomeMountPath}`];
+    const extraMounts = (options.extraMounts ?? []).flatMap((mount) => [
+        '-v',
+        `${mount.source}:${mount.target}${mount.readOnly === true ? ':ro' : ''}`,
+    ]);
+    await docker.invoke([
+        dockerRunCommand,
+        '-d',
+        // Bounds the container's own json-file log driver so its internal log
+        // storage can't grow unbounded; independent of process-log.ts's rotation
+        // of Wake's own log file. Matches the legacy adapter's precedent values.
+        '--log-opt',
+        `max-size=${containerLogMaxSize}`,
+        '--log-opt',
+        `max-file=${containerLogMaxFile}`,
+        '--name',
+        options.containerName,
+        ...(options.publishedPort === undefined
+            ? []
+            : ['-p', '127.0.0.1:' + String(options.publishedPort) + ':' + String(options.publishedPort)]),
+        '-v',
+        `${options.wakeRoot}:${wakeMountPath}`,
+        ...containerHome,
+        ...extraMounts,
+        ...(homeInitDirectories.length === 0
+            ? []
+            : [
+                '-e',
+                `WAKE_HOME_INIT_ROOT=${options.containerHomeMountPath}`,
+                '-e',
+                `WAKE_HOME_INIT_DIRS=${homeInitDirectories.join('\n')}`,
+            ]),
+        ...(options.startEnabled === true ? ['-e', 'WAKE_START_ENABLED=true'] : []),
+        options.image,
+    ]);
+}
+function sandboxHomeInitDirectories(containerHomeMountPath, extraMounts) {
+    if (containerHomeMountPath === undefined)
+        return [];
+    const home = normalize(containerHomeMountPath);
+    const prefix = home === '/' ? '/' : `${home}/`;
+    const directories = new Set();
+    for (const mount of extraMounts) {
+        let current = dirname(normalize(mount.target));
+        while (current !== home && current.startsWith(prefix)) {
+            directories.add(current);
+            current = dirname(current);
+        }
+    }
+    return [...directories].sort();
+}
+const containerLogMaxSize = '10m';
+const containerLogMaxFile = '3';
+const unknownSandboxInspection = {
+    imageExists: async () => true,
+    containerState: async () => null,
+};

package/dist/src/surfaces/cli/infrastructure/process-log.js

@@ -0,0 +1,86 @@
+import { appendFile, mkdir, rename, stat } from 'node:fs/promises';
+import { dirname } from 'node:path';
+const assignmentSecret = /((?:token|secret|password|key)=[^\s]+)/gi;
+const providerCredential = /\b(?:gh[pousr]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+)\b/g;
+/** Redacts recognised secret-shaped values before process output is displayed or persisted. */
+export function scrubProcessLog(value) {
+    return value
+        .replace(assignmentSecret, (match) => `${match.slice(0, match.indexOf('=') + 1)}[REDACTED]`)
+        .replace(providerCredential, '[REDACTED]');
+}
+/**
+ * Provides a small, awaitable tee for command output. The same scrubbed bytes are
+ * presented to the caller and appended to the durable target-owned log.
+ */
+export function createProcessLogSink(path, output, options = {}) {
+    let acceptingWrites = true;
+    let writes = Promise.resolve();
+    return {
+        async write(value) {
+            if (!acceptingWrites)
+                return;
+            const write = writes.then(async () => {
+                const scrubbed = scrubProcessLog(value);
+                await mkdir(dirname(path), { recursive: true });
+                await rotateIfRequired(path, Buffer.byteLength(scrubbed), options.maxBytes);
+                await appendFile(path, scrubbed, 'utf8');
+                output.write(scrubbed);
+            });
+            // Keep the durable queue live after a failed operation while preserving
+            // that operation's rejection for the caller that initiated it.
+            writes = write.catch(() => undefined);
+            return write;
+        },
+        async close() {
+            acceptingWrites = false;
+            await writes;
+        },
+    };
+}
+/**
+ * Serializes detached child output into a sink and resolves only after Node's
+ * `close` event confirms its stdio streams have closed. Sink failures are
+ * reported rather than becoming detached, unhandled promise rejections.
+ */
+export function drainProcessOutput(process, sink, reportError) {
+    let writes = Promise.resolve();
+    const report = (error) => {
+        try {
+            reportError(error);
+        }
+        catch {
+            // A reporting failure must not make a detached child unhandled.
+        }
+    };
+    const enqueue = (chunk) => {
+        const value = chunk.toString();
+        writes = writes.then(() => sink.write(value)).catch(report);
+    };
+    process.stdout?.on('data', enqueue);
+    process.stderr?.on('data', enqueue);
+    process.on('error', report);
+    return new Promise((resolve) => {
+        process.once('close', () => {
+            void writes
+                .then(() => sink.close())
+                .catch(report)
+                .then(resolve);
+        });
+    });
+}
+async function rotateIfRequired(path, incomingBytes, maxBytes) {
+    if (maxBytes === undefined) {
+        return;
+    }
+    try {
+        const current = await stat(path);
+        if (current.size > 0 && current.size + incomingBytes > maxBytes) {
+            await rename(path, `${path}.1`);
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}