@corenel/cli 0.4.2 → 0.4.4

package/dist/cli.js

@@ -18931,42 +18931,58 @@ function credentialFilePath(stateDir) {
 }
 var TOKEN_ENV = "CORENEL_TOKEN";
 var API_BASE_ENV = "CORENEL_API_BASE";
-async function writeAuthToken(token, stateDir) {
-  const dir = credentialDir(stateDir);
-  const path = tokenFilePath(stateDir);
-  await fs2.mkdir(dir, { recursive: true, mode: 448 });
-  await fs2.writeFile(path, token.trim() + "\n", { mode: 384 });
-  try {
-    await fs2.chmod(path, 384);
-  } catch {
-  }
-  try {
-    await fs2.chmod(dir, 448);
-  } catch {
-  }
-}
 async function writeLoginCredential(token, opts = {}) {
   const cred = {
     accessToken: token.trim(),
     ...opts.account ? { account: opts.account } : {},
     ...opts.apiBase ? { apiBase: opts.apiBase } : {}
   };
-  const path = credentialFilePath(opts.stateDir);
-  await fs2.mkdir(credentialDir(opts.stateDir), { recursive: true, mode: 448 });
-  await fs2.writeFile(path, `${JSON.stringify(cred, null, 2)}
+  const dir = credentialDir(opts.stateDir);
+  const credPath = credentialFilePath(opts.stateDir);
+  const tokPath = tokenFilePath(opts.stateDir);
+  await fs2.mkdir(dir, { recursive: true, mode: 448 });
+  const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+  await fs2.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}
+`, { mode: 384 });
+  await fs2.writeFile(tokTmp, `${cred.accessToken}
 `, { mode: 384 });
   try {
-    await fs2.chmod(path, 384);
+    await fs2.chmod(credTmp, 384);
   } catch {
   }
-  await writeAuthToken(cred.accessToken, opts.stateDir);
+  try {
+    await fs2.chmod(tokTmp, 384);
+  } catch {
+  }
+  try {
+    await fs2.rename(credTmp, credPath);
+    await fs2.rename(tokTmp, tokPath);
+  } catch (e) {
+    try {
+      await fs2.rm(credTmp, { force: true });
+    } catch {
+    }
+    try {
+      await fs2.rm(tokTmp, { force: true });
+    } catch {
+    }
+    throw e;
+  }
+  try {
+    await fs2.chmod(dir, 448);
+  } catch {
+  }
+}
+function isMissing(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
-async function readAuthToken(stateDir) {
+async function readAuthTokenRead(stateDir) {
   try {
     const t = (await fs2.readFile(tokenFilePath(stateDir), "utf8")).trim();
-    return t || null;
-  } catch {
-    return null;
+    return { value: t || null, unreadable: false };
+  } catch (err) {
+    return { value: null, unreadable: !isMissing(err) };
   }
 }
 async function clearAuthToken(stateDir) {
@@ -18975,27 +18991,30 @@ async function clearAuthToken(stateDir) {
   } catch {
   }
 }
-async function readCredentialFile(stateDir) {
+async function readCredentialFileRead(stateDir) {
   let raw;
   try {
     raw = await fs2.readFile(credentialFilePath(stateDir), "utf8");
-  } catch {
-    return null;
+  } catch (err) {
+    return { value: null, unreadable: !isMissing(err) };
   }
   try {
     const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return null;
+    if (typeof parsed !== "object" || parsed === null) return { value: null, unreadable: false };
     const c = parsed;
-    if (typeof c.accessToken !== "string" || !c.accessToken) return null;
+    if (typeof c.accessToken !== "string" || !c.accessToken) return { value: null, unreadable: false };
     return {
-      accessToken: c.accessToken,
-      ...typeof c.refreshToken === "string" ? { refreshToken: c.refreshToken } : {},
-      ...typeof c.expiresAt === "number" ? { expiresAt: c.expiresAt } : {},
-      ...typeof c.account === "string" ? { account: c.account } : {},
