@intent-systems/nexus 2026.1.5-3

package/dist/infra/node-pairing.js

@@ -0,0 +1,212 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { resolveConfigDir } from "../utils.js";
+const PENDING_TTL_MS = 5 * 60 * 1000;
+function defaultBaseDir() {
+    return resolveConfigDir(process.env, os.homedir);
+}
+function resolvePaths(baseDir) {
+    const root = baseDir ?? defaultBaseDir();
+    const dir = path.join(root, "nodes");
+    return {
+        dir,
+        pendingPath: path.join(dir, "pending.json"),
+        pairedPath: path.join(dir, "paired.json"),
+    };
+}
+async function readJSON(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeJSONAtomic(filePath, value) {
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${filePath}.${randomUUID()}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
+    await fs.rename(tmp, filePath);
+}
+function pruneExpiredPending(pendingById, nowMs) {
+    for (const [id, req] of Object.entries(pendingById)) {
+        if (nowMs - req.ts > PENDING_TTL_MS) {
+            delete pendingById[id];
+        }
+    }
+}
+let lock = Promise.resolve();
+async function withLock(fn) {
+    const prev = lock;
+    let release;
+    lock = new Promise((resolve) => {
+        release = resolve;
+    });
+    await prev;
+    try {
+        return await fn();
+    }
+    finally {
+        release?.();
+    }
+}
+async function loadState(baseDir) {
+    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    const [pending, paired] = await Promise.all([
+        readJSON(pendingPath),
+        readJSON(pairedPath),
+    ]);
+    const state = {
+        pendingById: pending ?? {},
+        pairedByNodeId: paired ?? {},
+    };
+    pruneExpiredPending(state.pendingById, Date.now());
+    return state;
+}
+async function persistState(state, baseDir) {
+    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    await Promise.all([
+        writeJSONAtomic(pendingPath, state.pendingById),
+        writeJSONAtomic(pairedPath, state.pairedByNodeId),
+    ]);
+}
+function normalizeNodeId(nodeId) {
+    return nodeId.trim();
+}
+function newToken() {
+    return randomUUID().replaceAll("-", "");
+}
+export async function listNodePairing(baseDir) {
+    const state = await loadState(baseDir);
+    const pending = Object.values(state.pendingById).sort((a, b) => b.ts - a.ts);
+    const paired = Object.values(state.pairedByNodeId).sort((a, b) => b.approvedAtMs - a.approvedAtMs);
+    return { pending, paired };
+}
+export async function getPairedNode(nodeId, baseDir) {
+    const state = await loadState(baseDir);
+    return state.pairedByNodeId[normalizeNodeId(nodeId)] ?? null;
+}
+export async function requestNodePairing(req, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const nodeId = normalizeNodeId(req.nodeId);
+        if (!nodeId) {
+            throw new Error("nodeId required");
+        }
+        const existing = Object.values(state.pendingById).find((p) => p.nodeId === nodeId);
+        if (existing) {
+            return { status: "pending", request: existing, created: false };
+        }
+        const isRepair = Boolean(state.pairedByNodeId[nodeId]);
+        const request = {
+            requestId: randomUUID(),
+            nodeId,
+            displayName: req.displayName,
+            platform: req.platform,
+            version: req.version,
+            deviceFamily: req.deviceFamily,
+            modelIdentifier: req.modelIdentifier,
+            caps: req.caps,
+            commands: req.commands,
+            permissions: req.permissions,
+            remoteIp: req.remoteIp,
+            silent: req.silent,
+            isRepair,
+            ts: Date.now(),
+        };
+        state.pendingById[request.requestId] = request;
+        await persistState(state, baseDir);
+        return { status: "pending", request, created: true };
+    });
+}
+export async function approveNodePairing(requestId, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const pending = state.pendingById[requestId];
+        if (!pending)
+            return null;
+        const now = Date.now();
+        const existing = state.pairedByNodeId[pending.nodeId];
+        const node = {
+            nodeId: pending.nodeId,
