@crvouga/dev-fleet 0.0.0-stage → 0.1.0

package/src/agents/native-verify.ts

@@ -0,0 +1,226 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { Check, Runner } from '../types';
+import { pinnedPath } from './toolchain';
+import { registry } from './registry';
+import {
+  cacheKey,
+  cachedCheck,
+  sourceKey,
+  type VerifyCache,
+} from './verify-cache';
+
+const PROMPT = 'Reply with exactly: OK';
+
+/** Every agent T3 offers on every node, launched exactly as T3 launches it:
+ * through the tracked wrapper that injects the shared credential. `pin` names
+ * the mise.toml tool whose locked version the installed binary must report.
+ */
+export const NATIVE_AGENTS = [
+  {
+    name: 'claude',
+    binary: 'claude',
+    pin: 'claude',
+    wrapper: 'claude-proxy.ts',
+    args: ['-p', PROMPT],
+  },
+  {
+    name: 'codex',
+    binary: 'codex',
+    pin: 'codex',
+    wrapper: 'codex-proxy.ts',
+    args: ['exec', '--skip-git-repo-check', PROMPT],
+  },
+  {
+    name: 'grok',
+    binary: 'grok',
+    pin: 'http:grok',
+    wrapper: 'grok-proxy.ts',
+    args: ['-p', PROMPT],
+  },
+  {
+    name: 'antigravity',
+    binary: 'antigravity',
+    pin: 'http:antigravity',
+    wrapper: 'antigravity-proxy.ts',
+    args: [
+      '-p',
+      PROMPT,
+      '--model',
+      'Gemini 3.8 Flash (High)',
+      '--print-timeout',
+      '90s',
+    ],
+  },
+  {
+    name: 'muse',
+    binary: 'opencode',
+    pin: 'aqua:anomalyco/opencode',
+    wrapper: 'opencode-proxy.ts',
+    args: ['run', '--model', 'personal_proxy/devin/muse-wonder-1-0', PROMPT],
+  },
+] as const;
+
+type Agent = (typeof NATIVE_AGENTS)[number];
+
+/** Same versions everywhere (from the shared mise.lock) and a working signed-in
+ * session through each T3 launcher. Agents run concurrently and are bounded.
+ */
+export async function verifyNativeAgents(
+  node: string,
+  workspace: string,
+  run: Runner,
+  options: {
+    /** Proxy routes already found out of quota; their sessions are not run. */
+    outOfQuota?: Set<string>;
+    cache?: VerifyCache;
+  } = {}
+): Promise<Check[]> {
+  const { outOfQuota = new Set<string>(), cache = {} } = options;
+  const pins = parsePins(await readFile(join(workspace, 'mise.toml'), 'utf8'));
+  const cwd = await mkdtemp(join(tmpdir(), 'fleet-agents-'));
+  try {
+    const results = await Promise.all(
+      NATIVE_AGENTS.map(async (agent) => [
+        await versionCheck(agent, pins[agent.pin], run),
+        outOfQuota.has(agent.name)
+          ? quotaPass(agent)
+          : await cachedCheck(
+              `agent-${node}-${agent.name}`,
+              cacheKey(
+                node,
+                agent,
+                pins[agent.pin] ?? '',
+                registry,
+                await sourceKey(launcherSources(workspace, agent))
+              ),
+              () => sessionCheck(agent, { node, workspace, cwd }, run),
+              cache
+            ),
+      ])
+    );
+    return results.flat();
+  } finally {
+    await rm(cwd, { recursive: true, force: true });
+  }
+}
+
+/** Reads `tool = "x"` and `"tool" = { version = "x", ... }` pins. */
+export function parsePins(source: string): Record<string, string> {
+  const pins: Record<string, string> = {};
+  const pattern =
+    /^"?([A-Za-z0-9:@/._-]+)"?\s*=\s*(?:"([^"]+)"|\{[^\n]*?\bversion\s*=\s*"([^"]+)")/gm;
+  for (const match of source.matchAll(pattern))
+    pins[match[1]!] = (match[2] ?? match[3])!;
+  return pins;
+}
+
+/** Self-healing: a binary that drifted from the lock (a vendor self-updater
+ * rewrote it) is reinstalled from the locked artifact, then checked again.
+ */
+async function versionCheck(
+  agent: Agent,
+  pin: string | undefined,
+  run: Runner
+): Promise<Check> {