-      ...typeof c.apiBase === "string" && c.apiBase ? { apiBase: c.apiBase } : {}
+      value: {
+        accessToken: c.accessToken,
+        ...typeof c.refreshToken === "string" ? { refreshToken: c.refreshToken } : {},
+        ...typeof c.expiresAt === "number" ? { expiresAt: c.expiresAt } : {},
+        ...typeof c.account === "string" ? { account: c.account } : {},
+        ...typeof c.apiBase === "string" && c.apiBase ? { apiBase: c.apiBase } : {}
+      },
+      unreadable: false
     };
   } catch {
-    return null;
+    return { value: null, unreadable: false };
   }
 }
 async function clearAllCredentials(stateDir) {
@@ -19011,20 +19030,29 @@ async function resolveNodeCredential(opts = {}) {
   const stateDir = opts.stateDir;
   const fromEnv = env[TOKEN_ENV]?.trim();
   if (fromEnv) return { token: fromEnv, source: "env" };
-  const cred = await readCredentialFile(stateDir);
-  const fileToken = await readAuthToken(stateDir);
+  const credRead = await readCredentialFileRead(stateDir);
+  const tokenRead = await readAuthTokenRead(stateDir);
+  const cred = credRead.value;
+  const fileToken = tokenRead.value;
+  const unreadable = credRead.unreadable || tokenRead.unreadable ? { unreadable: true } : {};
   if (fileToken) {
     const same = cred && cred.accessToken === fileToken ? cred : null;
-    return withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same, now);
+    return {
+      ...withExpiry({ token: fileToken, source: "token-file", path: tokenFilePath(stateDir) }, same, now),
+      ...unreadable
+    };
   }
   if (cred) {
-    return withExpiry(
-      { token: cred.accessToken, source: "credential-file", path: credentialFilePath(stateDir) },
-      cred,
-      now
-    );
+    return {
+      ...withExpiry(
+        { token: cred.accessToken, source: "credential-file", path: credentialFilePath(stateDir) },
+        cred,
+        now
+      ),
+      ...unreadable
+    };
   }
-  return { token: null, source: "none" };
+  return { token: null, source: "none", ...unreadable };
 }
 function withExpiry(base, cred, now) {
   if (!cred) return base;
@@ -22162,24 +22190,35 @@ import { PermissionService as PermissionService4 } from "@corenel/harness/guardr
 import { ROOT_NODE_ID } from "@corenel/protocol";
 import { makeSpawn } from "@corenel/harness/core/spawn";
 function inMemoryMemory() {
-  const items = [];
-  let n = 0;
+  const items = /* @__PURE__ */ new Map();
   return {
-    async save(text, tags = []) {
-      const it = { id: `m${++n}`, text, tags, createdAt: n };
-      items.push(it);
+    async save(input) {
+      const it = {
+        id: input.name,
+        name: input.name,
+        type: input.type,
+        description: input.description,
+        text: input.body,
+        tags: [],
+        createdAt: Date.now()
+      };
+      items.set(input.name, it);
       return it;
     },
+    async read(name) {
+      return items.get(name) ?? null;
+    },
     async recall(q) {
-      return items.filter((i) => i.text.includes(q));
+      return [...items.values()].filter((i) => i.text.includes(q) || i.description.includes(q));
     },
     async list() {
-      return [...items];
+      return [...items.values()];
     },
-    async forget(id) {
-      const i = items.findIndex((x) => x.id === id);
-      if (i >= 0) items.splice(i, 1);
+    async forget(name) {
+      items.delete(name);
     }
+    // No core(): this stub has no tiers, and Task 9 injects nothing rather than
+    // pretending it has a memory block.
