@intent-systems/nexus 2026.1.5-3

package/dist/infra/usage-upload.js

@@ -0,0 +1,290 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import readline from "node:readline";
+import { resolveStateDir } from "../config/paths.js";
+import { resolveEventLogDir } from "./event-log.js";
+const UPLOAD_URL_ENV = "NEXUS_USAGE_UPLOAD_URL";
+const UPLOAD_TOKEN_ENV = "NEXUS_USAGE_UPLOAD_TOKEN";
+const OUTBOX_DIR_ENV = "NEXUS_USAGE_OUTBOX_DIR";
+const STATE_FILE = "upload-state.json";
+const ID_FILE = "anon-id.json";
+const EVENT_SCHEMA_VERSION = 1;
+const UPLOAD_SCHEMA_VERSION = 1;
+function resolveUsageDir() {
+    return path.join(resolveStateDir(), "usage");
+}
+function resolveOutboxDir(env = process.env) {
+    const override = env[OUTBOX_DIR_ENV]?.trim();
+    if (override)
+        return override;
+    return path.join(resolveStateDir(env), "events-outbox");
+}
+function stateFilePath() {
+    return path.join(resolveUsageDir(), STATE_FILE);
+}
+function anonIdFilePath() {
+    return path.join(resolveUsageDir(), ID_FILE);
+}
+function readJSON(pathname) {
+    try {
+        const raw = fs.readFileSync(pathname, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function writeJSON(pathname, data) {
+    fs.mkdirSync(path.dirname(pathname), { recursive: true });
+    fs.writeFileSync(pathname, JSON.stringify(data, null, 2), "utf-8");
+}
+function getOrCreateUsageState() {
+    const existing = readJSON(stateFilePath());
+    if (existing && existing.anon_id && existing.anon_salt) {
+        return existing;
+    }
+    const anonId = crypto.randomUUID();
+    const anonSalt = crypto.randomBytes(24).toString("hex");
+    const next = {
+        anon_id: anonId,
+        anon_salt: anonSalt,
+        cursor_ts: 0,
+        cursor_id: "",
+        updated_at: Date.now(),
+    };
+    writeJSON(stateFilePath(), next);
+    return next;
+}
+function getOrCreateAnonId() {
+    const existing = readJSON(anonIdFilePath());
+    if (existing?.anon_id && existing.anon_salt) {
+        return { anonId: existing.anon_id, anonSalt: existing.anon_salt };
+    }
+    const anonId = crypto.randomUUID();
+    const anonSalt = crypto.randomBytes(24).toString("hex");
+    writeJSON(anonIdFilePath(), { anon_id: anonId, anon_salt: anonSalt });
+    return { anonId, anonSalt };
+}
+function hashWithSalt(salt, value) {
+    return crypto.createHash("sha256").update(`${salt}:${value}`).digest("hex");
+}
+function shouldIncludeEvent(raw) {
+    if (!raw.event_type)
+        return false;
+    if (raw.event_type === "command_started" ||
+        raw.event_type === "command_finished" ||
+        raw.event_type === "command_failed") {
+        return Boolean(raw.command_path);
+    }
+    if (raw.event_type === "agent_event" && raw.stream === "tool") {
+        const phase = raw.data?.phase;
+        return phase === "start";
+    }
+    return false;
+}
+function toUploadEvent(raw, anonUserId, anonSalt) {
+    if (!shouldIncludeEvent(raw))
+        return null;
+    if (!raw.session_id || !raw.source || !raw.event_type)
+        return null;
+    const anonSessionId = hashWithSalt(anonSalt, raw.session_id);
+    const base = {
+        schema_version: EVENT_SCHEMA_VERSION,
+        anon_user_id: anonUserId,
+        anon_session_id: anonSessionId,
+        ts: raw.ts ?? 0,
+        seq: raw.seq ?? 0,
+        source: raw.source,
+        event_type: raw.event_type,
+        command_path: raw.command_path,
+        status: raw.status,
+    };
+    if (raw.event_type === "agent_event" && raw.stream === "tool") {
+        const name = typeof raw.data?.name === "string" ? raw.data?.name : undefined;
+        const phase = typeof raw.data?.phase === "string" ? raw.data?.phase : undefined;
+        return {
+            ...base,
+            tool_name: name,
+            tool_phase: phase,
+        };
+    }
+    if (typeof raw.invocation_kind === "string") {
+        base.invocation_kind = raw.invocation_kind;
+    }
+    else if (raw.data && typeof raw.data.invocation_kind === "string") {
+        base.invocation_kind = raw.data.invocation_kind;
+    }
+    return base;
+}
+function isAfterCursor(raw, cursorTs, cursorId) {
+    const ts = raw.ts ?? 0;
+    const id = raw.id ?? "";
+    if (ts > cursorTs)
+        return true;
+    if (ts === cursorTs && cursorId)
+        return id > cursorId;
+    return false;
+}
+function updateCursor(raw, state) {
+    const ts = raw.ts ?? 0;
+    const id = raw.id ?? "";
+    if (ts > state.cursor_ts) {
+        state.cursor_ts = ts;
+        state.cursor_id = id;
+    }
