@corenel/cli 0.4.1 → 0.4.2

package/dist/cli.js

@@ -18832,7 +18832,7 @@ var NodeFileService = class {
           out.push({ name: e.name, path, kind: "directory", children: await walk(absChild) });
         } else {
           const st = await fs.stat(absChild).catch(() => null);
-          out.push({ name: e.name, path, kind: "file", size: st?.size, ext: extOf(e.name) });
+          out.push({ name: e.name, path, kind: "file", size: st?.size, mtime: st?.mtimeMs, ext: extOf(e.name) });
         }
       }
       return out;
@@ -18845,7 +18845,7 @@ var NodeFileService = class {
   async stat(path) {
     try {
       const st = await fs.stat(this.abs(path));
-      return { path: normalizeFilePath(path), kind: st.isDirectory() ? "directory" : "file", size: st.size, ext: extOf(path) };
+      return { path: normalizeFilePath(path), kind: st.isDirectory() ? "directory" : "file", size: st.size, mtime: st.mtimeMs, ext: extOf(path) };
     } catch {
       return null;
     }
@@ -18910,7 +18910,7 @@ var NodeFileService = class {
 import { promises as fs2 } from "node:fs";
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
-import { stateDirName } from "@corenel/protocol";
+import { stateDirName, DEFAULT_API_BASE } from "@corenel/protocol";
 function corenelDir(base = homedir()) {
   return join2(base, stateDirName());
 }
@@ -18920,34 +18920,142 @@ function sidecarDir(base = homedir()) {
 function authTokenPath(base = homedir()) {
   return join2(corenelDir(base), "token");
 }
-async function writeAuthToken(token) {
-  await fs2.mkdir(corenelDir(), { recursive: true, mode: 448 });
-  await fs2.writeFile(authTokenPath(), token.trim() + "\n", { mode: 384 });
+function credentialDir(stateDir) {
+  return stateDir ?? corenelDir();
+}
+function tokenFilePath(stateDir) {
+  return join2(credentialDir(stateDir), "token");
+}
+function credentialFilePath(stateDir) {
+  return join2(credentialDir(stateDir), "auth.json");
+}
+var TOKEN_ENV = "CORENEL_TOKEN";
+var API_BASE_ENV = "CORENEL_API_BASE";
+async function writeAuthToken(token, stateDir) {
+  const dir = credentialDir(stateDir);
+  const path = tokenFilePath(stateDir);
+  await fs2.mkdir(dir, { recursive: true, mode: 448 });
+  await fs2.writeFile(path, token.trim() + "\n", { mode: 384 });
   try {
-    await fs2.chmod(authTokenPath(), 384);
+    await fs2.chmod(path, 384);
   } catch {
   }
   try {
-    await fs2.chmod(corenelDir(), 448);
+    await fs2.chmod(dir, 448);
+  } catch {
+  }
+}
+async function writeLoginCredential(token, opts = {}) {
+  const cred = {
+    accessToken: token.trim(),
+    ...opts.account ? { account: opts.account } : {},
+    ...opts.apiBase ? { apiBase: opts.apiBase } : {}
+  };
+  const path = credentialFilePath(opts.stateDir);
+  await fs2.mkdir(credentialDir(opts.stateDir), { recursive: true, mode: 448 });
+  await fs2.writeFile(path, `${JSON.stringify(cred, null, 2)}
+`, { mode: 384 });
+  try {
+    await fs2.chmod(path, 384);
   } catch {
   }
+  await writeAuthToken(cred.accessToken, opts.stateDir);
 }
-async function readAuthToken() {
+async function readAuthToken(stateDir) {
   try {
-    const t = (await fs2.readFile(authTokenPath(), "utf8")).trim();
+    const t = (await fs2.readFile(tokenFilePath(stateDir), "utf8")).trim();
     return t || null;