+  const matches = async () => {
+    const result = await run([agent.binary, '--version'], {
+      env: { PATH: pinnedPath() },
+      timeoutMs: 30_000,
+    });
+    return Boolean(pin) && result.ok && result.stdout.includes(pin!);
+  };
+  let ok = await matches();
+  if (!ok && pin) {
+    await run(
+      ['mise', 'install', '--locked', '--force', `${agent.pin}@${pin}`],
+      {
+        timeoutMs: 600_000,
+      }
+    );
+    ok = await matches();
+  }
+  return {
+    id: `agent:${agent.name}:version`,
+    status: ok ? 'pass' : 'fail',
+    summary: ok
+      ? `${agent.binary} ${pin} matches the shared toolchain lock.`
+      : 'AGENT_VERSION_MISMATCH',
+    ...(ok
+      ? {}
+      : {
+          remedy: {
+            action: `Every node runs the ${agent.binary} pinned in mise.toml/mise.lock; reinstalling it from the lock failed. Inspect mise install --locked ${agent.pin} on this node; never install it with a vendor self-updater.`,
+          },
+        }),
+  };
+}
+
+/** Quota is the account's, not the node's: no warning (as for providers). */
+function quotaPass(agent: Agent): Check {
+  return {
+    id: `agent:${agent.name}:session`,
+    status: 'pass',
+    summary: `The shared ${agent.name} account is rate limited or out of quota; its session is checked again once it recovers.`,
+  };
+}
+
+async function sessionCheck(
+  agent: Agent,
+  context: { node: string; workspace: string; cwd: string },
+  run: Runner
+): Promise<Check> {
+  const launch = () =>
+    run(
+      ['bun', join(context.workspace, 'agents', agent.wrapper), ...agent.args],
+      {
+        cwd: context.cwd,
+        env: { WS_AGENT_NODE: context.node, PATH: pinnedPath() },
+        input: '',
+        timeoutMs: 150_000,
+      }
+    );
+  const expected = /\bOK\b/;
+  let result = await launch();
+  // One retry: a CLI's first launch on a node may still be initializing.
+  if (!(result.ok && expected.test(result.stdout))) result = await launch();
+  const ok = result.ok && expected.test(result.stdout);
+  return {
+    id: `agent:${agent.name}:session`,
+    status: ok ? 'pass' : 'fail',
+    summary: ok
+      ? `${agent.name} runs signed in through its T3 launcher with the shared account.`
+      : sessionFailure(result.stderr + result.stdout),
+    ...(ok ? {} : { remedy: { action: sessionRemedy(agent) } }),
+  };
+}
+
+/** A stable code only; raw CLI output is never reported. */
+function sessionFailure(output: string): string {
+  if (/missing or out of date/.test(output)) return 'AGENT_PROFILE_STALE';
+  if (/Required secret unavailable/.test(output))
+    return 'AGENT_VAULT_UNAVAILABLE';
+  if (/model_not_found|unknown provider for model/.test(output))
+    return 'AGENT_MODEL_UNSERVED';
+  return 'AGENT_SESSION_UNVERIFIED';
+}
+
+function sessionRemedy(agent: Agent): string {
+  if (agent.name === 'antigravity')
+    return 'Antigravity sends its own catalog model ids; the proxy serves them through declared aliases that fleet-sync applies on the manager (see proxy:config-pending). Pick Gemini 3.8 Flash in T3: the default Pro model is not served by the shared accounts.';
+  return `Run the ${agent.name} launcher on this node to inspect it: WS_AGENT_NODE=<node> bun agents/${agent.wrapper}. Check this node's Vault session and the shared proxy.`;
+}
+
+/** The launcher and profile code a session depends on. */
+function launcherSources(workspace: string, agent: Agent): string[] {
+  const agents = join(workspace, 'agents');
+  const lib = join(workspace, 'src/agents');
+  return [
+    join(agents, agent.wrapper),
+    join(agents, 'managed-proxy.ts'),
+    ...['launch.ts', 'render.ts', 'secrets.ts', 'toolchain.ts'].map((name) =>
+      join(lib, name)
+    ),
+  ];
+}