   };
 }
 function inMemoryKv() {
@@ -22211,7 +22250,7 @@ function previewWrite(files) {
 }
 function nodeToolCtx(signal, opts = {}) {
   const base = {
-    memory: inMemoryMemory(),
+    memory: opts.memory ?? inMemoryMemory(),
     kv: inMemoryKv(),
     search: nullSearch,
     confirm: async () => true,
@@ -22252,6 +22291,42 @@ function tokenGuard(getToken) {
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var MIN_POLL_MS = 1e3;
 var DEFAULT_LIFETIME_S = 900;
+var ACCOUNT_LOOKUP_MS = 5e3;
+function deadlineSignal(ms, outer) {
+  const ac = new AbortController();
+  const onOuter = () => ac.abort();
+  const timer = setTimeout(() => ac.abort(), ms);
+  if (outer) {
+    if (outer.aborted) ac.abort();
+    else outer.addEventListener("abort", onOuter, { once: true });
+  }
+  return {
+    signal: ac.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      outer?.removeEventListener("abort", onOuter);
+    }
+  };
+}
+async function whoIsThis(base, token, f, outer, deadlineMs = ACCOUNT_LOOKUP_MS) {
+  const { signal, dispose } = deadlineSignal(deadlineMs, outer);
+  try {
+    const res = await f(`${base}/auth/me`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal
+    });
+    if (!res.ok) return void 0;
+    const body = JSON.parse(await res.text());
+    const email = body?.user?.email;
+    if (typeof email !== "string") return void 0;
+    const trimmed = email.trim();
+    return trimmed ? trimmed : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    dispose();
+  }
+}
 function defaultOpen(uri, code2) {
   process.stdout.write(`
   To authorize, open:  ${uri}
@@ -22300,7 +22375,9 @@ async function deviceLogin(opts) {
       client_id: "corenel-cli"
     });
     if (tok.access_token) {
-      await opts.store(tok.access_token);
+      const claimed = typeof tok.account === "string" ? tok.account.trim() : "";
+      const account = claimed || await whoIsThis(base, tok.access_token, f, opts.signal, opts.accountLookupMs);
+      await opts.store(tok.access_token, account || void 0);
       return tok.access_token;
     }
     if (tok.error === "authorization_pending") continue;
@@ -22450,6 +22527,41 @@ function isValidAgentName(name) {
 // ../crew/store.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { flattenFiles as flattenFiles3 } from "@corenel/protocol";
+
+// ../crew/sessionBinding.ts
+var SESSION_NAME_RE = /^[a-z0-9_-]{1,32}$/;
+function isValidSessionName(name) {
+  return SESSION_NAME_RE.test(name);
+}
+function parseSessionBinding(meta) {
+  const raw = meta.session;
+  if (raw === void 0) return { kind: "absent" };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "malformed", reason: "session: must be a block with `name:` and `workdir:`" };
+  }
+  const o = raw;
+  const name = typeof o.name === "string" ? o.name : "";
+  const workdir = typeof o.workdir === "string" ? o.workdir.trim() : "";
+  if (!isValidSessionName(name)) {
+    return {
+      kind: "malformed",
+      reason: `session.name ${JSON.stringify(name)} must be 1-32 characters of a-z, 0-9, "-" or "_"`
+    };
+  }
+  if (!workdir) return { kind: "malformed", reason: "session.workdir is required" };
+  return {
+    kind: "binding",
+    binding: {
+      name,
+      workdir,
+      // Anything but an explicit `false` is true, matching how `enabled` is read
+      // in store.ts — absent means the default, and the default is on.
+      createIfMissing: o.createIfMissing !== false
+    }
+  };
+}
+
+// ../crew/store.ts
 var TRIGGER_TYPES = [
   "manual",
   "file-change",
@@ -22535,6 +22647,7 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
   const dir = `${root}/${name}`;
   const { meta, body } = parseFrontmatter(await readOr(files, `${dir}/AGENT.md`));
+  const session = parseSessionBinding(meta);
   return {
     name,
     jobTitle: typeof meta.jobTitle === "string" ? meta.jobTitle : "",
@@ -22549,7 +22662,9 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
     policy: parsePolicyYaml(await readOr(files, `${dir}/POLICY.yaml`), name),
     settings: parseSettings(await readOr(files, `${dir}/settings.json`, "{}")),
     budget: parseBudget(meta),
-    canCall: parseCanCall(meta)
+    canCall: parseCanCall(meta),
+    ...session.kind === "binding" ? { session: session.binding } : {},
+    ...session.kind === "malformed" ? { sessionError: session.reason } : {}
   };
 }
 async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
@@ -22566,7 +22681,10 @@ async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
 // ../crew/runtime.ts
 import { saveCustomPolicy } from "@corenel/harness/guardrail";
 import { allTools } from "@corenel/harness/tools/builtins";
+import { registerSyncConfig, readConfigSyncRendered } from "@corenel/harness/prompts/syncConfig";
 import { makeCallAgentTool } from "@corenel/harness/tools/callAgent";
+var MEMORY_BLOCK = registerSyncConfig("crew/memory.md");
+var SELF_DIRECTION_BLOCK = registerSyncConfig("crew/self-direction.md");
 function buildSystemExtra(def, memoryLocation) {
   const parts = [];
   if (def.jobTitle?.trim()) parts.push(`--- Role ---
@@ -22580,11 +22698,7 @@ ${def.instructions.trim()}`);
   const location = memoryLocation ?? "memory/";
   const dir = location.replace(/\/+$/, "");
   const index = `${dir}/MEMORY.md`;
-  parts.push(
-    `--- Memory ---
-You keep durable notes in your own memory folder, \`${dir}/\`, one Markdown file per note, alongside \`${index}\`, an index you maintain for yourself.
