@cozibud/harness 0.2.0 → 0.3.0

package/README.md

@@ -1,9 +1,32 @@
 # `@cozibud/harness`
 
-Connect a signed-in Codex CLI to your Cozibud household for watch voice.
+Connect a signed-in Codex CLI to your Cozibud household for baby-care questions
+and actions in the web and phone apps, and watch voice.
 Keep the computer awake and the outbound relay running while using voice.
-Watch voice requires Codex CLI 0.159.0 or newer and a server supporting relay
-protocol 2. This source version still needs its package and server release.
+This harness requires Codex CLI 0.160.0 or newer. Watch voice needs a server supporting relay
+protocol 2. Web and phone baby-care conversations require harness 0.3.0,
+Codex CLI 0.160.0 or newer, and a server supporting relay protocol 3.
+This source version still needs its package and server release.
+
+## Web and phone baby care
+
+Enable Voice and text entry in Settings and choose Codex on your computer.
+Ask about the selected baby's last sleep, follow up about its duration, record
+care, manage timers, or ask for summaries, trends, routines and caregiver coverage.
+The server uses the same baby-care MCP handlers and permissions as other clients.
+Availability of medication and symptom recording follows the server's policy.
+Switch the selected child before asking about another baby.
+
+Corrections, deletions, restores, bulk changes and care-plan changes show the
+exact proposal before execution. Choose Confirm change to apply it, or Cancel
+to leave it unchanged. Approval expires after five minutes; a record changed
+elsewhere requires a new proposal. A text message alone cannot approve a proposal.
+
+The interpreter has no shell, filesystem, browser, image, memory, plugin or
+external MCP access. It proposes operations to a closed server-side baby-care
+allowlist. Mother tools, feedback and unrelated applications are excluded.
+No separate Codex MCP connection is needed for this path. Your signed-in Codex
+client receives the transcript and bounded baby-care context/results.
 
 ## Watch voice
 
@@ -28,6 +51,12 @@ child context go to your signed-in Codex client and its model service.
 Your Codex login stays local. Pairing credentials are protected with your
 Windows account's DPAPI on Windows, or a user-only file on other systems.
 Disconnect the computer in Cozibud's Watch settings to revoke its access.
+Each Cozibud account can pair two computers. The one connected longest answers
+requests from the web app, the phone app and the watch; the other is a backup
+that takes over when the first stops reporting in. Run `pair` again on a computer
+to replace its pairing, or choose the household and account by signing in to the
+one you want when you approve the link. Codex uses whichever account `codex login`
+signed in (set `CODEX_HOME` to keep a separate Codex profile).
 Use `COZIBUD_RELAY_URL` to choose another HTTPS server before pairing; pairings
 are scoped to that origin. The relay requires no inbound computer port.
 The separate local HTTP adapter must remain on loopback.