+            token: newToken(),
+            displayName: pending.displayName,
+            platform: pending.platform,
+            version: pending.version,
+            deviceFamily: pending.deviceFamily,
+            modelIdentifier: pending.modelIdentifier,
+            caps: pending.caps,
+            commands: pending.commands,
+            permissions: pending.permissions,
+            remoteIp: pending.remoteIp,
+            createdAtMs: existing?.createdAtMs ?? now,
+            approvedAtMs: now,
+        };
+        delete state.pendingById[requestId];
+        state.pairedByNodeId[pending.nodeId] = node;
+        await persistState(state, baseDir);
+        return { requestId, node };
+    });
+}
+export async function rejectNodePairing(requestId, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const pending = state.pendingById[requestId];
+        if (!pending)
+            return null;
+        delete state.pendingById[requestId];
+        await persistState(state, baseDir);
+        return { requestId, nodeId: pending.nodeId };
+    });
+}
+export async function verifyNodeToken(nodeId, token, baseDir) {
+    const state = await loadState(baseDir);
+    const normalized = normalizeNodeId(nodeId);
+    const node = state.pairedByNodeId[normalized];
+    if (!node)
+        return { ok: false };
+    return node.token === token ? { ok: true, node } : { ok: false };
+}
+export async function updatePairedNodeMetadata(nodeId, patch, baseDir) {
+    await withLock(async () => {
+        const state = await loadState(baseDir);
+        const normalized = normalizeNodeId(nodeId);
+        const existing = state.pairedByNodeId[normalized];
+        if (!existing)
+            return;
+        const next = {
+            ...existing,
+            displayName: patch.displayName ?? existing.displayName,
+            platform: patch.platform ?? existing.platform,
+            version: patch.version ?? existing.version,
+            deviceFamily: patch.deviceFamily ?? existing.deviceFamily,
+            modelIdentifier: patch.modelIdentifier ?? existing.modelIdentifier,
+            remoteIp: patch.remoteIp ?? existing.remoteIp,
+            caps: patch.caps ?? existing.caps,
+            commands: patch.commands ?? existing.commands,
+            permissions: patch.permissions ?? existing.permissions,
+        };
+        state.pairedByNodeId[normalized] = next;
+        await persistState(state, baseDir);
+    });
+}
+export async function renamePairedNode(nodeId, displayName, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const normalized = normalizeNodeId(nodeId);
+        const existing = state.pairedByNodeId[normalized];
+        if (!existing)
+            return null;
+        const trimmed = displayName.trim();
+        if (!trimmed)
+            throw new Error("displayName required");
+        const next = { ...existing, displayName: trimmed };
+        state.pairedByNodeId[normalized] = next;
+        await persistState(state, baseDir);
+        return next;
+    });
+}

package/dist/infra/path-env.js

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function isExecutable(filePath) {
+    try {
+        fs.accessSync(filePath, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isDirectory(dirPath) {
+    try {
+        return fs.statSync(dirPath).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function mergePath(params) {
+    const partsExisting = params.existing
+        .split(path.delimiter)
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const partsPrepend = params.prepend
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const seen = new Set();
+    const merged = [];
+    for (const part of [...partsPrepend, ...partsExisting]) {
+        if (!seen.has(part)) {
+            seen.add(part);
+            merged.push(part);
+        }
+    }
+    return merged.join(path.delimiter);
+}
+function candidateBinDirs(opts) {
+    const execPath = opts.execPath ?? process.execPath;
+    const cwd = opts.cwd ?? process.cwd();
+    const homeDir = opts.homeDir ?? os.homedir();
+    const platform = opts.platform ?? process.platform;
+    const candidates = [];
+    // Bun bundled (macOS app): `nexus` lives in the Relay dir (process.execPath).