package/src/agents/provider-errors.ts

@@ -0,0 +1,50 @@
+import { AgentConfigurationError } from './errors';
+
+export class ProviderVerificationError extends AgentConfigurationError {
+  constructor(
+    readonly code: string,
+    message: string
+  ) {
+    super(message);
+  }
+}
+export function providerHttpFailure(status: number): ProviderVerificationError {
+  const code =
+    status === 401 || status === 403
+      ? 'PROVIDER_AUTH_REJECTED'
+      : status === 429
+        ? 'PROVIDER_RATE_LIMITED'
+        : status >= 500
+          ? 'PROVIDER_UPSTREAM_UNAVAILABLE'
+          : 'PROVIDER_PROTOCOL_REJECTED';
+  return new ProviderVerificationError(
+    code,
+    'The gateway rejected a bounded verification request; response content is withheld.'
+  );
+}
+const SAFE_CODES = new Set([
+  'PROVIDER_AUTH_REJECTED',
+  'PROVIDER_RATE_LIMITED',
+  'PROVIDER_UPSTREAM_UNAVAILABLE',
+  'PROVIDER_PROTOCOL_REJECTED',
+  'PROVIDER_MODEL_UNAVAILABLE',
+  'PROVIDER_OUTPUT_UNVERIFIED',
+  'PROVIDER_TOOL_RESULT_UNVERIFIED',
+  'PROVIDER_EMPTY_RESPONSE',
+  'PROVIDER_RESPONSE_LIMIT',
+  'PROVIDER_TOOL_MISSING',
+  'PROVIDER_TOOL_INVALID',
+  'PROVIDER_TOOL_ARGUMENTS_INVALID',
+  'PROVIDER_STREAM_INCOMPLETE',
+]);
+export function providerFailureCode(error: unknown): string {
+  if (error instanceof ProviderVerificationError && SAFE_CODES.has(error.code))
+    return error.code;
+  if (error instanceof Error && SAFE_CODES.has(error.message))
+    return error.message;
+  if (error instanceof Error && error.name === 'TimeoutError')
+    return 'PROVIDER_TIMEOUT';
+  if (error instanceof TypeError) return 'PROVIDER_NETWORK_UNVERIFIED';
+  if (error instanceof SyntaxError) return 'PROVIDER_RESPONSE_INVALID';
+  return 'PROVIDER_ROUTE_UNVERIFIED';
+}

package/src/agents/registry.ts

@@ -0,0 +1,55 @@
+import { AgentConfigurationError } from './errors';
+import source from '../../agents/registry.json';
+import { createHash } from 'node:crypto';
+import { fleet } from '../fleet-config';
+
+export type Tool = keyof typeof source.defaults;
+export type Profile = 'direct' | 'proxy';
+export type Selection = {
+  node: string;
+  tool: Tool;
+  profile: Profile;
+  model: string;
+};
+/** The tracked registry plus the proxy endpoint from this fleet's config. */
+export const registry = {
+  ...source,
+  proxy: { endpoint: fleet.services.proxy.endpoint, ...source.proxy },
+};
+
+export function select(node: string, tool: string, profile: string): Selection {
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(node))
+    throw new AgentConfigurationError('Invalid node ID.');
+  if (!(tool in source.defaults) || !['direct', 'proxy'].includes(profile))
+    throw new AgentConfigurationError(
+      'Unsupported tool/profile; run bun src/agents/cli.ts agents inventory.'
+    );
+  const id = tool as Tool;
+  const model = resolveModel(node, id, profile as Profile);
+  if (!model || !/^[a-zA-Z0-9_./:+-]+$/.test(model))
+    throw new AgentConfigurationError(
+      'No approved model. Add an exact model ID to agents/registry.json and review it.'
+    );
+  return { node, tool: id, profile: profile as Profile, model };
+}
+
+export function resolveModel(
+  node: string,
+  tool: Tool,
+  profile: Profile,
+  nodes = source.nodes as Record<
+    string,
+    Partial<Record<Tool, { direct?: string; proxy?: string }>>
+  >
+) {
+  const override = nodes[node]?.[tool]?.[profile];
+  const models = source.proxy.models as Partial<Record<Tool, string | null>>;
+  return (
+    override ??
+    (profile === 'direct' ? source.defaults[tool].model : models[tool])
+  );
+}
+
+export function digest(value: string): string {
+  return createHash('sha256').update(value).digest('hex');
+}