package/dist/cli.js

@@ -7,6 +7,7 @@ import { ensureRelayPairing, pairRelay, relayOrigin } from "./pairing.js";
 import { createBuiltInDrivers } from "./process-driver.js";
 import { FileRelayExecutionStore, OutboundRelayBridge, RelayTransportError } from "./relay-client.js";
 import { HarnessRuntime } from "./runtime.js";
+import { RelayPollDelay, relayPause as pause } from "./relay-polling.js";
 import { createHarnessHttpServer } from "./server.js";
 import { DEFAULT_COZIBUD_MCP_URL, setupProvider } from "./setup.js";
 function value(args, name, fallback) {
@@ -65,8 +66,8 @@ async function relay(args) {
     if (available.state === "unavailable")
         throw new Error(available.message);
     const version = available.version?.match(/(\d+)\.(\d+)\.(\d+)/);
-    if (!version || (Number(version[1]) === 0 && Number(version[2]) < 159))
-        throw new Error("Watch voice requires Codex CLI 0.159.0 or newer. Update Codex, sign in, and retry.");
+    if (!version || (Number(version[1]) === 0 && Number(version[2]) < 160))
+        throw new Error("Baby-care relay requires Codex CLI 0.160.0 or newer. Update Codex, sign in, and retry.");
     const controller = new AbortController();
     process.once("SIGINT", () => controller.abort());
     process.once("SIGTERM", () => controller.abort());
@@ -75,25 +76,31 @@ async function relay(args) {
     const createBridge = () => {
         const namespace = createHash("sha256").update(`${baseUrl}\n${credential}`).digest("hex").slice(0, 20);
         const statePath = process.env.COZIBUD_RELAY_STATE?.trim() || join(homedir(), ".cozibud", `relay-state-${namespace}.json`);
-        return new OutboundRelayBridge({ baseUrl, credential, driver, store: new FileRelayExecutionStore(statePath) });
+        return new OutboundRelayBridge({ baseUrl, credential, driver, store: new FileRelayExecutionStore(statePath), signal: controller.signal });
     };
     let bridge = createBridge();
     let repaired = false;
     let connected = false;
     let backoffMs = 1_000;
+    const pollDelay = new RelayPollDelay();
     while (!controller.signal.aborted) {
         try {
             if (!connected) {
                 await bridge.connect();
                 connected = true;
                 backoffMs = 1_000;
+                pollDelay.reset();
                 console.log(`Cozibud relay connected with ${driver.label}. No local or LAN listener is open.`);
             }
             const state = await bridge.step();
-            if (state === "idle")
-                await pause(1_000, controller.signal);
+            const waitMs = pollDelay.after(state, bridge.hasPendingExecution);
+            if (waitMs > 0)
+                await pause(waitMs, controller.signal);
         }
         catch (error) {
+            if (controller.signal.aborted)
+                break;
+            pollDelay.reset();
             if (error instanceof RelayTransportError && [401, 403, 404].includes(error.status)) {
                 await bridge.close();
                 if ([401, 403].includes(error.status) && !process.env.COZIBUD_RELAY_CREDENTIAL?.trim() && !repaired && !controller.signal.aborted) {
@@ -207,12 +214,3 @@ catch (error) {
     console.error(error instanceof Error ? error.message : "The local harness failed.");
     process.exitCode = 1;
 }
-function pause(ms, signal) {
-    return new Promise(resolve => {
-        const done = () => { clearTimeout(timer); signal.removeEventListener("abort", done); resolve(); };
-        const timer = setTimeout(done, ms);
-        signal.addEventListener("abort", done, { once: true });
-        if (signal.aborted)
-            done();
-    });
-}

package/dist/pairing.js

@@ -73,6 +73,8 @@ export async function pairRelay(options) {
             interval += 5;
             continue;
         }
+        if (result.error?.code === "bridge_limit")
+            throw new Error("Your account already has two computers paired. Disconnect one in Cozibud under Settings → Connected devices → Computers, then run pair again.");
         throw new Error("Pairing was denied or expired. Run pair again.");
     }
     throw new Error("Pairing expired. Run pair again.");