+    try {
+        const execDir = path.dirname(execPath);
+        const siblingNexus = path.join(execDir, "nexus");
+        if (isExecutable(siblingNexus))
+            candidates.push(execDir);
+    }
+    catch {
+        // ignore
+    }
+    // Project-local installs (best effort): if a `node_modules/.bin/nexus` exists near cwd,
+    // include it. This helps when running under launchd or other minimal PATH environments.
+    const localBinDir = path.join(cwd, "node_modules", ".bin");
+    if (isExecutable(path.join(localBinDir, "nexus")))
+        candidates.push(localBinDir);
+    const miseDataDir = process.env.MISE_DATA_DIR ?? path.join(homeDir, ".local", "share", "mise");
+    const miseShims = path.join(miseDataDir, "shims");
+    if (isDirectory(miseShims))
+        candidates.push(miseShims);
+    // Common global install locations (macOS first).
+    if (platform === "darwin") {
+        candidates.push(path.join(homeDir, "Library", "pnpm"));
+    }
+    if (process.env.XDG_BIN_HOME)
+        candidates.push(process.env.XDG_BIN_HOME);
+    candidates.push(path.join(homeDir, ".local", "bin"));
+    candidates.push(path.join(homeDir, ".local", "share", "pnpm"));
+    candidates.push(path.join(homeDir, ".bun", "bin"));
+    candidates.push(path.join(homeDir, ".yarn", "bin"));
+    candidates.push("/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin");
+    return candidates.filter(isDirectory);
+}
+/**
+ * Best-effort PATH bootstrap so skills that require the `nexus` CLI can run
+ * under launchd/minimal environments (and inside the macOS bun bundle).
+ */
+export function ensureNexusCliOnPath(opts = {}) {
+    if (process.env.NEXUS_PATH_BOOTSTRAPPED === "1" || process.env.NEXUS_PATH_BOOTSTRAPPED === "1")
+        return;
+    process.env.NEXUS_PATH_BOOTSTRAPPED = "1";
+    process.env.NEXUS_PATH_BOOTSTRAPPED = "1"; // keep for backward compat
+    const existing = opts.pathEnv ?? process.env.PATH ?? "";
+    const prepend = candidateBinDirs(opts);
+    if (prepend.length === 0)
+        return;
+    const merged = mergePath({ existing, prepend });
+    if (merged)
+        process.env.PATH = merged;
+}

package/dist/infra/ports.js

@@ -0,0 +1,87 @@
+import net from "node:net";
+import { danger, info, logVerbose, shouldLogVerbose, warn, } from "../globals.js";
+import { logDebug } from "../logger.js";
+import { runExec } from "../process/exec.js";
+import { defaultRuntime } from "../runtime.js";
+class PortInUseError extends Error {
+    port;
+    details;
+    constructor(port, details) {
+        super(`Port ${port} is already in use.`);
+        this.name = "PortInUseError";
+        this.port = port;
+        this.details = details;
+    }
+}
+function isErrno(err) {
+    return Boolean(err && typeof err === "object" && "code" in err);
+}
+export async function describePortOwner(port) {
+    // Best-effort process info for a listening port (macOS/Linux).
+    try {
+        const { stdout } = await runExec("lsof", [
+            "-i",
+            `tcp:${port}`,
+            "-sTCP:LISTEN",
+            "-nP",
+        ]);
+        const trimmed = stdout.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    catch (err) {
+        logVerbose(`lsof unavailable: ${String(err)}`);
+    }
+    return undefined;
+}
+export async function ensurePortAvailable(port) {
+    // Detect EADDRINUSE early with a friendly message.
+    try {
+        await new Promise((resolve, reject) => {
+            const tester = net
+                .createServer()
+                .once("error", (err) => reject(err))
+                .once("listening", () => {
+                tester.close(() => resolve());
+            })
+                .listen(port);
+        });
+    }
+    catch (err) {
+        if (isErrno(err) && err.code === "EADDRINUSE") {
+            const details = await describePortOwner(port);
+            throw new PortInUseError(port, details);
+        }
+        throw err;
+    }
+}
+export async function handlePortError(err, port, context, runtime = defaultRuntime) {
+    // Uniform messaging for EADDRINUSE with optional owner details.