   } catch {
     return null;
   }
 }
-async function clearAuthToken() {
+async function clearAuthToken(stateDir) {
   try {
-    await fs2.rm(authTokenPath(), { force: true });
+    await fs2.rm(tokenFilePath(stateDir), { force: true });
   } catch {
   }
 }
-function nodeAuthToken() {
-  return { getToken: async () => await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null };
+async function readCredentialFile(stateDir) {
+  let raw;
+  try {
+    raw = await fs2.readFile(credentialFilePath(stateDir), "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const c = parsed;
+    if (typeof c.accessToken !== "string" || !c.accessToken) return null;
+    return {
+      accessToken: c.accessToken,
+      ...typeof c.refreshToken === "string" ? { refreshToken: c.refreshToken } : {},
+      ...typeof c.expiresAt === "number" ? { expiresAt: c.expiresAt } : {},
+      ...typeof c.account === "string" ? { account: c.account } : {},
+      ...typeof c.apiBase === "string" && c.apiBase ? { apiBase: c.apiBase } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+async function clearAllCredentials(stateDir) {
+  await clearAuthToken(stateDir);
+  try {
+    await fs2.rm(credentialFilePath(stateDir), { force: true });
+  } catch {
+  }
+}
+async function resolveNodeCredential(opts = {}) {
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? Date.now;
+  const stateDir = opts.stateDir;
+  const fromEnv = env[TOKEN_ENV]?.trim();
+  if (fromEnv) return { token: fromEnv, source: "env" };
+  const cred = await readCredentialFile(stateDir);
+  const fileToken = await readAuthToken(stateDir);
+  if (fileToken) {
+    const same = cred && cred.accessToken === fileToken ? cred : null;
+    return withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same, now);
+  }
+  if (cred) {
+    return withExpiry(
+      { token: cred.accessToken, source: "credential-file", path: credentialFilePath(stateDir) },
+      cred,
+      now
+    );
+  }
+  return { token: null, source: "none" };
+}
+function withExpiry(base, cred, now) {
+  if (!cred) return base;
+  const expired = typeof cred.expiresAt === "number" && cred.expiresAt <= now();
+  return {
+    ...base,
+    ...typeof cred.expiresAt === "number" ? { expiresAt: cred.expiresAt } : {},
+    ...expired ? { expired: true } : {},
+    ...cred.account ? { account: cred.account } : {},
+    ...cred.apiBase ? { apiBase: cred.apiBase } : {}
+  };
+}
+async function resolveApiBase(opts = {}) {
+  const explicit = opts.explicit?.trim();
+  if (explicit) return { base: explicit, source: "explicit" };
+  const fromEnv = (opts.env ?? process.env)[API_BASE_ENV]?.trim();
+  if (fromEnv) return { base: fromEnv, source: "env" };
+  const cred = await resolveNodeCredential({
+    env: {},
+    ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+  });
+  if (cred.apiBase) return { base: cred.apiBase, source: "credential" };
+  return { base: DEFAULT_API_BASE, source: "default" };
+}
+function maskToken(token) {
+  const t = token.trim();
+  if (t.length <= 8) return "****";
+  return `${t.slice(0, 4)}\u2026${t.slice(-2)} (${t.length} chars)`;
+}
+function nodeAuthToken(stateDir) {
+  return { getToken: async () => (await resolveNodeCredential(stateDir ? { stateDir } : {})).token };
 }
 
