@crievo/omni 0.1.4 → 0.1.6

package/tools/lib/service.mjs

@@ -4,24 +4,52 @@
    python, with ~/.omni/bin (tools/lib/deps.mjs) first; OMNI_HOME goes along when the workspace is not the
    code root (tools/lib/paths.mjs).
 
+   On Windows the same job is a scheduled task at login, with a supervisor that reopens the studio
+   (tools/lib/service-windows.mjs); every function here picks one or the other by platform, and the macOS
+   code below is what it has always been.
+
    Used by `tools/runner.mjs service` (this repo) and `omni up` (the installed CLI). Throws Errors in
    Portuguese; the callers print them. */
 
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { BIN_DIR } from "./deps.mjs";
 import { CODE_ROOT, DATA_ROOT, homeEnvPlist } from "./paths.mjs";
+import { listeningOn, sleepSync } from "./platform.mjs";
+import { windowsService } from "./service-windows.mjs";
 
 export const AGENT = "com.omnivideo.studio";
 export const PLIST = join(homedir(), "Library", "LaunchAgents", `${AGENT}.plist`);
 export const LOG_FILE = join(DATA_ROOT, ".runner", "studio.log");
 const domain = () => `gui/${process.getuid?.()}`;
 const launchctl = (/** @type {string[]} */ ...a) => spawnSync("launchctl", a, { encoding: "utf8" });
+const win = () => process.platform === "win32";
+
+/** the scheduled task of this machine, set up for the code root it would run (Windows) */
+const windowsTask = (/** @type {string} */ codeRoot = CODE_ROOT) =>
+  windowsService({
+    dir: dirname(LOG_FILE),
+    logFile: LOG_FILE,
+    runScript: join(codeRoot, "tools", "lib", "service-run.mjs"),
+  });
 
 /** the bun to run the studio with: the CLI package's own (the `bun` dependency), else the one installed */
 export function bunPath(codeRoot = CODE_ROOT) {
+  if (win()) {
+    /* `where` lists every match; the .cmd shims npm and bun's installer leave beside it can't be a service's command */
+    const found = spawnSync("where", ["bun"], { encoding: "utf8" })
+      .stdout.split(/\r?\n/)
+      .find(l => /\.exe$/i.test(l.trim()))
+      ?.trim();
+    return [
+      join(codeRoot, "node_modules", "bun", "bin", "bun.exe"),
+      join(codeRoot, "..", "..", "bun", "bin", "bun.exe"),
+      found,
+      join(homedir(), ".bun", "bin", "bun.exe"),
+    ].find(p => p && existsSync(p));
+  }
   const found = spawnSync("/bin/sh", ["-lc", "command -v bun"], { encoding: "utf8" }).stdout.trim();
   return [
     join(codeRoot, "node_modules", ".bin", "bun"),
@@ -35,6 +63,7 @@ export function bunPath(codeRoot = CODE_ROOT) {
 