package/src/agents/render.ts

@@ -0,0 +1,110 @@
+import { join, win32 } from 'node:path';
+import type { PlatformName } from '../platform/types';
+import { registry, type Selection } from './registry';
+
+/** Dedicated outputs; native login/state directories are never copied. */
+export function agentRoot(home: string, platform: PlatformName): string {
+  return platform === 'windows'
+    ? win32.join(home, 'AppData', 'Local', 'personal', 'agents')
+    : join(home, '.config', 'personal', 'agents');
+}
+
+export function render(s: Selection): Record<string, string> {
+  const model = JSON.stringify(s.model);
+  if (s.tool === 'codex') {
+    const provider =
+      s.profile === 'proxy'
+        ? '\nmodel_provider = "personal_proxy"\n[model_providers.personal_proxy]\nname = "Personal CLI Proxy"\nbase_url = ' +
+          JSON.stringify(registry.proxy.endpoint + '/v1') +
+          '\nenv_key = "CLIPROXY_API_KEY"\nwire_api = "responses"\nrequires_openai_auth = false\nsupports_websockets = false\n'
+        : '\n';
+    return { 'config.toml': `model = ${model}${provider}` };
+  }
+  if (s.tool === 'claude')
+    return {
+      'settings.json': JSON.stringify({ model: s.model }, null, 2) + '\n',
+    };
+  if (s.tool === 'grok') return { 'config.toml': grokConfig(s) };
+  if (s.tool === 'antigravity')
+    return {
+      // The fleet profile home for direct and one-shot runs (see launchArgs);
+      // never the human's ~/.gemini. T3 keeps its own private GEMINI_HOME.
+      '.gemini/antigravity-cli/settings.json':
+        JSON.stringify({ modelProvider: 'gemini' }, null, 2) + '\n',
+    };
+  if (s.tool === 'gemini')
+    return {
+      '.gemini/settings.json':
+        JSON.stringify(
+          {
+            model: { name: s.model },
+            ...(s.profile === 'proxy'
+              ? { security: { auth: { selectedType: 'gateway' } } }
+              : {}),
+          },
+          null,
+          2
+        ) + '\n',
+    };
+  const config =
+    s.profile === 'proxy'
+      ? {
+          $schema: 'https://opencode.ai/config.json',
+          model: `personal_proxy/${s.model}`,
+          provider: {
+            personal_proxy: {
+              npm: '@ai-sdk/openai',
+              options: {
+                baseURL: registry.proxy.endpoint + '/v1',
+                apiKey: '{env:CLIPROXY_API_KEY}',
+              },
+              models: Object.fromEntries(
+                [
+                  ...Object.values(registry.proxy.routes).map(
+                    (route) => route.model
+                  ),
+                  s.model,
+                ].map((id) => [id, { name: id }])
+              ),
+            },
+          },
+        }
+      : { $schema: 'https://opencode.ai/config.json', model: s.model };
+  return { 'opencode.json': JSON.stringify(config, null, 2) + '\n' };
+}
+
+/** Grok Build reads custom models only from GROK_HOME/config.toml. The key
+ * comes from the environment (env_key), never the file; no grok login.
+ */
+function grokConfig(s: Selection): string {
+  // Grok records a one-time skills migration in config.toml; declaring it up
+  // front keeps the rendered file unchanged by the CLI (no profile drift).
+  const lines = [
+    '[cli]',
+    'auto_update = false',
+    '',
+    '[marketplace]',
+    'default_skills_installs_purged = true',
+    '',
+  ];
+  if (s.profile !== 'proxy')
+    return [
+      ...lines,
+      '[models]',
+      `default = ${JSON.stringify(s.model)}`,
+      '',
+    ].join('\n');
+  return [
+    ...lines,
+    '[models]',
+    'default = "personal-proxy"',
+    '',
+    '[model.personal-proxy]',
+    `model = ${JSON.stringify(s.model)}`,
+    `name = ${JSON.stringify(`${s.model} (Personal CLI Proxy)`)}`,
+    `base_url = ${JSON.stringify(registry.proxy.endpoint + '/v1')}`,
+    'env_key = "CLIPROXY_API_KEY"',
+    'api_backend = "chat_completions"',
+    '',
+  ].join('\n');
+}