 // ../../node_modules/.pnpm/@prompd+core@0.5.0-beta.10/node_modules/@prompd/core/dist/index.js
@@ -22048,7 +22156,7 @@ function configWorkspaceRoot(base) {
 // src/cli.ts
 import { FileRecallStore, UNATTACHED_SESSION } from "@corenel/harness/sessions/fileRecallStore";
 import { stateDirName as stateDirName6 } from "@corenel/protocol";
-import { PermissionService as PermissionService3 } from "@corenel/harness/guardrail/permission-service";
+import { PermissionService as PermissionService4 } from "@corenel/harness/guardrail/permission-service";
 
 // src/nodeContext.ts
 import { ROOT_NODE_ID } from "@corenel/protocol";
@@ -22209,7 +22317,7 @@ import { runAgent } from "@corenel/harness/core/loop";
 import { createChatClient, setGatewayBase } from "@corenel/harness/providers/gateway";
 
 // src/apiBase.ts
-var DEFAULT_API_BASE = "https://api.corenel.ai/api";
+import { DEFAULT_API_BASE as DEFAULT_API_BASE2 } from "@corenel/protocol";
 var InvalidApiBaseError = class extends Error {
   constructor(value, why) {
     super(`invalid API base ${JSON.stringify(value)} -- ${why}`);
@@ -22223,8 +22331,13 @@ function isLoopback(hostname) {
   return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
 }
 var warnedCleartext = false;
-function apiBase(explicit) {
-  const value = explicit || process.env.CORENEL_API_BASE || DEFAULT_API_BASE;
+async function apiBase(explicit, opts = {}) {
+  const resolved = await resolveApiBase({
+    explicit,
+    env: opts.env ?? process.env,
+    ...opts.stateDir ? { stateDir: opts.stateDir } : {}
+  });
+  const value = resolved.base;
   let url;
   try {
     url = new URL(value);
@@ -22454,7 +22567,7 @@ async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
 import { saveCustomPolicy } from "@corenel/harness/guardrail";
 import { allTools } from "@corenel/harness/tools/builtins";
 import { makeCallAgentTool } from "@corenel/harness/tools/callAgent";
-function buildSystemExtra(def) {
+function buildSystemExtra(def, memoryLocation) {
   const parts = [];
   if (def.jobTitle?.trim()) parts.push(`--- Role ---
 ${def.jobTitle.trim()}`);
@@ -22464,12 +22577,57 @@ ${def.soul.trim()}`);
 ${def.persona.trim()}`);
   if (def.instructions.trim()) parts.push(`--- Instructions ---
 ${def.instructions.trim()}`);
+  const location = memoryLocation ?? "memory/";
+  const dir = location.replace(/\/+$/, "");
+  const index = `${dir}/MEMORY.md`;
+  parts.push(
+    `--- Memory ---
+You keep durable notes in your own memory folder, \`${dir}/\`, one Markdown file per note, alongside \`${index}\`, an index you maintain for yourself.
+Read \`${index}\` at the start of a run to recall what you already know, and call recall_memory to look up one note by name. If you can call save_memory, use it for what is worth knowing on a later run, and keep \`${index}\` current as you do. If a file tool you have takes a \`root\` argument, you can pass \`${dir}/\` as \`root\` to read and edit those files directly.`
+  );
+  const selfDirection = selfDirectionBlock(def);
+  if (selfDirection) parts.push(selfDirection);
   return parts.join("\n\n");
 }
+function selfDirectionBlock(def) {
+  const trigger = def.triggers?.find((t) => t.type === "self-directed");
+  if (!trigger) return null;
+  const raw = trigger.config?.fallbackMs;
+  const fallbackMs = typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : null;
+  const consequence = fallbackMs == null ? "If this run ends without that call, nothing will wake it again and your work stops here until someone starts you by hand." : `If this run ends without that call you will be woken anyway, about ${Math.round(fallbackMs / 6e4)} minutes from now -- but that is a backstop for a run that could not schedule itself, not a substitute for choosing when you should next run.`;
+  return `--- Self-direction ---
+You run on your own schedule. You will not run again unless you call \`schedule_self\` with the time you should next wake, before this run ends.
+${consequence}
+So decide, before you finish, whether there is more to do and when it should happen.`;
+}
+
+// ../crew/memory.ts
+import { flattenFiles as flattenFiles4 } from "@corenel/protocol";
+import { parseFact, renderFact, slugify, uniqueSlug, FACT_INDEX } from "@corenel/harness/core/factFile";
+
+// ../crew/room/store.ts
+import { flattenFiles as flattenFiles5 } from "@corenel/protocol";
+import { encodeLine, foldSession } from "@corenel/harness/sessions/jsonl";
+import { FINDINGS_FILE, encodeFindingLine, foldFindings } from "@corenel/harness/rooms/findings";
+
+// ../crew/room/prompt.ts
+import { MAX_ROOM_FINDINGS, renderFindings } from "@corenel/harness/rooms/findings";
+
+// ../crew/room/turn.ts
+import { readRoomOutcome } from "@corenel/harness/tools/roomTools";
+
+// ../crew/room/turnRuntime.ts
+import { PermissionService } from "@corenel/harness/guardrail";
+import { BudgetMeter, mergeSignals } from "@corenel/harness/core/budget";
+import { makeRoomTools, ROOM_TOOL_NAMES } from "@corenel/harness/tools/roomTools";
+
+// ../crew/room/engine.ts
+import { describeParticipants, resolveAddressee } from "@corenel/harness/tools/roomTools";
+import { planFindingEdit, planFindingEdits } from "@corenel/harness/rooms/findings";
 