 /** what launchd says about the studio's agent */
 export function service() {
+  if (win()) return windowsTask().status();
   const installed = existsSync(PLIST);
   const printed = installed ? launchctl("print", `${domain()}/${AGENT}`) : null;
   const pid = printed?.status === 0 ? Number(/\bpid = (\d+)/.exec(printed.stdout)?.[1] ?? 0) : 0;
@@ -90,7 +119,8 @@ function plist(/** @type {string} */ bun, /** @type {string} */ codeRoot) {
  * @returns {{ changed: boolean }}
  */
 export function serviceInstall({ codeRoot = CODE_ROOT, onlyIfChanged = false, log = () => {} } = {}) {
-  if (process.platform !== "darwin") throw new Error("o serviço é do macOS (launchd)");
+  if (win()) return windowsInstall({ codeRoot, onlyIfChanged, log });
+  if (process.platform !== "darwin") throw new Error("o serviço é do macOS (launchd) e do Windows (tarefa agendada)");
   const bun = bunPath(codeRoot);
   if (!bun) throw new Error("não achei o bun: instale com curl -fsSL https://bun.sh/install | bash");
   const text = plist(bun, codeRoot);
@@ -116,22 +146,62 @@ export function serviceInstall({ codeRoot = CODE_ROOT, onlyIfChanged = false, lo
   launchctl("bootout", `${domain()}/${AGENT}`);
   let r = launchctl("bootstrap", domain(), PLIST);
   for (let i = 0; i < 6 && r.status !== 0; i++) {
-    spawnSync("sleep", ["0.5"]);
+    sleepSync(500);
     r = launchctl("bootstrap", domain(), PLIST);
   }
   if (r.status !== 0) throw new Error(`launchctl bootstrap: ${(r.stderr || r.stdout).trim()}`);
-  if (spawnSync("lsof", ["-nP", "-iTCP:5432", "-sTCP:LISTEN"], { encoding: "utf8" }).stdout.includes("LISTEN"))
+  if (listeningOn(5432))
+    log("aviso: já há um studio aberto na porta 5432 (num terminal?): feche-o e o serviço assume em até 30 s");
+  return { changed: true };
+}
+
+/** the Windows twin of the install above: the same bun, the same lockfile step, the same port warning */
+function windowsInstall({ codeRoot, onlyIfChanged, log }) {
+  const bun = bunPath(codeRoot);
+  if (!bun) throw new Error('não achei o bun: instale com powershell -c "irm bun.sh/install.ps1 | iex"');
+  const task = windowsTask(codeRoot);
+  const options = {
+    bun,
+    codeRoot,
+    dataRoot: DATA_ROOT,
+    binDir: BIN_DIR,
+    path: process.env.PATH ?? process.env.Path ?? "",
+  };
+  if (onlyIfChanged && task.upToDate(options)) return { changed: false };
+  if (existsSync(join(codeRoot, "studio", "bun.lock"))) {
+    const deps = spawnSync(bun, ["install", "--frozen-lockfile", "--silent"], {
+      cwd: join(codeRoot, "studio"),
+      stdio: "inherit",
+    });
+    if (deps.status !== 0) throw new Error("bun install falhou em studio/");
+  }
+  task.install(options);
+  if (listeningOn(5432))
     log("aviso: já há um studio aberto na porta 5432 (num terminal?): feche-o e o serviço assume em até 30 s");
   return { changed: true };
 }
 
 export function serviceUninstall() {
+  if (win()) return windowsTask().uninstall();
   launchctl("bootout", `${domain()}/${AGENT}`);
   if (existsSync(PLIST)) unlinkSync(PLIST);
 }
 
 export function serviceRestart() {
+  if (win()) return windowsTask().restart();
   if (!service().loaded) throw new Error("o serviço não está ligado");
   const r = launchctl("kickstart", "-k", `${domain()}/${AGENT}`);
   if (r.status !== 0) throw new Error(`launchctl kickstart: ${(r.stderr || r.stdout).trim()}`);
 }
+
+/** the studio folder the installed service runs from (a launchd plist's WorkingDirectory, the Windows
+ *  spec's cwd), or "" when there is none  */
+export function serviceWorkingDir() {
+  if (win()) return windowsTask().workingDir();
+  try {
+    const wd = /<key>WorkingDirectory<\/key><string>([^<]+)<\/string>/.exec(readFileSync(PLIST, "utf8"))?.[1];
+    return wd ? wd.replace(/&amp;/g, "&") : "";
+  } catch {
+    return "";
+  }
+}

package/tools/lib/up.mjs

@@ -9,7 +9,8 @@
                  background on a hook)
      login       none yet: the browser opens on the approval page (at most once an hour)
      claude      on a hook, the session's Claude Code folder into ~/.omni/claude.json (claude-settings.mjs)
-     service     the studio as a launchd agent, from the app, so the hosted studio reaches this Mac
+     service     the studio kept on at login (a launchd agent on macOS, a scheduled task on Windows, both in
+                 tools/lib/service.mjs), from the app, so the hosted studio reaches this computer
 
