@geravant/sinain 1.15.1 → 1.15.3

package/cli.js

@@ -14,11 +14,18 @@ const SINAIN_DIR = path.join(HOME, ".sinain");
 const PKG_DIR = path.dirname(new URL(import.meta.url).pathname);
 
 // Self-update sentinel — query the npm registry, and if a newer version
-// of @geravant/sinain is available, re-exec via `npx --ignore-existing`
-// before doing anything else. Adds ~500ms startup but kills the
-// "stale npx cache silently serves 1.6.x" class of bugs permanently.
-// See self-update.js for details + opt-out env var.
-await checkForUpdate();
+// of @geravant/sinain is available, re-exec before doing anything else.
+// Adds ~500ms startup but kills the "stale npx cache silently serves 1.6.x"
+// class of bugs permanently. See self-update.js for details + opt-out env var.
+//
+// Wrapped in try/catch so a bug here (or a missing module) can't silently
+// kill the CLI — the user always sees the dispatch path run, even if the
+// update check fails for any reason.
+try {
+  await checkForUpdate();
+} catch (err) {
+  process.stderr.write(`  ⚠ self-update check failed: ${err.message}\n  (continuing with installed version)\n`);
+}
 
 switch (cmd) {
   case "start":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geravant/sinain",
-  "version": "1.15.1",
+  "version": "1.15.3",
   "description": "Ambient intelligence that sees what you see, hears what you hear, and acts on your behalf",
   "type": "module",
   "bin": {
@@ -14,6 +14,7 @@
   },
   "files": [
     "cli.js",
+    "self-update.js",
     "config.js",
     "config-shared.js",
     "onboard.js",
@@ -39,6 +40,7 @@
     "sinain-mcp-server/tsconfig.json",
     "sinain-agent/run.sh",
     "sinain-agent/mcp-config.json",
+    "sinain-agent/agents.example.json",
     "sinain-agent/.env.example",
     "sinain-agent/CLAUDE.md",
     "sense_client",

package/self-update.js

@@ -0,0 +1,135 @@
+/**
+ * Self-update sentinel for @geravant/sinain.
+ *
+ * Why this exists: when users run `npx @geravant/sinain start` (without a
+ * version pin), npx caches the *unversioned spec* and reuses that cache
+ * forever — never re-checking the registry. Users end up running 1.6.x
+ * for months while the latest is 1.15+. The cache-key is the spec, not
+ * the version, so once the slot is populated, `npx` considers the spec
+ * "satisfied" indefinitely.
+ *
+ * Fix: at the top of cli.js, BEFORE any command dispatches, query the
+ * npm registry for the current `latest` dist-tag. If it's newer than
+ * the version of this file, re-exec ourselves with
+ * `npx --ignore-existing @geravant/sinain@<latest> <argv>`. The user sees
+ * one extra "updating..." line and then the up-to-date wizard runs.
+ *
+ * Cost: ~500ms startup latency (single HTTPS GET to registry.npmjs.org).
+ * Soft-fail on network errors so offline use still works.
+ *
+ * Loop protection: SINAIN_SELF_UPDATED=1 is set on the relaunched process
+ * so it can't recurse if the registry returns nonsense. Users can opt out
+ * entirely with SINAIN_NO_AUTO_UPDATE=1.
+ */
+
+import { spawnSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PKG_NAME = "@geravant/sinain";
+const REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
+const FETCH_TIMEOUT_MS = 2000;
+
+/**
+ * Compare two semver versions. Returns >0 if a>b, <0 if a<b, 0 if equal.
+ * Handles only X.Y.Z (no pre-release tags). Tolerates leading 'v'.
+ */
+function semverCompare(a, b) {
+  const parse = (v) => v.replace(/^v/, "").split(/[.+-]/).map((p) => parseInt(p, 10) || 0);
+  const [a1, a2, a3] = parse(a);
+  const [b1, b2, b3] = parse(b);
+  if (a1 !== b1) return a1 - b1;
+  if (a2 !== b2) return a2 - b2;
+  return a3 - b3;
+}
+
+function readLocalVersion() {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf-8"));
+    return pkg.version;
+  } catch {
+    return null;
+  }
+}
+
+async function fetchRemoteVersion() {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(REGISTRY_URL, { signal: ctrl.signal });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.version ?? null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Commands that should NOT trigger a self-update check:
+ *   - update    : explicit user action (already updating)
+ *   - version   : status query, must be fast and offline-safe
+ *   - help      : ditto
+ *   - stop      : tearing things down, don't introduce a network call
+ *   - status    : status query, fast + offline-safe
+ *   - completion / shell helpers : trivial, must not block
+ *
+ * `start`, `setup-overlay`, `onboard`, `config` (i.e. anything that runs
+ * the wizard or core install path) DO trigger the check, because that's
+ * where stale-cache UX hits hardest.
+ */
+const SKIP_COMMANDS = new Set([
+  "update", "version", "--version", "-v",
+  "help", "--help", "-h",
+  "stop", "status", "completion",
+]);
+
+/**
+ * Run the self-update check. If a newer version is available, exec ourselves
+ * via `npx --ignore-existing @geravant/sinain@<latest>` and exit with the
+ * relaunched process's status. If everything's fine (or the check fails
+ * soft), this function returns and the caller proceeds normally.
+ */
+export async function checkForUpdate() {
+  // Loop guard — set on the relaunched process so we can't recurse.
+  if (process.env.SINAIN_SELF_UPDATED === "1") return;
+  // Opt-out for users who don't want the network call.
+  if (process.env.SINAIN_NO_AUTO_UPDATE === "1") return;
+  // Skip commands that shouldn't pay the network cost.
+  const cmd = process.argv[2];
+  if (cmd && SKIP_COMMANDS.has(cmd)) return;
+
+  const local = readLocalVersion();
+  if (!local) return;
+
+  const remote = await fetchRemoteVersion();
+  if (!remote) return;
+
+  if (semverCompare(remote, local) <= 0) return;
+
+  // Stale — print + relaunch.
+  process.stderr.write(
+    `\n  ⚠ sinain ${local} is stale; latest is ${remote}\n` +
+    `  Auto-updating... (set SINAIN_NO_AUTO_UPDATE=1 to disable)\n\n`,
+  );
+
+  const args = process.argv.slice(2);
+  // --yes: skip npx's "are you sure" prompt for unfamiliar packages.
+  // (Note: do NOT pass --ignore-existing — npm 7+ removed it. The
+  //  version-pinned spec `@geravant/sinain@<remote>` already keys to a
+  //  separate npx cache slot, so a fresh `<remote>` triggers a download
+  //  regardless of what's in the unversioned slot.)
+  const result = spawnSync(
+    "npx",
+    ["--yes", `${PKG_NAME}@${remote}`, ...args],
+    {
+      stdio: "inherit",
+      env: { ...process.env, SINAIN_SELF_UPDATED: "1" },
+    },
+  );
+  process.exit(result.status ?? 1);
+}