 // src/runAgent.ts
 import { stateDirName as stateDirName3 } from "@corenel/protocol";
-import { PermissionService } from "@corenel/harness/guardrail/permission-service";
+import { PermissionService as PermissionService2 } from "@corenel/harness/guardrail/permission-service";
 import { STANDARD_POLICY } from "@corenel/harness/guardrail/builtins";
 import { toolAddress } from "@corenel/harness/tools/namespaces";
 
@@ -22508,7 +22666,7 @@ async function runCrewAgentCli(opts) {
     opts.warn(`agent "${opts.agent}" is disabled; enable it before running`);
     return 2;
   }
-  setGatewayBase(apiBase(opts.base));
+  setGatewayBase(await apiBase(opts.base));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     opts.warn("not signed in: set CORENEL_TOKEN, or run `corenel login` on this machine");
@@ -22543,7 +22701,7 @@ ${extra}` : base;
   if (operatorUnattended === "park" && !unattendedAllow) {
     opts.warn(`corenel: policy "${effectivePolicy.name}" asks to park an unattended action, but run-agent cannot wait -- refusing.`);
   }
-  const permission = new PermissionService({
+  const permission = new PermissionService2({
     policy: effectivePolicy,
     ceiling: mutatingCeiling(tools, "ask"),
     ...unattendedAllow ? { prompt: { ask: async () => "allow" } } : {}
@@ -22819,16 +22977,13 @@ function version(read = (p) => readFileSync2(p, "utf8")) {
 
 // src/auth.ts
 function hintOf(token) {
-  const t = token.trim();
-  if (t.length <= 8) return "****";
-  return `${t.slice(0, 4)}\u2026${t.slice(-2)} (${t.length} chars)`;
+  return maskToken(token);
 }
-async function authState(read = readAuthToken, env = process.env) {
-  const path = authTokenPath();
-  const stored = await read();
-  if (stored) return { source: "file", path, hint: hintOf(stored) };
-  if (env.CORENEL_TOKEN) return { source: "env", path, hint: hintOf(env.CORENEL_TOKEN) };
-  return { source: "none", path };
+async function authState(resolve2 = (env2) => resolveNodeCredential({ env: env2 }), env = process.env) {
+  const r = await resolve2(env);
+  if (!r.token) return { source: "none", path: authTokenPath() };
+  const source = r.source === "env" ? "env" : "file";
+  return { source, path: r.path ?? authTokenPath(), hint: hintOf(r.token) };
 }
 function describeAuth(s, base) {
   if (s.source === "none") {
@@ -22846,12 +23001,12 @@ function describeAuth(s, base) {
   ].filter(Boolean).join("\n");
 }
 async function runAuth(out = (s) => process.stdout.write(s)) {
-  out(`${describeAuth(await authState(), apiBase())}
+  out(`${describeAuth(await authState(), await apiBase())}
 `);
 }
 async function runLogout(out = (s) => process.stdout.write(s)) {
   const before = await authState();
-  await clearAuthToken();
+  await clearAllCredentials();
   if (before.source === "file") out(`Signed out. Removed ${before.path}
 `);
   else out("Nothing to forget \u2014 no stored token.\n");
@@ -22892,7 +23047,7 @@ async function checkToken(base, token, f = fetch) {
   return { name: "token", status: "ok", detail: `accepted by ${base} (${res.status})` };
 }
 async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
-  const base = apiBase();
+  const base = await apiBase();
   const checks = [
     { name: "binary", status: "ok", detail: selfPath() },
     { name: "version", status: "ok", detail: `@corenel/cli ${version()}` },
@@ -22900,7 +23055,7 @@ async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
     {
       name: "api",
       status: "ok",
-      detail: base === DEFAULT_API_BASE ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE})`
+      detail: base === DEFAULT_API_BASE2 ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE2})`
     }
   ];
   try {
@@ -22917,7 +23072,7 @@ async function collectChecks(f = fetch, modelId = DEFAULT_MODEL) {
     status: auth.source === "none" ? "warn" : "ok",
     detail: auth.source === "none" ? "no" : `yes, from ${auth.source === "env" ? "CORENEL_TOKEN" : auth.path} (${auth.hint})`
   });
-  checks.push(await checkToken(base, await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null, f));
+  checks.push(await checkToken(base, (await resolveNodeCredential()).token, f));
   const sidecar = findSidecarEntry();
   checks.push({
     name: "sidecar",
@@ -22948,7 +23103,7 @@ ${failed.length} problem${failed.length > 1 ? "s" : ""} above.
 