package/src/agents/round-trip.ts

@@ -0,0 +1,192 @@
+import { providerHttpFailure } from './provider-errors';
+import { randomUUID } from 'node:crypto';
+import { registry } from './registry';
+import { record } from '../config';
+
+/** Reasoning models spend output tokens thinking before any text or tool call,
+ * so a tight cap ends the response without the tool call or text being
+ * verified. Prompts are tiny; this is a ceiling, not an expected length.
+ */
+export const VERIFY_OUTPUT_TOKENS = 1024;
+
+/** Supported OpenAI Responses harness route. The only tool is a local echo;
+ * model output can never select a command, file, URL or other side effect.
+ */
+export async function verifyRoundTrip(
+  model: string,
+  key: string,
+  request = fetch
+): Promise<void> {
+  await verifyStream(model, key, request);
+  const nonce = randomUUID();
+  const tool = {
+    type: 'function',
+    name: 'fleet_echo',
+    description: 'Return the provided verification nonce.',
+    parameters: {
+      type: 'object',
+      properties: { nonce: { type: 'string', enum: [nonce] } },
+      required: ['nonce'],
+      additionalProperties: false,
+    },
+    strict: true,
+  };
+  const prompt = {
+    role: 'user',
+    content: `Call fleet_echo with nonce ${nonce}, then reply with its result.`,
+  };
+  const response = await call(
+    model,
+    key,
+    {
+      input: [prompt],
+      tools: [tool],
+      tool_choice: { type: 'function', name: 'fleet_echo' },
+      max_output_tokens: VERIFY_OUTPUT_TOKENS,
+    },
+    request
+  );
+  const payload: unknown = JSON.parse(await boundedText(response));
+  const invocation = validateInvocation(payload, nonce);
+  const final = await call(
+    model,
+    key,
+    {
+      input: [
+        prompt,
+        invocation,
+        {
+          type: 'function_call_output',
+          call_id: invocation.call_id,
+          output: nonce,
+        },
+      ],
+      tools: [tool],
+      tool_choice: 'none',
+      max_output_tokens: VERIFY_OUTPUT_TOKENS,
+    },
+    request
+  );
+  const completed: unknown = JSON.parse(await boundedText(final));
+  if (
+    !record(completed) ||
+    completed['status'] !== 'completed' ||
+    !Array.isArray(completed['output']) ||
+    !JSON.stringify(completed['output']).includes(nonce)
+  )
+    throw new Error('PROVIDER_TOOL_RESULT_UNVERIFIED');
+}
+async function call(
+  model: string,
+  key: string,
+  body: object,
+  request: typeof fetch
+): Promise<Response> {
+  const response = await request(registry.proxy.endpoint + '/v1/responses', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${key}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ model, ...body }),
+    redirect: 'error',
+    signal: AbortSignal.timeout(45_000),
+  });
+  if (!response.ok) throw providerHttpFailure(response.status);
+  return response;
+}
+async function boundedText(response: Response): Promise<string> {
+  if (!response.body) throw new Error('PROVIDER_EMPTY_RESPONSE');
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = '';
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      size += chunk.value.byteLength;
+      if (size > 512 * 1024) throw new Error('PROVIDER_RESPONSE_LIMIT');
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return text + decoder.decode();
+  } finally {
+    await reader.cancel();
+  }
+}
+function validateInvocation(
+  payload: unknown,
+  nonce: string
+): {
+  type: 'function_call';
+  call_id: string;
+  name: 'fleet_echo';
+  arguments: string;
+} {
+  if (!record(payload)) throw new Error('PROVIDER_TOOL_MISSING');
+  if (!Array.isArray(payload['output']))
+    throw new Error('PROVIDER_TOOL_MISSING');
+  const calls = payload['output'].filter(
+    (item) => record(item) && item['type'] === 'function_call'
+  );
+  const call = calls[0];
+  if (
+    calls.length !== 1 ||
+    !record(call) ||
+    call['name'] !== 'fleet_echo' ||
+    !stringFields(call, ['call_id', 'arguments'])
+  )
+    throw new Error('PROVIDER_TOOL_INVALID');
+  const args: unknown = JSON.parse(String(call['arguments']));
+  if (
+    !record(args) ||
+    Object.keys(args).length !== 1 ||
+    args['nonce'] !== nonce
+  )
+    throw new Error('PROVIDER_TOOL_ARGUMENTS_INVALID');
+  return {
+    type: 'function_call',
+    name: 'fleet_echo',
+    call_id: String(call['call_id']),
+    arguments: String(call['arguments']),
+  };
+}
+
+async function verifyStream(
+  model: string,
+  key: string,
+  request: typeof fetch
+): Promise<void> {
+  const response = await call(
+    model,
+    key,
+    {
+      input: 'Reply OK.',
+      stream: true,
+      max_output_tokens: VERIFY_OUTPUT_TOKENS,
+    },
+    request
+  );
+  const body = await boundedText(response);
+  const events: unknown[] = body
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith('data:'))
+    .map((line) => line.slice(5).trim())
+    .filter((line) => line !== '[DONE]')
+    .map((line) => JSON.parse(line));
+  const types = events.filter(record).map((event) => event['type']);
+  if (
+    !types.includes('response.completed') ||
+    !types.includes('response.output_text.delta') ||
+    types.includes('response.failed') ||
+    types.includes('error')
+  )
+    throw new Error('PROVIDER_STREAM_INCOMPLETE');
+}
+
+function stringFields(
+  value: Record<string, unknown>,
+  fields: string[]
+): boolean {
+  return fields.every((field) => typeof value[field] === 'string');
+}