-Read \`${index}\` at the start of a run to recall what you already know, and call recall_memory to look up one note by name. If you can call save_memory, use it for what is worth knowing on a later run, and keep \`${index}\` current as you do. If a file tool you have takes a \`root\` argument, you can pass \`${dir}/\` as \`root\` to read and edit those files directly.`
-  );
+  parts.push(readConfigSyncRendered(MEMORY_BLOCK, { dir, index }));
   const selfDirection = selfDirectionBlock(def);
   if (selfDirection) parts.push(selfDirection);
   return parts.join("\n\n");
@@ -22595,23 +22709,58 @@ function selfDirectionBlock(def) {
   const raw = trigger.config?.fallbackMs;
   const fallbackMs = typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : null;
   const consequence = fallbackMs == null ? "If this run ends without that call, nothing will wake it again and your work stops here until someone starts you by hand." : `If this run ends without that call you will be woken anyway, about ${Math.round(fallbackMs / 6e4)} minutes from now -- but that is a backstop for a run that could not schedule itself, not a substitute for choosing when you should next run.`;
-  return `--- Self-direction ---
-You run on your own schedule. You will not run again unless you call \`schedule_self\` with the time you should next wake, before this run ends.
-${consequence}
-So decide, before you finish, whether there is more to do and when it should happen.`;
+  return readConfigSyncRendered(SELF_DIRECTION_BLOCK, { consequence });
 }
 
 // ../crew/memory.ts
-import { flattenFiles as flattenFiles4 } from "@corenel/protocol";
-import { parseFact, renderFact, slugify, uniqueSlug, FACT_INDEX } from "@corenel/harness/core/factFile";
+import { makeFactStore } from "@corenel/harness/memory/store";
+function agentMemoryRoot(crewRoot, agentName) {
+  return `${crewRoot}/${agentName}/memory`;
+}
+function makeAgentMemoryProvider(getFiles, memoryRoot) {
+  const store = makeFactStore(getFiles, memoryRoot);
+  const toItem = (f) => ({
+    id: f.name,
+    name: f.name,
+    type: f.type,
+    description: f.description,
+    text: f.body,
+    tags: [],
+    createdAt: f.created
+  });
+  return {
+    async save(input) {
+      return toItem(await store.save(input));
+    },
+    async read(name) {
+      const hit = await store.read(name);
+      return hit ? toItem(hit) : null;
+    },
+    async recall(query, limit) {
+      return (await store.recall(query, limit)).map(toItem);
+    },
+    async list(limit) {
+      return (await store.list(limit)).map(toItem);
+    },
+    async forget(name) {
+      return store.forget(name);
+    },
+    async core() {
+      const block = await store.core();
+      return { items: block.facts.map(toItem), archivedCount: block.archivedCount };
+    }
+  };
+}
 
 // ../crew/room/store.ts
-import { flattenFiles as flattenFiles5 } from "@corenel/protocol";
+import { flattenFiles as flattenFiles4 } from "@corenel/protocol";
 import { encodeLine, foldSession } from "@corenel/harness/sessions/jsonl";
 import { FINDINGS_FILE, encodeFindingLine, foldFindings } from "@corenel/harness/rooms/findings";
 
 // ../crew/room/prompt.ts
+import { registerSyncConfig as registerSyncConfig2, readConfigSyncRendered as readConfigSyncRendered2 } from "@corenel/harness/prompts/syncConfig";
 import { MAX_ROOM_FINDINGS, renderFindings } from "@corenel/harness/rooms/findings";
+var ROOM_BLOCK = registerSyncConfig2("crew/room.md");
 
 // ../crew/room/turn.ts
 import { readRoomOutcome } from "@corenel/harness/tools/roomTools";
@@ -22641,6 +22790,12 @@ function workspaceStateDir() {
   const fromEnv = process.env.CORENEL_STATE_DIR;
   return fromEnv && /^\.[A-Za-z0-9][A-Za-z0-9._-]*$/.test(fromEnv) ? fromEnv : stateDirName3();
 }