    In this repo (a git checkout) the app, the tools and the service are left to `tools/setup.mjs` and
    `tools/runner.mjs service`: `up` never rewires a development machine. */
@@ -22,7 +23,8 @@ import { CLI_COMMAND, PACKAGE, STUDIO_URL } from "./cli.mjs";
 import { OMNI_DIR, checkDeps, ensureDeps } from "./deps.mjs";
 import { readTokens } from "./oauth-client.mjs";
 import { CODE_ROOT, DATA_ROOT } from "./paths.mjs";
-import { PLIST, service, serviceInstall } from "./service.mjs";
+import { npmCommand } from "./platform.mjs";
+import { service, serviceInstall, serviceWorkingDir } from "./service.mjs";
 
 const LOGIN_EVERY_MS = 60 * 60_000;
 
@@ -61,25 +63,40 @@ export function ensureWorkspace(home = DATA_ROOT, codeRoot = CODE_ROOT) {
   return created;
 }
 
+/** npx's cache, whichever way the OS writes the path  @param {string} codeRoot */
+const inNpxCache = codeRoot => /[\\/]_npx[\\/]/.test(codeRoot);
+
+/** the `omni` shortcut in ~/.omni/bin: a shell script on macOS and Linux, a .cmd on Windows (where a file
+ *  without an extension doesn't run)  @param {string} installed the installed package folder @param {string} [platform] */
+export function shortcut(installed, platform = process.platform) {
+  const main = join(installed, "bin", "omni.mjs");
+  if (platform === "win32")
+    /* % is cmd's variable mark, even inside quotes: a path with one needs it doubled */
+    return { name: "omni.cmd", text: `@echo off\r\nnode "${main.replace(/%/g, "%%")}" %*\r\n`, mode: 0o644 };
+  return { name: "omni", text: `#!/bin/sh\nexec node "${main}" "$@"\n`, mode: 0o755 };
+}
+
 /** The code root the service should run: this checkout, an already stable install, or a fresh copy in
  *  ~/.omni/app/<version>/ when this runs from npx's cache.  @param {(line: string) => void} log */
 export function ensureApp(log = () => {}, codeRoot = CODE_ROOT) {
-  if (isDev(codeRoot) || !codeRoot.includes("/_npx/")) return codeRoot;
+  if (isDev(codeRoot) || !inNpxCache(codeRoot)) return codeRoot;
   const version = JSON.parse(readFileSync(join(codeRoot, "package.json"), "utf8")).version;
   const prefix = join(OMNI_DIR, "app", version);
   const installed = join(prefix, "node_modules", ...PACKAGE.split("/"));
   if (!existsSync(join(installed, "package.json"))) {
     log(`instalando o OmniVideo ${version} em ${prefix}…`);
     const spec = process.env.OMNI_PACKAGE_SPEC || `${PACKAGE}@${version}`;
-    const r = spawnSync("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--loglevel=error", spec], {
-      encoding: "utf8",
-    });
+    const npm = npmCommand();
+    const r = spawnSync(
+      npm.cmd,
+      [...npm.prefix, "install", "--prefix", prefix, "--no-audit", "--no-fund", "--loglevel=error", spec],
+      { encoding: "utf8", windowsHide: true },
+    );
     if (r.status !== 0) throw new Error(`npm install falhou: ${(r.stderr || r.stdout).trim().split("\n").at(-1)}`);
   }
   mkdirSync(join(OMNI_DIR, "bin"), { recursive: true });
-  writeFileSync(join(OMNI_DIR, "bin", "omni"), `#!/bin/sh\nexec node "${join(installed, "bin", "omni.mjs")}" "$@"\n`, {
-    mode: 0o755,
-  });
+  const link = shortcut(installed);
+  writeFileSync(join(OMNI_DIR, "bin", link.name), link.text, { mode: link.mode });
   return installed;
 }
 
@@ -104,6 +121,7 @@ export function ensureTools(codeRoot = CODE_ROOT, { background = false } = {}) {
   const out = openSync(join(OMNI_DIR, "deps.log"), "a");
   spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "deps", "install", "--unlock"], {
     detached: true,
+    windowsHide: true,
     stdio: ["ignore", out, out],
     env: { ...process.env, OMNI_HOME: DATA_ROOT },
   }).unref();
@@ -123,6 +141,7 @@ export function startLogin(codeRoot = CODE_ROOT) {
   writeFileSync(marker, new Date().toISOString());
   spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "login"], {
     detached: true,
+    windowsHide: true,
     stdio: "ignore",
     env: { ...process.env, OMNI_HOME: DATA_ROOT },
   }).unref();
@@ -131,13 +150,9 @@ export function startLogin(codeRoot = CODE_ROOT) {
 