package/dist/process-driver.js

@@ -1,8 +1,8 @@
 import { spawn } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { delimiter, isAbsolute, join } from "node:path";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { ensureCursorWorkspace } from "./cursor-workspace.js";
 const DEFAULT_TIMEOUT_MS = 120_000;
@@ -307,17 +307,46 @@ export function executable(configured) {
         for (const directory of directories) {
             const base = directory ? join(directory, configured) : configured;
             const script = /\.ps1$/i.test(base) ? base : `${base}.ps1`;
-            if (existsSync(script))
-                return {
-                    command: join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-                    prefixArgs: ["-NoLogo", "-NoProfile", "-File", script],
-                };
+            if (!existsSync(script))
+                continue;
+            const shimmed = nodeShimTarget(script);
+            if (shimmed)
+                return shimmed;
+            return {
+                command: join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+                prefixArgs: ["-NoLogo", "-NoProfile", "-File", script],
+            };
         }
     }
     return /\.(?:c|m)?js$/i.test(configured)
         ? { command: process.execPath, prefixArgs: [configured] }
         : { command: configured, prefixArgs: [] };
 }
+/**
+ * npm, pnpm and Yarn install a CLI on Windows as a PowerShell shim that runs a JavaScript entry point
+ * with Node. Running that entry point directly keeps arguments intact: `powershell -File` treats a bare
+ * `-` (read the prompt from stdin) as an unnamed parameter and fails before the CLI starts.
+ */
+function nodeShimTarget(script) {
+    let source;
+    try {
+        source = readFileSync(script, "utf8");
+    }
+    catch {
+        return null;
+    }
+    if (source.length > 16_384)
+        return null;
+    const target = /"\$basedir[\\/]([^"$`]+\.[cm]?js)"/i.exec(source)?.[1];
+    if (!target)
+        return null;
+    const basedir = dirname(script);
+    const entry = resolve(basedir, target);
+    if (!existsSync(entry))
+        return null;
+    const bundledNode = join(basedir, "node.exe");
+    return { command: existsSync(bundledNode) ? bundledNode : process.execPath, prefixArgs: [entry] };
+}
 const codexExecutable = executable(process.env.COZIBUD_CODEX_PATH || "codex");
 const claudeExecutable = executable(process.env.COZIBUD_CLAUDE_PATH || "claude");
 const geminiExecutable = executable(process.env.COZIBUD_GEMINI_PATH || "gemini");
@@ -329,7 +358,7 @@ export const builtInProcessHarnesses = [
         command: codexExecutable.command,
         versionArgs: [...codexExecutable.prefixArgs, "--version"],
         args: (input) => [...codexExecutable.prefixArgs, "exec", "--json", "--ephemeral", "--skip-git-repo-check", "--sandbox", "read-only",
-            ...(input?.interpretation ? ["--ignore-user-config", "--ignore-rules", "-c", "features.shell_tool=false", "-c", "features.apps=false", "-c", "features.multi_agent=false", "-c", "features.hooks=false", "-c", "web_search=\"disabled\""] : ["-c", "mcp_servers.cozibud.required=true"]), "-"],
+            ...(input?.interpretation ? ["--ignore-user-config", "--ignore-rules", "-c", "features.shell_tool=false", "-c", "features.unified_exec=false", "-c", "tools.view_image=false", "-c", "features.view_image=false", "-c", "features.image_generation=false", "-c", "features.memories=false", "-c", "features.plugins=false", "-c", "features.remote_plugin=false", "-c", "features.skill_mcp_dependency_install=false", "-c", "features.apps=false", "-c", "features.multi_agent=false", "-c", "features.hooks=false", "-c", "web_search=\"disabled\""] : ["-c", "mcp_servers.cozibud.required=true"]), "-"],
     },
     {
         id: "claude",

package/dist/relay-client.d.ts

@@ -53,7 +53,9 @@ export declare class OutboundRelayBridge {
         store: RelayExecutionStore;
         fetchImpl?: Fetch;
         maxActive?: number;
+        signal?: AbortSignal;
     });
+    get hasPendingExecution(): boolean;
     private get fetcher();
     private headers;
     private json;

