@forwardimpact/outpost 3.6.0 → 3.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forwardimpact/outpost",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "Personal operations center — context from email, calendar, and knowledge assembled so preparation is continuous, not a morning scramble.",
   "homepage": "https://www.forwardimpact.team",
   "repository": {

package/src/outpost.js

@@ -26,7 +26,7 @@ import { StateManager } from "./state-manager.js";
 import { AgentRunner } from "./agent-runner.js";
 import { Scheduler, formatLocalTime } from "./scheduler.js";
 import { KBManager } from "./kb-manager.js";
-import { SocketServer, requestShutdown } from "./socket-server.js";
+import { SocketServer, requestShutdown, requestWake } from "./socket-server.js";
 import {
   readPosture,
   writePosture,
@@ -436,17 +436,28 @@ export async function run(runtime, version) {
         cli.usageError("missing required argument <agent>");
         return 2;
       }
-      const config = await loadConfig();
-      const state = await stateManager.load();
-      const agent = config.agents[args[0]];
-      if (!agent) {
+      // Always route the wake through the running daemon. The daemon is the
+      // only spawn site that descends from fit-outpost.app, so a `claude`
+      // spawned there inherits the app as its TCC responsible process and a
+      // single grant to the app covers it. Spawning from this CLI process
+      // would attribute the access to the terminal instead, breaking the
+      // single-grant model. If no daemon is running there is nowhere to wake
+      // with correct attribution, so this errors rather than spawning locally.
+      const result = await requestWake(SOCKET_PATH, args[0], runtime);
+      if (result.ok) {
+        log(`Wake dispatched to daemon for "${args[0]}".`);
+        return 0;
+      }
+      if (result.reason === "not-running") {
         cli.error(
-          `agent "${args[0]}" not found. Available: ${Object.keys(config.agents).join(", ") || "(none)"}`,
+          "daemon not running. Start fit-outpost.app (or run `fit-outpost daemon`) before waking an agent.",
         );
-        return 1;
+      } else if (result.reason === "timeout") {
+        cli.error("daemon did not respond to the wake request.");
+      } else {
+        cli.error(result.message);
       }
-      await agentRunner.wake(args[0], agent, state, config.env);
-      return 0;
+      return 1;
     },
     init: async () => {
       if (!args[0]) {

package/src/socket-server.js

@@ -323,6 +323,71 @@ export class SocketServer {
   }
 }
 
+/**
+ * Connect to the running daemon and ask it to wake an agent.
+ *
+ * The wake runs inside the daemon process, which is the only spawn site that
+ * descends from fit-outpost.app — so the spawned `claude` inherits the app as
+ * its TCC responsible process. Routing every wake through the daemon is what
+ * keeps the single-grant model intact; a wake spawned from this CLI process
+ * would be attributed to the terminal instead. The daemon acknowledges
+ * (`ack`) once it has accepted the request and then runs the wake
+ * asynchronously, so this resolves on the ack rather than on completion.
+ *
+ * @param {string} socketPath
+ * @param {string} agent - Agent name to wake.
+ * @param {import("@forwardimpact/libutil/runtime").Runtime} runtime
+ *   Injected runtime bag (uses `fsSync` and `clock`).
+ * @returns {Promise<{ ok: boolean, reason?: "not-running"|"timeout"|"error", message?: string }>}
+ */
+export async function requestWake(socketPath, agent, runtime) {
+  if (!runtime?.fsSync) throw new Error("runtime.fsSync is required");
+  if (!runtime?.clock) throw new Error("runtime.clock is required");
+  if (!runtime.fsSync.existsSync(socketPath)) {
+    return { ok: false, reason: "not-running" };
+  }
+
+  return new Promise((resolve) => {
+    const timeout = runtime.clock.setTimeout(() => {
+      socket.destroy();
+      resolve({ ok: false, reason: "timeout" });
+    }, 5000);
+
+    const socket = createConnection(socketPath, () => {
+      socket.write(JSON.stringify({ type: "wake", agent }) + "\n");
+    });
+
+    let buffer = "";
+    socket.on("data", (data) => {
+      buffer += data.toString();
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      runtime.clock.clearTimeout(timeout);
+      let msg = null;
+      try {
+        msg = JSON.parse(buffer.slice(0, idx));
+      } catch {}
+      socket.destroy();
+      if (msg && msg.type === "ack" && msg.command === "wake") {
+        resolve({ ok: true });
+      } else {
+        resolve({
+          ok: false,
+          reason: "error",
+          message: msg?.message || "daemon rejected wake request",
+        });
+      }
+    });
+
+    // A stale socket file (daemon crashed) refuses the connection; treat it
+    // the same as a missing daemon.
+    socket.on("error", () => {
+      runtime.clock.clearTimeout(timeout);
+      resolve({ ok: false, reason: "not-running" });
+    });
+  });
+}
+
 /**
  * Connect to the daemon socket and request graceful shutdown.
  * @param {string} socketPath