+    else if (ts === state.cursor_ts && id > state.cursor_id) {
+        state.cursor_id = id;
+    }
+}
+async function readEventLogs(handler, limit) {
+    const dir = resolveEventLogDir();
+    if (!fs.existsSync(dir))
+        return;
+    const files = fs
+        .readdirSync(dir)
+        .filter((name) => name.endsWith(".jsonl"))
+        .map((name) => path.join(dir, name))
+        .sort();
+    let count = 0;
+    for (const file of files) {
+        const stream = fs.createReadStream(file);
+        const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+        for await (const line of rl) {
+            if (limit && count >= limit) {
+                rl.close();
+                return;
+            }
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let raw;
+            try {
+                raw = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            const accepted = handler(raw);
+            if (accepted)
+                count += 1;
+        }
+    }
+}
+export async function buildUsageUploadBatch(limit = 1000) {
+    const state = getOrCreateUsageState();
+    const { anonId, anonSalt } = getOrCreateAnonId();
+    const events = [];
+    await readEventLogs((raw) => {
+        if (!raw.session_id || !raw.source || !raw.event_type)
+            return false;
+        if (!isAfterCursor(raw, state.cursor_ts, state.cursor_id))
+            return false;
+        const entry = toUploadEvent(raw, anonId, anonSalt);
+        updateCursor(raw, state);
+        if (entry) {
+            events.push(entry);
+            if (events.length >= limit)
+                return true;
+        }
+        return false;
+    }, limit);
+    state.updated_at = Date.now();
+    if (events.length === 0) {
+        return { batch: null, nextState: state, count: 0 };
+    }
+    const batch = {
+        batch_id: crypto.randomUUID(),
+        generated_at: Date.now(),
+        schema_version: UPLOAD_SCHEMA_VERSION,
+        anon_user_id: anonId,
+        events,
+    };
+    return { batch, nextState: state, count: events.length };
+}
+export function writeUsageUploadBatch(batch, state) {
+    const outboxDir = resolveOutboxDir();
+    fs.mkdirSync(outboxDir, { recursive: true });
+    const filename = `usage-batch-${batch.generated_at}-${batch.batch_id}.json`;
+    const filePath = path.join(outboxDir, filename);
+    fs.writeFileSync(filePath, JSON.stringify(batch, null, 2), "utf-8");
+    writeJSON(stateFilePath(), state);
+    return filePath;
+}
+async function uploadBatchFile(filePath) {
+    const url = process.env[UPLOAD_URL_ENV]?.trim();
+    if (!url)
+        return false;
+    const token = process.env[UPLOAD_TOKEN_ENV]?.trim();
+    const payload = fs.readFileSync(filePath, "utf-8");
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (token) {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    try {
+        const res = await fetch(url, {
+            method: "POST",
+            headers,
+            body: payload,
+        });
+        if (!res.ok)
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function flushUsageOutbox() {
+    const outboxDir = resolveOutboxDir();
+    if (!fs.existsSync(outboxDir))
+        return { attempted: 0, uploaded: 0 };
+    const files = fs
+        .readdirSync(outboxDir)
+        .filter((name) => name.endsWith(".json"))
+        .map((name) => path.join(outboxDir, name))
+        .sort();
+    let attempted = 0;
+    let uploaded = 0;
+    for (const file of files) {
+        attempted += 1;
+        const ok = await uploadBatchFile(file);
+        if (ok) {
+            uploaded += 1;
+            fs.unlinkSync(file);
+        }
+    }
+    return { attempted, uploaded };
+}
+export async function runUsageUpload(opts = {}) {
+    const limit = opts.limit && opts.limit > 0 ? opts.limit : 1000;
+    if (!opts.onlyFlush) {
+        const { batch, nextState, count } = await buildUsageUploadBatch(limit);
+        if (opts.dryRun) {
+            return {
+                status: "dry_run",
+                events: count,
+                batchCreated: Boolean(batch),
+            };
+        }
+        if (batch) {
+            writeUsageUploadBatch(batch, nextState);
+        }
+        else {
+            writeJSON(stateFilePath(), nextState);
+        }
+    }
+    if (opts.flush) {
+        const { attempted, uploaded } = await flushUsageOutbox();
+        return {
+            status: "flush",
+            attempted,
+            uploaded,
+        };
+    }
+    return {
+        status: "ok",
+    };
+}