 /** the checkout the installed studio service runs from, when it is a git checkout (a development machine) */
 function devServiceRoot() {
-  try {
-    const wd = /<key>WorkingDirectory<\/key><string>([^<]+)<\/string>/.exec(readFileSync(PLIST, "utf8"))?.[1];
-    const root = wd ? join(wd.replace(/&amp;/g, "&"), "..") : "";
-    return root && existsSync(join(root, ".git")) ? root : "";
-  } catch {
-    return "";
-  }
+  const wd = serviceWorkingDir();
+  const root = wd ? join(wd, "..") : "";
+  return root && existsSync(join(root, ".git")) ? root : "";
 }
 
 /**
@@ -175,7 +190,7 @@ export async function up({ hook = false, log = () => {} } = {}) {
   const devService = devServiceRoot();
   if (!dev && devService)
     notes.push(`o studio de desenvolvimento (${devService}) continua sendo o serviço deste computador`);
-  if (!dev && !devService && process.platform === "darwin") {
+  if (!dev && !devService && (process.platform === "darwin" || process.platform === "win32")) {
     try {
       if (serviceInstall({ codeRoot, onlyIfChanged: true, log }).changed) notes.push("studio ligado como serviço");
     } catch (e) {

package/tools/lib/vault.mjs

@@ -0,0 +1,116 @@
+/* Where the CLI keeps the login: the operating system's credential vault, never `.env`
+   (docs/specs/phase-2-plugin-cli.md, "Windows"). One secret is a service ("omni"), an account (the studio's
+   host) and a string (the tokens, as JSON).
+
+     macOS            /usr/bin/security, the Keychain's own tool. NOT a library: measured on this Mac, an item
+                      written by `security` blocks on an authorization dialog when @napi-rs/keyring reads it,
+                      and an item written by node blocks the bun that runs the studio service (and `security`
+                      itself). The service has nobody to click it. `security` is the one reader and writer
+                      every process shares, so no dialog ever shows.
+     Windows, Linux   @napi-rs/keyring: Credential Manager on Windows, the Secret Service on Linux. A native
+                      addon, loaded on first use, so a checkout without it (a Mac) never needs it.
+
+   A vault is { get, set, delete }, all synchronous like the callers. The tests hand in their own. Messages in
+   Portuguese: they reach the user as they are. */
+
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+
+/**
+ * @typedef {{
+ *   get(service: string, account: string): string | null,
+ *   set(service: string, account: string, secret: string): void,
+ *   delete(service: string, account: string): void,
+ *   label: string,
+ * }} Vault
+ */
+
+/** what the vault is called where the user reads it  @param {string} [platform] */
+export const vaultName = (platform = process.platform) =>
+  platform === "darwin"
+    ? "Keychain"
+    : platform === "win32"
+      ? "Gerenciador de Credenciais do Windows"
+      : "chaveiro do sistema";
+
+/**
+ * The macOS Keychain through `security`. The secret goes as an argument, which `security` has no other way
+ * to take; -U updates the item in place.
+ * @param {string} [bin] the `security` program (the tests point it at a fake)
+ * @returns {Vault}
+ */
+export function securityVault(bin = "security") {
+  return {
+    label: vaultName("darwin"),
+    get(service, account) {
+      const r = spawnSync(bin, ["find-generic-password", "-s", service, "-a", account, "-w"], { encoding: "utf8" });
+      return r.status === 0 ? r.stdout.trim() : null;
+    },
+    set(service, account, secret) {
+      const r = spawnSync(
+        bin,
+        ["add-generic-password", "-U", "-s", service, "-a", account, "-l", "OmniVideo", "-w", secret],
+        { encoding: "utf8" },
+      );
+      if (r.status !== 0)
+        throw new Error(`não consegui gravar o login no Keychain: ${r.stderr.trim() || `código ${r.status}`}`);
+    },
+    delete(service, account) {
+      spawnSync(bin, ["delete-generic-password", "-s", service, "-a", account], { encoding: "utf8" });
+    },
+  };
+}
+
+/**
+ * Credential Manager (Windows) or the Secret Service (Linux) through @napi-rs/keyring.
+ * @param {() => { Entry: new (service: string, account: string) => { getPassword(): string | null, setPassword(p: string): void, deletePassword(): boolean } }} [load]
+ *   loads the library (the tests hand in a fake)
+ * @param {string} [platform]
+ * @returns {Vault}
+ */
+export function keyringVault(load, platform = process.platform) {
+  const where = vaultName(platform);
+  const entry = (/** @type {string} */ service, /** @type {string} */ account) => {
+    let lib;
+    try {
+      lib = (load ?? (() => createRequire(import.meta.url)("@napi-rs/keyring")))();
+    } catch (e) {
+      throw new Error(
+        `não achei a biblioteca do ${where} (@napi-rs/keyring): ${/** @type {Error} */ (e).message.split("\n")[0]}`,
+      );
+    }
+    return new lib.Entry(service, account);
+  };
+  return {
+    label: where,
+    get(service, account) {
+      /* a missing library throws (a packaging bug the user must hear about); an item that isn't there, or a
+         vault that doesn't answer, reads as "not logged in", as `security` failing always did */
+      const e = entry(service, account);
+      try {
+        return e.getPassword() ?? null;
+      } catch {
+        return null;
+      }
+    },
+    set(service, account, secret) {
+      const e = entry(service, account);
+      try {
+        e.setPassword(secret);
+      } catch (err) {
+        throw new Error(`não consegui gravar o login no ${where}: ${/** @type {Error} */ (err).message}`);
+      }
+    },
+    delete(service, account) {
+      try {
+        entry(service, account).deletePassword();
+      } catch {
+        /* already gone */
+      }
+    },
+  };
+}
+
+/** the vault of this machine  @param {string} [platform] @returns {Vault} */
+export const defaultVault = (platform = process.platform) =>
+  platform === "darwin" ? securityVault() : keyringVault(undefined, platform);