 // src/repl.ts
 import { createInterface } from "node:readline";
-import { PermissionService as PermissionService2 } from "@corenel/harness/guardrail/permission-service";
+import { PermissionService as PermissionService3 } from "@corenel/harness/guardrail/permission-service";
 import { STANDARD_POLICY as STANDARD_POLICY2 } from "@corenel/harness/guardrail/builtins";
 import { TermSession } from "@corenel/term/session";
 import { describeToolCall, formatOrd } from "@corenel/term/describe";
@@ -23126,7 +23281,7 @@ async function runRepl(deps) {
     }
   };
   rl.on("SIGINT", onSigint);
-  const permission = new PermissionService2({
+  const permission = new PermissionService3({
     policy: deps.policy ?? STANDARD_POLICY2,
     prompt: {
       ask: async (req) => {
@@ -23804,7 +23959,7 @@ async function resolvePolicy(opts) {
 // src/cli.ts
 var EXIT_POLICY_PARK_REFUSED = 3;
 async function agentSetup(argv) {
-  setGatewayBase2(apiBase(flag(argv, "base", "")));
+  setGatewayBase2(await apiBase(flag(argv, "base", "")));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     process.stderr.write("corenel: not signed in.\n  Run `corenel login`, or set CORENEL_TOKEN=<token> (a gateway bearer token), then try again.\n");
@@ -23890,7 +24045,7 @@ async function run(argv) {
       process.exitCode = EXIT_POLICY_PARK_REFUSED;
       return;
     }
-    const permission = new PermissionService3({
+    const permission = new PermissionService4({
       policy,
       ceiling: mutatingCeiling(tools, "ask"),
       ...unattendedAllow ? { prompt: { ask: async () => "allow" } } : {}
@@ -24089,8 +24244,8 @@ async function main() {
         break;
       }
       case "login": {
-        const base = apiBase(flag(rest, "base", ""));
-        await deviceLogin({ base, store: writeAuthToken });
+        const base = await apiBase(flag(rest, "base", ""));
+        await deviceLogin({ base, store: (token) => writeLoginCredential(token, { apiBase: base }) });
         process.stdout.write(`
 Logged in. Token saved to ${authTokenPath()}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/cli",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "type": "module",
   "description": "Corenel CLI — runs the harness in node, in-proc, no transport. The headless proof the kernel is host-agnostic. (corenel run/ask/chat/login + start --sidecar to follow.)",
   "bin": {
@@ -9,9 +9,9 @@
   "dependencies": {
     "openai": "^4.77.0",
     "ws": "^8.18.0",
-    "@corenel/harness": "0.4.1",
-    "@corenel/protocol": "0.4.1",
-    "@corenel/term": "0.2.1"
+    "@corenel/harness": "0.6.0",
+    "@corenel/protocol": "0.6.0",
+    "@corenel/term": "0.2.2"
   },
   "devDependencies": {
     "esbuild": "^0.21.5",
@@ -19,8 +19,8 @@
     "@types/ws": "^8.5.13",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/crew": "0.0.0",
-    "@corenel/tools-node": "0.2.2"
+    "@corenel/tools-node": "0.3.0",
+    "@corenel/crew": "0.0.0"
   },
   "publishConfig": {
     "access": "public"
@@ -33,6 +33,11 @@
   "engines": {
     "node": ">=18"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Prompd/prompd-web.git",
+    "directory": "packages/cli"
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "prestart": "pnpm --filter @corenel/protocol build && pnpm --filter @corenel/harness build && pnpm --filter @corenel/term build",