package/dist/infra/voicewake.js

@@ -0,0 +1,78 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { resolveConfigDir } from "../utils.js";
+const DEFAULT_TRIGGERS = ["nexus", "claude", "computer"];
+function defaultBaseDir() {
+    return resolveConfigDir(process.env, os.homedir);
+}
+function resolvePath(baseDir) {
+    const root = baseDir ?? defaultBaseDir();
+    return path.join(root, "settings", "voicewake.json");
+}
+function sanitizeTriggers(triggers) {
+    const cleaned = (triggers ?? [])
+        .map((w) => (typeof w === "string" ? w.trim() : ""))
+        .filter((w) => w.length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_TRIGGERS;
+}
+async function readJSON(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeJSONAtomic(filePath, value) {
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${filePath}.${randomUUID()}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
+    await fs.rename(tmp, filePath);
+}
+let lock = Promise.resolve();
+async function withLock(fn) {
+    const prev = lock;
+    let release;
+    lock = new Promise((resolve) => {
+        release = resolve;
+    });
+    await prev;
+    try {
+        return await fn();
+    }
+    finally {
+        release?.();
+    }
+}
+export function defaultVoiceWakeTriggers() {
+    return [...DEFAULT_TRIGGERS];
+}
+export async function loadVoiceWakeConfig(baseDir) {
+    const filePath = resolvePath(baseDir);
+    const existing = await readJSON(filePath);
+    if (!existing) {
+        return { triggers: defaultVoiceWakeTriggers(), updatedAtMs: 0 };
+    }
+    return {
+        triggers: sanitizeTriggers(existing.triggers),
+        updatedAtMs: typeof existing.updatedAtMs === "number" && existing.updatedAtMs > 0
+            ? existing.updatedAtMs
+            : 0,
+    };
+}
+export async function setVoiceWakeTriggers(triggers, baseDir) {
+    const sanitized = sanitizeTriggers(triggers);
+    const filePath = resolvePath(baseDir);
+    return await withLock(async () => {
+        const next = {
+            triggers: sanitized,
+            updatedAtMs: Date.now(),
+        };
+        await writeJSONAtomic(filePath, next);
+        return next;
+    });
+}