package/sinain-agent/agents.example.json

@@ -0,0 +1,148 @@
+{
+  "_doc": [
+    "Roster + bare-agent + OpenClaw config for sinain. This is the single",
+    "source of truth for everything agent-shaped:",
+    "  - top-level fields  → bare-agent infra (poll, turns, tool whitelists)",
+    "  - escalation block  → routing policy (was ESCALATION_* in .env)",
+    "  - analyzer block    → loop pacing (was AGENT_DEBOUNCE_MS / _MAX_INTERVAL_MS)",
+    "  - profiles          → one entry per CLI binary or routing target",
+    "                        (claude, openclaude, codex, ..., openclaw)",
+    "",
+    "This is the COMMITTED example. The actual file run.sh and sinain-core",
+    "read is sinain-agent/agents.json (gitignored). On first run, run.sh",
+    "copies this example into agents.json so a fresh checkout works without",
+    "manual setup. sinain-core falls back to this file too if agents.json",
+    "doesn't exist yet.",
+    "",
+    "Path resolution in sinain-core: AGENTS_CONFIG_PATH env override, or",
+    "default: <repo-root>/sinain-agent/agents.json (resolved relative to",
+    "the sinain-core/dist directory).",
+    "",
+    "Profile fields (all optional except `type`):",
+    "  type      Determines dispatch path AND CLI flag layout.",
+    "            Local CLIs (HTTP-dispatched): claude, openclaude, codex,",
+    "            goose, junie, aider — bare agent invokes the binary.",
+    "            Gateway profiles (WS-dispatched): openclaw — sinain-core",
+    "            sends via WS RPC. Multiple gateway profiles with different",
+    "            names are allowed (e.g. nemoclaw, nanoclaw-prod) — any",
+    "            profile with `type: \"openclaw\"` is treated as a gateway.",
+    "            All gateway profiles auto-register in the overlay roster.",
+    "  bin       Path or name of a real binary on PATH (default: profile",
+    "            name). Shell aliases are invisible here — replicate them",
+    "            as bin (the underlying binary) + env (the vars the alias",
+    "            was setting). See the pclaude example.",
+    "  settings  Path to a Claude-Code-style settings.json (default:",
+    "            sinain-agent/.claude/settings.json — the hook-bearing one).",
+    "  model     OPENAI_MODEL override (only meaningful for openclaude /",
+    "            CLAUDE_CODE_USE_OPENAI=1 paths).",
+    "  env       Per-profile env overrides applied only for this binary's",
+    "            invocation. Values may use ${VAR} indirection (anywhere in",
+    "            the string) to read from the parent shell's environment —",
+    "            keep secrets in .env, not here.",
+    "",
+    "openclaw-profile-only fields (consumed by sinain-core):",
+    "  wsUrl, wsToken, httpUrl, httpToken, sessionKey, phase1TimeoutMs,",
+    "  phase2TimeoutMs, pingIntervalMs",
+    "",
+    "Examples beyond the built-ins live under `_examples`. Move any of them",
+    "into `profiles` to activate; the runtime ignores keys it doesn't know."
+  ],
+
+  "default": "openclaude",
+  "pollIntervalSec": 5,
+  "agentMaxTurns": 8,
+  "spawnMaxTurns": 25,
+
+  "allowedTools": "mcp__sinain",
+  "escAllowedTools": "${allowedTools} Bash(git:*) Edit Write Read Glob Grep LS",
+  "spawnAllowedTools": "${allowedTools} Bash(git:*) Edit Write Read Glob Grep LS",
+  "autoApproveTools": "Read Glob Grep Ls Cat mcp__sinain*",
+
+  "analyzer": {
+    "debounceMs": 6000,
+    "maxIntervalMs": 60000
+  },
+
+  "escalation": {
+    "mode": "rich",
+    "cooldownMs": 30000,
+    "staleMs": 90000
+  },
+
+  "profiles": {