+    if (err instanceof PortInUseError ||
+        (isErrno(err) && err.code === "EADDRINUSE")) {
+        const details = err instanceof PortInUseError
+            ? err.details
+            : await describePortOwner(port);
+        runtime.error(danger(`${context} failed: port ${port} is already in use.`));
+        if (details) {
+            runtime.error(info("Port listener details:"));
+            runtime.error(details);
+            if (/nexus|src\/index\.ts|dist\/index\.js/.test(details)) {
+                runtime.error(warn("It looks like another nexus instance is already running. Stop it or pick a different port."));
+            }
+        }
+        runtime.error(info("Resolve by stopping the process using the port or passing --port <free-port>."));
+        runtime.exit(1);
+    }
+    runtime.error(danger(`${context} failed: ${String(err)}`));
+    if (shouldLogVerbose()) {
+        const stdout = err?.stdout;
+        const stderr = err?.stderr;
+        if (stdout?.trim())
+            logDebug(`stdout: ${stdout.trim()}`);
+        if (stderr?.trim())
+            logDebug(`stderr: ${stderr.trim()}`);
+    }
+    return runtime.exit(1);
+}
+export { PortInUseError };

package/dist/infra/provider-summary.js

@@ -0,0 +1,80 @@
+import chalk from "chalk";
+import { loadConfig } from "../config/config.js";
+import { resolveTelegramToken } from "../telegram/token.js";
+import { normalizeE164 } from "../utils.js";
+import { getWebAuthAgeMs, readWebSelfId, webAuthExists, } from "../web/session.js";
+export async function buildProviderSummary(cfg) {
+    const effective = cfg ?? loadConfig();
+    const lines = [];
+    const webEnabled = effective.web?.enabled !== false;
+    if (!webEnabled) {
+        lines.push(chalk.cyan("WhatsApp: disabled"));
+    }
+    else {
+        const webLinked = await webAuthExists();
+        const authAgeMs = getWebAuthAgeMs();
+        const authAge = authAgeMs === null ? "unknown" : formatAge(authAgeMs);
+        const { e164 } = readWebSelfId();
+        lines.push(webLinked
+            ? chalk.green(`WhatsApp: linked${e164 ? ` as ${e164}` : ""} (auth ${authAge})`)
+            : chalk.red("WhatsApp: not linked"));
+    }
+    const telegramEnabled = effective.telegram?.enabled !== false;
+    if (!telegramEnabled) {
+        lines.push(chalk.cyan("Telegram: disabled"));
+    }
+    else {
+        const { token: telegramToken } = resolveTelegramToken(effective);
+        const telegramConfigured = Boolean(telegramToken?.trim());
+        lines.push(telegramConfigured
+            ? chalk.green("Telegram: configured")
+            : chalk.cyan("Telegram: not configured"));
+    }
+    const signalEnabled = effective.signal?.enabled !== false;
+    if (!signalEnabled) {
+        lines.push(chalk.cyan("Signal: disabled"));
+    }
+    else {
+        const signalConfigured = Boolean(effective.signal) &&
+            Boolean(effective.signal?.account?.trim() ||
+                effective.signal?.httpUrl?.trim() ||
+                effective.signal?.cliPath?.trim() ||
+                effective.signal?.httpHost?.trim() ||
+                typeof effective.signal?.httpPort === "number" ||
+                typeof effective.signal?.autoStart === "boolean");
+        lines.push(signalConfigured
+            ? chalk.green("Signal: configured")
+            : chalk.cyan("Signal: not configured"));
+    }
+    const imessageEnabled = effective.imessage?.enabled !== false;
+    if (!imessageEnabled) {
+        lines.push(chalk.cyan("iMessage: disabled"));
+    }
+    else {
+        const imessageConfigured = Boolean(effective.imessage);
+        lines.push(imessageConfigured
+            ? chalk.green("iMessage: configured")
+            : chalk.cyan("iMessage: not configured"));
+    }
+    const allowFrom = effective.whatsapp?.allowFrom?.length