package/dist/infra/widearea-dns.js

@@ -0,0 +1,123 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { CONFIG_DIR, ensureDir } from "../utils.js";
+export const WIDE_AREA_DISCOVERY_DOMAIN = "nexus.internal.";
+export const WIDE_AREA_ZONE_FILENAME = "nexus.internal.db";
+export function getWideAreaZonePath() {
+    return path.join(CONFIG_DIR, "dns", WIDE_AREA_ZONE_FILENAME);
+}
+function dnsLabel(raw, fallback) {
+    const normalized = raw
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+/, "")
+        .replace(/-+$/, "");
+    const out = normalized.length > 0 ? normalized : fallback;
+    return out.length <= 63 ? out : out.slice(0, 63);
+}
+function txtQuote(value) {
+    const escaped = value
+        .replaceAll("\\", "\\\\")
+        .replaceAll('"', '\\"')
+        .replaceAll("\n", "\\n");
+    return `"${escaped}"`;
+}
+function formatYyyyMmDd(date) {
+    const y = date.getUTCFullYear();
+    const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const d = String(date.getUTCDate()).padStart(2, "0");
+    return `${y}${m}${d}`;
+}
+function nextSerial(existingSerial, now) {
+    const today = formatYyyyMmDd(now);
+    const base = Number.parseInt(`${today}01`, 10);
+    if (!existingSerial || !Number.isFinite(existingSerial))
+        return base;
+    const existing = String(existingSerial);
+    if (existing.startsWith(today))
+        return existingSerial + 1;
+    return base;
+}
+function extractSerial(zoneText) {
+    const match = zoneText.match(/^\s*@\s+IN\s+SOA\s+\S+\s+\S+\s+(\d+)\s+/m);
+    if (!match)
+        return null;
+    const parsed = Number.parseInt(match[1], 10);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function extractContentHash(zoneText) {
+    const match = zoneText.match(/^\s*;\s*nexus-content-hash:\s*(\S+)\s*$/m);
+    return match?.[1] ?? null;
+}
+function computeContentHash(body) {
+    // Cheap stable hash; avoids importing crypto (and keeps deterministic across runtimes).
+    let h = 2166136261;
+    for (let i = 0; i < body.length; i++) {
+        h ^= body.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return (h >>> 0).toString(16).padStart(8, "0");
+}
+function renderZone(opts) {
+    const hostname = os.hostname().split(".")[0] ?? "nexus";
+    const hostLabel = dnsLabel(opts.hostLabel ?? hostname, "nexus");
+    const instanceLabel = dnsLabel(opts.instanceLabel ?? `${hostname}-bridge`, "nexus-bridge");
+    const txt = [
+        `displayName=${opts.displayName.trim() || hostname}`,
+        `transport=bridge`,
+        `bridgePort=${opts.bridgePort}`,
+    ];
+    if (opts.tailnetDns?.trim()) {
+        txt.push(`tailnetDns=${opts.tailnetDns.trim()}`);
+    }
+    const records = [];
+    records.push(`$ORIGIN ${WIDE_AREA_DISCOVERY_DOMAIN}`);
+    records.push(`$TTL 60`);
+    const soaLine = `@ IN SOA ns1 hostmaster ${opts.serial} 7200 3600 1209600 60`;
+    records.push(soaLine);
+    records.push(`@ IN NS ns1`);
+    records.push(`ns1 IN A ${opts.tailnetIPv4}`);
+    records.push(`${hostLabel} IN A ${opts.tailnetIPv4}`);
+    if (opts.tailnetIPv6) {
+        records.push(`${hostLabel} IN AAAA ${opts.tailnetIPv6}`);
+    }
+    records.push(`_nexus-bridge._tcp IN PTR ${instanceLabel}._nexus-bridge._tcp`);
+    records.push(`${instanceLabel}._nexus-bridge._tcp IN SRV 0 0 ${opts.bridgePort} ${hostLabel}`);
+    records.push(`${instanceLabel}._nexus-bridge._tcp IN TXT ${txt.map(txtQuote).join(" ")}`);
+    const contentBody = `${records.join("\n")}\n`;
+    const hashBody = `${records
+        .map((line) => line === soaLine
+        ? `@ IN SOA ns1 hostmaster SERIAL 7200 3600 1209600 60`
+        : line)
+        .join("\n")}\n`;
+    const contentHash = computeContentHash(hashBody);
+    return `; nexus-content-hash: ${contentHash}\n${contentBody}`;
+}
+export function renderWideAreaBridgeZoneText(opts) {
+    return renderZone(opts);
+}
+export async function writeWideAreaBridgeZone(opts) {
+    const zonePath = getWideAreaZonePath();
+    await ensureDir(path.dirname(zonePath));
+    const existing = (() => {
+        try {
+            return fs.readFileSync(zonePath, "utf-8");
+        }
+        catch {
+            return null;
+        }
+    })();
+    const nextNoSerial = renderWideAreaBridgeZoneText({ ...opts, serial: 0 });
+    const nextHash = extractContentHash(nextNoSerial);
+    const existingHash = existing ? extractContentHash(existing) : null;
+    if (existing && nextHash && existingHash === nextHash) {
+        return { zonePath, changed: false };
+    }
+    const existingSerial = existing ? extractSerial(existing) : null;
+    const serial = nextSerial(existingSerial, new Date());
+    const next = renderWideAreaBridgeZoneText({ ...opts, serial });
+    fs.writeFileSync(zonePath, next, "utf-8");
+    return { zonePath, changed: true };
+}