package/dist/relay-client.js

@@ -65,10 +65,11 @@ export class OutboundRelayBridge {
     constructor(options) {
         this.options = options;
     }
+    get hasPendingExecution() { return this.scheduled.size > 0; }
     get fetcher() { return this.options.fetchImpl ?? fetch; }
     headers(extra) { return { authorization: `Bearer ${this.options.credential}`, ...extra }; }
     async json(path, init) {
-        const response = await this.fetcher(new URL(path, this.options.baseUrl), { ...init, redirect: "error", signal: AbortSignal.timeout(20_000) });
+        const response = await this.fetcher(new URL(path, this.options.baseUrl), { ...init, redirect: "error", signal: this.options.signal ? AbortSignal.any([this.options.signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000) });
         if (!response.ok) {
             const code = await response.json().then(value => value.error?.code).catch(() => undefined);
             throw new RelayTransportError(response.status, code ?? `relay_http_${response.status}`);
@@ -145,13 +146,61 @@ export class OutboundRelayBridge {
             try {
                 const prompt = command.transcript ?? JSON.stringify(command.action);
                 const source = command.source === "structured-action" ? "quick-action" : command.source;
-                const output = await this.options.driver.run({ prompt, source, client: command.client,
-                    interpretation: command.interpretation,
-                    careRecordIdempotencyKey: `relay:${command.requestId}` }, {
-                    turnId: command.requestId, signal: controller.signal,
-                    // Progress remains local in v1; bounded server progress is reserved by the protocol.
-                    emit: () => { },
-                });
+                const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(Math.min(300_000, Math.max(1, Date.parse(command.expiresAt) - Date.now())))]);
+                const interpret = (interpretation = command.interpretation) => this.options.driver.run({ prompt, source, client: command.client,
+                    interpretation, careRecordIdempotencyKey: `relay:${command.requestId}` }, { turnId: command.requestId, signal, emit: () => { } });
+                let output;
+                if (!command.careTools)
+                    output = await interpret();
+                else {
+                    if (!command.interpretation || this.options.driver.id !== "codex")
+                        throw new Error("Baby-care interpretation requires the isolated Codex driver.");
+                    const results = [];
+                    let next = command.careTools.confirmed;
+                    let callId = 0;
+                    let answerReadback = "";
+                    for (let round = 0;; round += 1) {
+                        if (round > 12 || signal.aborted)
+                            throw new Error("The care request reached its limit. Check the current records before trying again.");
+                        if (!next) {
+                            output = await interpret(`${command.interpretation}\n<care_tool_results>${JSON.stringify(results)}</care_tool_results>\n${answerReadback}\nReturn the next care tool request or a final answer as JSON.`);
+                            let parsed;
+                            try {
+                                parsed = JSON.parse(output.text);
+                            }
+                            catch {
+                                throw new Error("The care interpreter returned invalid JSON.");
+                            }
+                            if (!parsed || typeof parsed !== "object")
+                                throw new Error("The care interpreter returned invalid JSON.");
+                            const value = parsed;
+                            if (value.operation !== "tool") {
+                                if (!["answer", "clarify", "refuse"].includes(value.operation ?? "") || typeof value.text !== "string" || !value.text.trim())
+                                    throw new Error("The care interpreter returned an invalid answer.");
+                                if (value.operation === "answer" && callId === 0) {
+                                    answerReadback = "Your answer has no fresh server readback for this message. Return a care tool request to check the referenced record now; prior conversation results alone cannot support a final answer.";
+                                    continue;
+                                }
+                                break;
+                            }
+                            if (typeof value.name !== "string" || !value.arguments || Array.isArray(value.arguments) || typeof value.arguments !== "object")
+                                throw new Error("The care interpreter returned an invalid tool request.");
+                            next = { name: value.name, arguments: value.arguments };
+                        }
+                        if (++callId > 12)
+                            throw new Error("The care request reached its tool limit.");
+                        const result = await this.json(`/api/watch-relay/v1/deliveries/${command.deliveryId}/care-tools`, { method: "POST", headers: this.headers({ "content-type": "application/json" }),
+                            body: JSON.stringify({ requestId: command.requestId, connectionId: this.connectionId, callId, ...next }) });
+                        if (result.retrySameCall)
+                            callId -= 1;
+                        results.push({ name: next.name, ...result });
+                        next = undefined;
+                        if (result.status === "confirmation_required") {
+                            output = { text: JSON.stringify({ operation: "clarify", text: "Review this proposed change before applying it." }) };
+                            break;
+                        }
+                    }
+                }
                 terminal = { state: "completed", modelOutput: output.text, updatedAt: new Date().toISOString() };
             }
             catch (error) {