+        ? effective.whatsapp.allowFrom.map(normalizeE164).filter(Boolean)
+        : [];
+    if (allowFrom.length) {
+        lines.push(chalk.cyan(`AllowFrom: ${allowFrom.join(", ")}`));
+    }
+    return lines;
+}
+export function formatAge(ms) {
+    if (ms < 0)
+        return "unknown";
+    const minutes = Math.round(ms / 60_000);
+    if (minutes < 1)
+        return "just now";
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days}d ago`;
+}

package/dist/infra/provider-usage.auth.js

@@ -0,0 +1,189 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { CLAUDE_CLI_PROFILE_ID, ensureAuthProfileStore, listProfilesForProvider, resolveApiKeyForProfile, resolveAuthProfileOrder, } from "../agents/auth-profiles.js";
+import { getCustomProviderApiKey, resolveEnvApiKey } from "../agents/model-auth.js";
+import { normalizeProviderId } from "../agents/model-selection.js";
+import { loadConfig } from "../config/config.js";
+function parseGoogleToken(apiKey) {
+    if (!apiKey)
+        return null;
+    try {
+        const parsed = JSON.parse(apiKey);
+        if (parsed && typeof parsed.token === "string") {
+            return { token: parsed.token };
+        }
+    }
+    catch {
+        // ignore
+    }
+    return null;
+}
+function resolveZaiApiKey() {
+    const envDirect = process.env.ZAI_API_KEY?.trim() || process.env.Z_AI_API_KEY?.trim();
+    if (envDirect)
+        return envDirect;
+    const envResolved = resolveEnvApiKey("zai");
+    if (envResolved?.apiKey)
+        return envResolved.apiKey;
+    const cfg = loadConfig();
+    const key = getCustomProviderApiKey(cfg, "zai") || getCustomProviderApiKey(cfg, "z-ai");
+    if (key)
+        return key;
+    const store = ensureAuthProfileStore();
+    const apiProfile = [
+        ...listProfilesForProvider(store, "zai"),
+        ...listProfilesForProvider(store, "z-ai"),
+    ].find((id) => store.profiles[id]?.type === "api_key");
+    if (apiProfile) {
+        const cred = store.profiles[apiProfile];
+        if (cred?.type === "api_key" && cred.key?.trim()) {
+            return cred.key.trim();
+        }
+    }
+    try {
+        const authPath = path.join(os.homedir(), ".pi", "agent", "auth.json");
+        if (!fs.existsSync(authPath))
+            return undefined;
+        const data = JSON.parse(fs.readFileSync(authPath, "utf-8"));
+        return data["z-ai"]?.access || data.zai?.access;
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveMinimaxApiKey() {
+    const envDirect = process.env.MINIMAX_CODE_PLAN_KEY?.trim() || process.env.MINIMAX_API_KEY?.trim();
+    if (envDirect)
+        return envDirect;
+    const envResolved = resolveEnvApiKey("minimax");
+    if (envResolved?.apiKey)
+        return envResolved.apiKey;
+    const cfg = loadConfig();
+    const key = getCustomProviderApiKey(cfg, "minimax");
+    if (key)
+        return key;
+    const store = ensureAuthProfileStore();
+    const apiProfile = listProfilesForProvider(store, "minimax").find((id) => {
+        const cred = store.profiles[id];
+        return cred?.type === "api_key" || cred?.type === "token";
+    });
+    if (!apiProfile)
+        return undefined;
+    const cred = store.profiles[apiProfile];
+    if (cred?.type === "api_key" && cred.key?.trim()) {
+        return cred.key.trim();
+    }
+    if (cred?.type === "token" && cred.token?.trim()) {
+        return cred.token.trim();
+    }
+    return undefined;
+}
+async function resolveOAuthToken(params) {
+    const cfg = loadConfig();
+    const store = ensureAuthProfileStore(params.agentDir, {
+        allowKeychainPrompt: false,
+    });
+    const order = resolveAuthProfileOrder({
+        cfg,
+        store,
+        provider: params.provider,
+    });
+    // Claude CLI creds are the only Anthropic tokens that reliably include the
+    // `user:profile` scope required for the OAuth usage endpoint.