package/tools/metrics.mjs

@@ -59,6 +59,7 @@ import {
   collectAccount as coreCollectAccount,
 } from "./lib/metrics/metrics.mjs";
 import { isMainModule, homeEnvPlist, DATA_ROOT as ROOT } from "./lib/paths.mjs";
+import { localAgents, noLocalAgent } from "./lib/platform.mjs";
 
 const VIDEOS = join(ROOT, "videos");
 const DIR = join(ROOT, ".metrics");
@@ -305,7 +306,7 @@ function show(only) {
       `\nconta @${c.username}: ${n(c.followers)} seguidores, ${n(c.posts)} posts, ${n(c.profile_visits_day)} visitas ao perfil hoje (foto de ${new Date(c.at).toLocaleString("pt-BR")})`,
     );
   if (cloudCollects()) console.log("\ncoleta: a cloud, de hora em hora (o agente daqui só puxa)");
-  else if (!agentStatus().loaded)
+  else if (localAgents() && !agentStatus().loaded)
     console.log("\naviso: o agente está desligado e marco perdido não volta: node tools/metrics.mjs agent install");
 }
 
@@ -316,11 +317,14 @@ const domain = () => `gui/${process.getuid()}`;
 const launchctl = (...a) => spawnSync("launchctl", a, { encoding: "utf8" });
 
 function agentStatus() {
+  /* no launchd, no agent: on Windows and Linux the cloud collects (cloud.metrics) */
+  if (!localAgents()) return { installed: false, loaded: false, supported: false, log: LOG_FILE };
   const installed = existsSync(PLIST);
   return { installed, loaded: installed && launchctl("print", `${domain()}/${AGENT}`).status === 0, log: LOG_FILE };
 }
 