package/src/agents/secrets.ts

@@ -0,0 +1,13 @@
+import { AgentConfigurationError } from './errors';
+import { secret } from '../fleet-config';
+
+/** The key every node presents to the CLI proxy, from this fleet's secrets
+ * provider with this node's own access.
+ */
+export async function proxyKey(): Promise<string> {
+  const value = await secret('proxy-client-key');
+  if (value) return value;
+  throw new AgentConfigurationError(
+    "Required secret unavailable: proxy-client-key. Restore this node's access to the fleet's secrets provider (see `secrets` in the fleet configuration)."
+  );
+}

package/src/agents/toolchain.ts

@@ -0,0 +1,34 @@
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+/** mise shims resolve every agent to the version pinned in the shared lock.
+ * Putting them first keeps an unmanaged copy elsewhere on PATH (a vendor
+ * installer in ~/.local/bin, an nvm global) from shadowing the pinned one.
+ */
+export function pinnedPath(env: NodeJS.ProcessEnv = process.env): string {
+  const data =
+    env['MISE_DATA_DIR'] ??
+    join(env['XDG_DATA_HOME'] ?? join(homedir(), '.local', 'share'), 'mise');
+  const shims = join(data, 'shims');
+  const rest = (env['PATH'] ?? '')
+    .split(delimiter)
+    .filter((entry) => entry && entry !== shims);
+  return [shims, ...rest].join(delimiter);
+}
+
+/** The real pinned executable behind a mise shim. Needed when a launch
+ * changes HOME: a shim run under another HOME cannot find mise's trust state.
+ */
+export function pinnedBinary(
+  tool: string,
+  env: NodeJS.ProcessEnv = process.env
+): string {
+  const result = spawnSync('mise', ['which', tool], {
+    encoding: 'utf8',
+    env: { ...env, PATH: pinnedPath(env) },
+    timeout: 15_000,
+  });
+  const path = result.status === 0 ? result.stdout.trim() : '';
+  return path.startsWith('/') ? path : tool;
+}