+    const candidates = params.provider === "anthropic" ? [CLAUDE_CLI_PROFILE_ID, ...order] : order;
+    const deduped = [];
+    for (const entry of candidates) {
+        if (!deduped.includes(entry))
+            deduped.push(entry);
+    }
+    for (const profileId of deduped) {
+        const cred = store.profiles[profileId];
+        if (!cred || (cred.type !== "oauth" && cred.type !== "token"))
+            continue;
+        try {
+            const resolved = await resolveApiKeyForProfile({
+                // Usage snapshots should work even if config profile metadata is stale.
+                // (e.g. config says api_key but the store has a token profile.)
+                cfg: undefined,
+                store,
+                profileId,
+            });
+            if (!resolved?.apiKey)
+                continue;
+            let token = resolved.apiKey;
+            if (params.provider === "google-gemini-cli" || params.provider === "google-antigravity") {
+                const parsed = parseGoogleToken(resolved.apiKey);
+                token = parsed?.token ?? resolved.apiKey;
+            }
+            return {
+                provider: params.provider,
+                token,
+                accountId: cred.type === "oauth" && "accountId" in cred
+                    ? cred.accountId
+                    : undefined,
+            };
+        }
+        catch {
+            // ignore
+        }
+    }
+    return null;
+}
+function resolveOAuthProviders(agentDir) {
+    const store = ensureAuthProfileStore(agentDir, {
+        allowKeychainPrompt: false,
+    });
+    const cfg = loadConfig();
+    const providers = [
+        "anthropic",
+        "github-copilot",
+        "google-gemini-cli",
+        "google-antigravity",
+        "openai-codex",
+    ];
+    const isOAuthLikeCredential = (id) => {
+        const cred = store.profiles[id];
+        return cred?.type === "oauth" || cred?.type === "token";
+    };
+    return providers.filter((provider) => {
+        const profiles = listProfilesForProvider(store, provider).filter(isOAuthLikeCredential);
+        if (profiles.length > 0)
+            return true;
+        const normalized = normalizeProviderId(provider);
+        const configuredProfiles = Object.entries(cfg.auth?.profiles ?? {})
+            .filter(([, profile]) => normalizeProviderId(profile.provider) === normalized)
+            .map(([id]) => id)
+            .filter(isOAuthLikeCredential);
+        return configuredProfiles.length > 0;
+    });
+}
+export async function resolveProviderAuths(params) {
+    if (params.auth)
+        return params.auth;
+    const oauthProviders = resolveOAuthProviders(params.agentDir);
+    const auths = [];
+    for (const provider of params.providers) {
+        if (provider === "zai") {
+            const apiKey = resolveZaiApiKey();
+            if (apiKey)
+                auths.push({ provider, token: apiKey });
+            continue;
+        }
+        if (provider === "minimax") {
+            const apiKey = resolveMinimaxApiKey();
+            if (apiKey)
+                auths.push({ provider, token: apiKey });
+            continue;
+        }
+        if (!oauthProviders.includes(provider))
+            continue;
+        const auth = await resolveOAuthToken({
+            provider,
+            agentDir: params.agentDir,
+        });
+        if (auth)
+            auths.push(auth);
+    }
+    return auths;
+}