 function installAgent() {
+  if (!localAgents()) return console.log(noLocalAgent("a coleta de métricas", "metrics"));
   const x = s => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   /* ffprobe measures the published MP4: launchd starts without the shell's PATH */
   const path = [
@@ -375,6 +379,7 @@ function installAgent() {
 }
 
 function uninstallAgent() {
+  if (!localAgents()) return console.log(noLocalAgent("a coleta de métricas", "metrics"));
   launchctl("bootout", `${domain()}/${AGENT}`);
   try {
     unlinkSync(PLIST);
@@ -403,7 +408,7 @@ if (isMain) {
       if (args.includes("--json")) console.log(JSON.stringify(s));
       else
         console.log(
-          `agente: ${s.loaded ? `ligado, coleta de ${AGENT_STEP_H} em ${AGENT_STEP_H} horas` : "desligado (node tools/metrics.mjs agent install)"}`,
+          `agente: ${s.supported === false ? "sem agente local aqui (a coleta é da cloud: cloud.metrics)" : s.loaded ? `ligado, coleta de ${AGENT_STEP_H} em ${AGENT_STEP_H} horas` : "desligado (node tools/metrics.mjs agent install)"}`,
         );
     } else
       fail(

package/tools/omni.mjs

@@ -3,7 +3,8 @@
    The `omni` CLI (docs/specs/phase-2-plugin-cli.md): `npx -y @crievo/omni …` once published (bin/omni.mjs
    settles the workspace and calls main), `node tools/omni.mjs …` in this repo. The plugin calls it from its
    hook, its MCP server and its skills' `!` lines, so the user needs no terminal. The login is OAuth with PKCE
-   in the browser (tools/lib/oauth-client.mjs); the tokens live in the macOS Keychain, never in .env.
+   in the browser (tools/lib/oauth-client.mjs); the tokens live in the system's credential vault (the macOS
+   Keychain, Windows Credential Manager: tools/lib/vault.mjs), never in .env.
 
      omni up [--hook]            readies this machine: workspace, app, Python, login, studio service
                                  (tools/lib/up.mjs); --hook prints one line and never waits on the login
@@ -32,7 +33,9 @@ import { OMNI_DIR, checkDeps, depsEnv, ensureDeps } from "./lib/deps.mjs";
 import { serveMcp } from "./lib/mcp-server.mjs";
 import { accessToken, login, logout, readTokens } from "./lib/oauth-client.mjs";
 import { CODE_ROOT, DATA_ROOT, isMainModule } from "./lib/paths.mjs";
+import { pickPython } from "./lib/platform.mjs";
 import { service } from "./lib/service.mjs";
+import { vaultName } from "./lib/vault.mjs";
 import { skillText } from "./lib/skill-client.mjs";
 import { up } from "./lib/up.mjs";
 import { cloudSettings } from "./platforms.mjs";
@@ -200,12 +203,7 @@ export async function main(args) {
     if (!tool || !/^[a-z0-9_-]+$/i.test(tool)) fail("uso: omni run <ferramenta> [args…]");
     const mjs = join(CODE_ROOT, "tools", `${tool}.mjs`);
     const py = join(CODE_ROOT, "tools", `${tool.replace(/-/g, "_")}.py`);
-    const venv = join(CODE_ROOT, ".venv", "bin", "python");
-    const [bin, script] = existsSync(mjs)
-      ? [process.execPath, mjs]
-      : existsSync(py)
-        ? [existsSync(venv) ? venv : "python3", py]
-        : [];
+    const [bin, script] = existsSync(mjs) ? [process.execPath, mjs] : existsSync(py) ? [pickPython(CODE_ROOT), py] : [];
     if (!bin) fail(`não existe a ferramenta ${tool}`);
     const r = spawnSync(/** @type {string} */ (bin), [/** @type {string} */ (script), ...rest], {
       stdio: "inherit",
@@ -293,7 +291,7 @@ export async function main(args) {
       const t = await login(url, { deviceName: flag("name") || deviceName(), log: line => console.log(line) }).catch(
         e => fail(String(e.message)),
       );
-      console.log(`Pronto: "${t.device_name}" entrou no OmniVideo. O login ficou no Keychain.`);
+      console.log(`Pronto: "${t.device_name}" entrou no OmniVideo. O login ficou no ${vaultName()}.`);
     }
     if (cmd === "login") return console.log("O studio deste computador passa a usar este login em até 30 segundos.");
     if (