+    "claude":     { "type": "claude" },
+    "openclaude": {
+      "_comment": "Routes through the local OpenRouter proxy (auto-launched on :11435 by run.sh) → DeepSeek V4 Flash. Proxy preserves reasoning_content across multi-turn MCP flows. To use Anthropic API directly, drop the env block (or just pick the `claude` profile).",
+      "type": "openclaude",
+      "model": "deepseek/deepseek-v4-flash",
+      "env": {
+        "CLAUDE_CODE_USE_OPENAI": "1",
+        "OPENAI_BASE_URL": "http://localhost:11435/api/v1",
+        "OPENAI_API_KEY": "${OPENROUTER_API_KEY}"
+      }
+    },
+    "openclaw": {
+      "_comment": "Remote gateway routing. Selecting openclaw for a lane sends that lane's traffic to the OpenClaw gateway via WS RPC instead of the local bare agent. sinain-core reads these fields directly at startup to construct the WS client. Removing this profile disables the gateway path entirely (no WS client, no openclaw chip in the overlay roster).",
+      "type": "openclaw",
+      "wsUrl": "ws://localhost:18789",
+      "wsToken": "${OPENCLAW_WS_TOKEN}",
+      "httpUrl": "http://localhost:18789/hooks/agent",
+      "httpToken": "${OPENCLAW_HTTP_TOKEN}",
+      "sessionKey": "agent:main:sinain",
+      "phase1TimeoutMs": 30000,
+      "phase2TimeoutMs": 120000,
+      "pingIntervalMs": 30000
+    },
+    "codex":      { "type": "codex" },
+    "goose":      { "type": "goose" },
+    "junie":      { "type": "junie" },
+    "aider":      { "type": "aider" }
+  },
+
+  "_examples": {
+    "pclaude": {
+      "_comment": "Personal claude config. `bin` must be a real PATH binary — replicate a shell alias as bin+env (the alias `pclaude=CLAUDE_CONFIG_DIR=$HOME/.claude-personal claude` becomes the entry below).",
+      "type": "claude",
+      "bin": "claude",
+      "env": {
+        "CLAUDE_CONFIG_DIR": "${HOME}/.claude-personal"
+      }
+    },
+    "pclaude-with-personal-endpoint": {
+      "_comment": "Personal claude pointing at a private OpenAI-compat endpoint.",
+      "type": "claude",
+      "bin": "claude",
+      "env": {
+        "OPENAI_API_KEY": "${PERSONAL_OPENAI_API_KEY}",
+        "OPENAI_BASE_URL": "https://my-personal-endpoint/v1"
+      },
+      "settings": "~/.pclaude/settings.json"
+    },
+    "openclaude-spawn": {
+      "_comment": "Different settings.json for the spawn lane vs the escalation lane.",
+      "type": "openclaude",
+      "bin": "openclaude",
+      "settings": "/Users/your.name/IdeaProjects/sinain-hud/sinain-agent/.claude/spawn-settings.json"
+    },
+    "openclaude-gpt5": {
+      "_comment": "Same binary, different model + key for a different OpenRouter route.",
+      "type": "openclaude",
+      "bin": "openclaude",
+      "model": "openai/gpt-5",
+      "env": {
+        "CLAUDE_CODE_USE_OPENAI": "1",
+        "OPENAI_BASE_URL": "http://localhost:11435/api/v1",
+        "OPENAI_API_KEY": "${OPENROUTER_API_KEY}"
+      }
+    },
+    "nemoclaw": {
+      "_comment": "Server-side NemoClaw (or any openclaw-fork) on a different host. `type: openclaw` makes it a WS-dispatched gateway alongside the canonical openclaw profile. Currently, only the first gateway profile gets a live WS client at startup — selecting nemoclaw in the overlay routes via WS, but the connection still uses openclaw's URL until per-profile WS clients ship.",
+      "type": "openclaw",
+      "wsUrl": "ws://nemoclaw-host:18789",
+      "wsToken": "${NEMOCLAW_WS_TOKEN}",
+      "httpUrl": "http://nemoclaw-host:18789/hooks/agent",
+      "httpToken": "${NEMOCLAW_HTTP_TOKEN}",
+      "sessionKey": "agent:main:sinain"
+    }
+  }
+}