+function guestCrewRoot() {
+  return `${workspaceStateDir()}/${CREW_SEG}`;
+}
+function guestAgentMemoryRoot(agent) {
+  return agentMemoryRoot(guestCrewRoot(), agent);
+}
 function mutatingCeiling(tools, defaultLevel = "deny") {
   const overrides = {};
   for (const t of tools) if (!t.mutates) overrides[toolAddress(t)] = "allow";
@@ -22656,7 +22811,9 @@ function eventLine(e) {
 }
 async function runCrewAgentCli(opts) {
   const files = new NodeFileService(opts.cwd);
-  const root = `${workspaceStateDir()}/${CREW_SEG}`;
+  const root = guestCrewRoot();
+  const memoryRoot = guestAgentMemoryRoot(opts.agent);
+  const memory = makeAgentMemoryProvider(() => files, memoryRoot);
   const def = await loadCrewAgentAtIfExists(files, root, opts.agent, "workspace");
   if (!def) {
     opts.warn(`no such agent "${opts.agent}" under ${opts.cwd}/${root}`);
@@ -22674,7 +22831,7 @@ async function runCrewAgentCli(opts) {
   }
   registerGuard(tokenGuard(() => token));
   const tools = allTools2();
-  const extra = buildSystemExtra(def);
+  const extra = buildSystemExtra(def, memoryRoot);
   let system = extra;
   try {
     const base = await composeAgentSystem({
@@ -22717,7 +22874,7 @@ ${extra}` : base;
       // Cause-aware refusal text -- see cli.ts's `run()` for why the kernel's
       // own "denied by the user" default would be a lie on this path.
       describePermissionDenial: nonInteractiveDenialMessage,
-      toolCtx: nodeToolCtx(ac.signal, { files }),
+      toolCtx: nodeToolCtx(ac.signal, { files, memory }),
       policy: effectivePolicy,
       signal: ac.signal,
       onEvent: (e) => opts.emit(eventLine(e))
@@ -23729,9 +23886,14 @@ function isOnValue(value) {
   return value === void 0 || !FALSY_FLAG_VALUES.has(value.toLowerCase());
 }
 function hasBooleanFlag(argv, name) {
-  for (const tok of argv) {
-    const parsed = classifyToken(tok);
-    if (!parsed || parsed.name !== name) continue;
+  for (let i = 0; i < argv.length; i++) {
+    const parsed = classifyToken(argv[i]);
+    if (!parsed) continue;
+    if (parsed.value === void 0 && !isBooleanFlag(parsed.name)) {
+      i++;
+      continue;
+    }
+    if (parsed.name !== name) continue;
     if (isOnValue(parsed.value)) return true;
   }
   return false;
@@ -24245,10 +24407,14 @@ async function main() {
       }
       case "login": {
         const base = await apiBase(flag(rest, "base", ""));
-        await deviceLogin({ base, store: (token) => writeLoginCredential(token, { apiBase: base }) });
+        await deviceLogin({
+          base,
+          store: (token, account) => writeLoginCredential(token, { apiBase: base, ...account ? { account } : {} })
+        });
         process.stdout.write(`
 Logged in. Token saved to ${authTokenPath()}
 `);
+        process.stdout.write("If a sidecar daemon is already running, restart it to sign it in as well.\n");
         break;
       }
       case "auth":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/cli",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "type": "module",
   "description": "Corenel CLI — runs the harness in node, in-proc, no transport. The headless proof the kernel is host-agnostic. (corenel run/ask/chat/login + start --sidecar to follow.)",
   "bin": {
@@ -9,9 +9,9 @@
   "dependencies": {
     "openai": "^4.77.0",
     "ws": "^8.18.0",
-    "@corenel/harness": "0.6.0",
-    "@corenel/protocol": "0.6.0",
-    "@corenel/term": "0.2.2"
+    "@corenel/harness": "0.6.1",
+    "@corenel/term": "0.2.3",
+    "@corenel/protocol": "0.6.1"
   },
   "devDependencies": {
     "esbuild": "^0.21.5",
@@ -19,7 +19,7 @@
     "@types/ws": "^8.5.13",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/tools-node": "0.3.0",
+    "@corenel/tools-node": "0.3.1",
     "@corenel/crew": "0.0.0"
   },
   "publishConfig": {