package/tools/omnichat.mjs

@@ -174,6 +174,7 @@ import {
 import { sendManual } from "./lib/omnichat/manual.mjs";
 import { handleWebhook, WEBHOOK_FIELDS } from "./lib/omnichat/webhook.mjs";
 import { isMainModule, homeEnvPlist, DATA_ROOT as ROOT } from "./lib/paths.mjs";
+import { localAgents, noLocalAgent } from "./lib/platform.mjs";
 
 const CFG = JSON.parse(readFileSync(join(ROOT, "omnivideo.config.json"), "utf8"));
 const C = resolveOmnichatConfig(CFG.omnichat?.instagram ?? {});
@@ -398,7 +399,7 @@ function enable(dir) {
   describe(dir, all.instagram);
   if (!readJson(join(dir, "publication.json"))?.instagram?.id)
     console.log(`${thePost(dir)} ainda não foi publicado: começa a responder quando ele subir`);
-  if (!agentStatus().loaded)
+  if (localAgents() && !agentStatus().loaded)
     console.log("aviso: o agente está desligado e nada é respondido sozinho: node tools/omnichat.mjs agent install");
 }
 
@@ -828,7 +829,7 @@ function published(dir) {
   const file = ruleFile(dir);
   const all = readJson(file) ?? {};
   const agentHint = () => {
-    if (!cloudOwns() && !agentStatus().loaded)
+    if (!cloudOwns() && localAgents() && !agentStatus().loaded)
       console.log(
         "aviso: omnichat: o agente está desligado e nada é respondido sozinho: node tools/omnichat.mjs agent install",
       );
@@ -1033,10 +1034,16 @@ async function status() {
   const pause = readJson(PAUSE_FILE);
   if (isPaused(pause, Date.now())) s.pause = pause;
   if (cloudOwns()) {
-    await Promise.all(videosWithRule().map(d => pullRecord(d).catch(() => {})));
-    /* the cloud answers: its pause and its token are the ones that count */
+    /* the cloud answers: its pause and its token are the ones that count; its posts' updated_at say
+       which records changed since the mirror, and only those are pulled */
     try {
       const c = await cloudApi("GET", "/api/status");
+      const at = new Map((c.posts ?? []).map(p => [String(p.media_id), p.updated_at]));
+      await Promise.all(
+        videosWithRule()
+          .filter(d => at.has(String(mediaOf(d))))
+          .map(d => pullRecord(d, at.get(String(mediaOf(d)))).catch(() => {})),
+      );
       s.cloud = { ready: true, active: !!c.active, expires: c.account?.expires ?? null };
       if (!c.active) s.cloud.reason = "a cloud não está respondendo (cloud push)";
       if (c.account?.paused_until && Date.parse(c.account.paused_until) > Date.now())
@@ -1100,7 +1107,7 @@ async function status() {
     );
   console.log("  DM: a permissão de mensagens só se confere no primeiro envio");
   console.log(
-    `  agente: ${s.agent.loaded ? "ligado, confere a cada minuto" : "desligado (node tools/omnichat.mjs agent install)"}`,
+    `  agente: ${s.agent.supported === false ? "sem agente local aqui (as respostas são da cloud: cloud.omnichat)" : s.agent.loaded ? "ligado, confere a cada minuto" : "desligado (node tools/omnichat.mjs agent install)"}`,
   );
   if (s.studio)
     console.log(
@@ -1167,19 +1174,26 @@ function syncRule(dir) {
 }
 const flushCloud = () => Promise.all(pendingCloud.splice(0));
 