package/dist/relay-polling.d.ts

@@ -0,0 +1,12 @@
+/** Short polls retain the server's 45-second connection lease. Only a quiet,
+ * empty bridge backs off: active provider work keeps the existing one-second
+ * cancellation cadence. New commands, cancellation and reconnect reset it.
+ * No request is deliberately held open. Idle discovery may wait up to 2.5s. The cap stays below ordinary client keep-alive timeouts to avoid turning idle polls into repeated TLS handshakes. */
+export declare class RelayPollDelay {
+    private readonly random;
+    private nextIdleMs;
+    constructor(random?: () => number);
+    reset(): void;
+    after(state: "idle" | "command" | "cancel", hasPendingExecution: boolean): number;
+}
+export declare function relayPause(ms: number, signal: AbortSignal): Promise<void>;

package/dist/relay-polling.js

@@ -0,0 +1,34 @@
+/** Short polls retain the server's 45-second connection lease. Only a quiet,
+ * empty bridge backs off: active provider work keeps the existing one-second
+ * cancellation cadence. New commands, cancellation and reconnect reset it.
+ * No request is deliberately held open. Idle discovery may wait up to 2.5s. The cap stays below ordinary client keep-alive timeouts to avoid turning idle polls into repeated TLS handshakes. */
+export class RelayPollDelay {
+    random;
+    nextIdleMs = 1_000;
+    constructor(random = Math.random) {
+        this.random = random;
+    }
+    reset() { this.nextIdleMs = 1_000; }
+    after(state, hasPendingExecution) {
+        if (state !== "idle") {
+            this.reset();
+            return 0;
+        }
+        if (hasPendingExecution) {
+            this.reset();
+            return 1_000;
+        }
+        const delay = Math.round(this.nextIdleMs * (0.8 + this.random() * 0.2));
+        this.nextIdleMs = Math.min(2_500, this.nextIdleMs * 2);
+        return delay;
+    }
+}
+export function relayPause(ms, signal) {
+    return new Promise(resolve => {
+        const done = () => { clearTimeout(timer); signal.removeEventListener("abort", done); resolve(); };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+        if (signal.aborted)
+            done();
+    });
+}

package/dist/relay-protocol.d.ts

@@ -1,8 +1,8 @@
 /** Versioned wire values consumed by the outbound Cozibud relay client. */
-export declare const WATCH_RELAY_PROTOCOL: "cozibud.watch-relay.v2";
-export declare const WATCH_RELAY_PROTOCOL_VERSION: 2;
+export declare const WATCH_RELAY_PROTOCOL: "cozibud.watch-relay.v3";
+export declare const WATCH_RELAY_PROTOCOL_VERSION: 3;
 export type WatchRelayCommand = Readonly<{
-    protocol: typeof WATCH_RELAY_PROTOCOL;
+    protocol: typeof WATCH_RELAY_PROTOCOL | "cozibud.watch-relay.v2";
     requestId: string;
     deliveryId: string;
     attempt: number;
@@ -15,4 +15,11 @@ export type WatchRelayCommand = Readonly<{
     }>;
     expiresAt: string;
     interpretation?: string;
+    careTools?: Readonly<{
+        enabled: true;
+        confirmed?: {
+            name: string;
+            arguments: Record<string, unknown>;
+        };
+    }>;
 }>;

package/dist/relay-protocol.js

@@ -1,3 +1,3 @@
 /** Versioned wire values consumed by the outbound Cozibud relay client. */
-export const WATCH_RELAY_PROTOCOL = "cozibud.watch-relay.v2";
-export const WATCH_RELAY_PROTOCOL_VERSION = 2;
+export const WATCH_RELAY_PROTOCOL = "cozibud.watch-relay.v3";
+export const WATCH_RELAY_PROTOCOL_VERSION = 3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cozibud/harness",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Cozibud local-client bridge and CLI.",
   "type": "module",
   "license": "Apache-2.0",