package/dist/infra/ws.js

@@ -0,0 +1,13 @@
+import { Buffer } from "node:buffer";
+export function rawDataToString(data, encoding = "utf8") {
+    if (typeof data === "string")
+        return data;
+    if (Buffer.isBuffer(data))
+        return data.toString(encoding);
+    if (Array.isArray(data))
+        return Buffer.concat(data).toString(encoding);
+    if (data instanceof ArrayBuffer) {
+        return Buffer.from(data).toString(encoding);
+    }
+    return Buffer.from(String(data)).toString(encoding);
+}

package/dist/logger.js

@@ -0,0 +1,52 @@
+import { danger, info, logVerboseConsole, success, warn } from "./globals.js";
+import { createSubsystemLogger, getLogger } from "./logging.js";
+import { defaultRuntime } from "./runtime.js";
+const subsystemPrefixRe = /^([a-z][a-z0-9-]{1,20}):\s+(.*)$/i;
+function splitSubsystem(message) {
+    const match = message.match(subsystemPrefixRe);
+    if (!match)
+        return null;
+    const [, subsystem, rest] = match;
+    return { subsystem, rest };
+}
+export function logInfo(message, runtime = defaultRuntime) {
+    const parsed = runtime === defaultRuntime ? splitSubsystem(message) : null;
+    if (parsed) {
+        createSubsystemLogger(parsed.subsystem).info(parsed.rest);
+        return;
+    }
+    runtime.log(info(message));
+    getLogger().info(message);
+}
+export function logWarn(message, runtime = defaultRuntime) {
+    const parsed = runtime === defaultRuntime ? splitSubsystem(message) : null;
+    if (parsed) {
+        createSubsystemLogger(parsed.subsystem).warn(parsed.rest);
+        return;
+    }
+    runtime.log(warn(message));
+    getLogger().warn(message);
+}
+export function logSuccess(message, runtime = defaultRuntime) {
+    const parsed = runtime === defaultRuntime ? splitSubsystem(message) : null;
+    if (parsed) {
+        createSubsystemLogger(parsed.subsystem).info(parsed.rest);
+        return;
+    }
+    runtime.log(success(message));
+    getLogger().info(message);
+}
+export function logError(message, runtime = defaultRuntime) {
+    const parsed = runtime === defaultRuntime ? splitSubsystem(message) : null;
+    if (parsed) {
+        createSubsystemLogger(parsed.subsystem).error(parsed.rest);
+        return;
+    }
+    runtime.error(danger(message));
+    getLogger().error(message);
+}
+export function logDebug(message) {
+    // Always emit to file logger (level-filtered); console only when verbose.
+    getLogger().debug(message);
+    logVerboseConsole(message);
+}