-/* the cloud's record mirrored into omnichat-record.json: the studio and the log read the file */
-async function pullRecord(dir) {
+/* The cloud's record mirrored into omnichat-record.json: the studio and the log read the file.
+   `cloudAt`: the post's updated_at from /api/status; when the mirror already has that version, nothing is
+   asked (the studio's status runs every few minutes, and each record that leaves Neon counts against the
+   free plan's monthly transfer). */
+async function pullRecord(dir, cloudAt = null) {
   if (!cloudOwns()) return;
   const media = mediaOf(dir);
   if (!media) return;
+  const file = recordFile(dir);
+  if (cloudAt && readJson(file)?.cloud_updated_at === cloudAt) return;
   try {
     const out = await cloudApi("GET", `/api/posts/${media}`);
-    const file = recordFile(dir);
     const all = readJson(file) ?? {};
     /* only a change is written: the write is a studio notice, and the notice makes the page read (and
        pull) again, so an unchanged record written anyway loops against the cloud */
-    if (JSON.stringify(all.instagram ?? null) === JSON.stringify(out.record ?? null)) return;
+    const at = out.updated_at ?? null;
+    if (JSON.stringify(all.instagram ?? null) === JSON.stringify(out.record ?? null) && all.cloud_updated_at === at)
+      return;
     all.instagram = out.record;
+    all.cloud_updated_at = at;
     delete all.cloud;
     writeJson(file, all);
   } catch (e) {
@@ -1417,6 +1431,8 @@ const domain = () => `gui/${process.getuid()}`;
 const launchctl = (...a) => spawnSync("launchctl", a, { encoding: "utf8" });
 
 function agentStatus() {
+  /* no launchd, no agent: on Windows and Linux the cloud answers (cloud.omnichat) */
+  if (!localAgents()) return { installed: false, loaded: false, node_ok: false, supported: false, log: LOG_FILE };
   const installed = existsSync(PLIST);
   let node = null;
   if (installed) {
@@ -1437,6 +1453,7 @@ function agentStatus() {
 }
 
 function installAgent() {
+  if (!localAgents()) return console.log(noLocalAgent("as respostas do omnichat", "omnichat"));
   const x = s => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   /* the shell PATH goes along: launchd starts without claude, which reads the context of uncertain comments */
   const path = [
@@ -1493,6 +1510,7 @@ function installAgent() {
 }
 
 function uninstallAgent() {
+  if (!localAgents()) return console.log(noLocalAgent("as respostas do omnichat", "omnichat"));
   launchctl("bootout", `${domain()}/${AGENT_LABEL}`);
   try {
     unlinkSync(PLIST);
@@ -1551,7 +1569,7 @@ if (isMain) {
         );
       else
         console.log(
-          `agente: ${a.loaded ? "ligado, confere a cada minuto" : "desligado (agent install)"}${a.installed && !a.node_ok ? " · o node do agente sumiu: rode agent install de novo" : ""}`,
+          `agente: ${a.supported === false ? "sem agente local aqui (as respostas são da cloud: cloud.omnichat)" : a.loaded ? "ligado, confere a cada minuto" : "desligado (agent install)"}${a.installed && !a.node_ok ? " · o node do agente sumiu: rode agent install de novo" : ""}`,
         );
     } else if (cmd === "agent" && sub === "install") installAgent();
     else if (cmd === "agent" && sub === "uninstall") uninstallAgent();

package/tools/package.mjs

@@ -91,11 +91,12 @@ function build() {
     type: "module",
     bin: { omni: "bin/omni.mjs" },
     engines: { node: ">=22" },
-    os: ["darwin"],
+    os: ["darwin", "win32"],
     license: "UNLICENSED",
     homepage: "https://omni.crievo.com",
-    /* the studio's runtime libraries, the bun that runs it, and what fetches the Chrome without a window */
-    dependencies: { ...studio.dependencies, bun: "1.4.3", "@puppeteer/browsers": "3.2.3" },
+    /* the studio's runtime libraries, the bun that runs it, what fetches the Chrome without a window, and the
+       credential vault of Windows (tools/lib/vault.mjs; macOS keeps `security` and never loads it) */
+    dependencies: { ...studio.dependencies, bun: "1.4.3", "@puppeteer/browsers": "3.2.3", "@napi-rs/keyring": "2.1.1" },
   };
   writeFileSync(join(PKG, "package.json"), `${JSON.stringify(pkg, null, 2)}\n`);
   writeFileSync(