@love-moon/conductor-cli 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @love-moon/conductor-cli
 
+## 0.10.0
+
+### Minor Changes
+
+- 43c4f87: Runtime health preflight and agent schedule access control. The daemon now
+  advertises positive backend runtime health (`x-conductor-runtime-health`) so the
+  backend can reject task creation with `503 runtime_unavailable` before any
+  timeline activity, and adds `disable_built_in_cli_list` to opt out of built-in
+  SDK backends. The SDK attributes agent-originated scheduled-message calls with
+  `X-Conductor-Actor: agent` so per-task `agent_schedule_access`
+  (full/read_only/blocked) can govern `conductor task schedule` from agents while
+  human/UI calls stay unrestricted.
+
+### Patch Changes
+
+- 43c4f87: Fix `conductor fire` and `conductor diagnose` with an explicit `--config-file`
+  resolving `agent_token`/`backend_url` from daemon-injected `CONDUCTOR_*` env
+  instead of the file. Fire could dial the file's websocket with the inherited
+  token and loop on `4002 invalid-token`; diagnose queried the wrong backend and
+  404'd. An explicit config file now wins over inherited env, matching the
+  daemon's behavior.
+- 43c4f87: Fix `conductor update` installing into the wrong npm prefix.
+- Updated dependencies [43c4f87]
+- Updated dependencies [43c4f87]
+  - @love-moon/ai-sdk@0.10.0
+  - @love-moon/conductor-sdk@0.10.0
+
 ## 0.9.0
 
 ### Minor Changes

package/bin/conductor-config.js

@@ -319,6 +319,16 @@ async function main() {
     });
   }
 
+  lines.push(
+    "",
+    "# Uncomment to disable built-in SDK backends that are otherwise advertised",
+    "# automatically (copilot, dsh). Listing a name here hides it from the",
+    "# daemon's supported backends without removing the shipped dependency.",
+    "# disable_built_in_cli_list:",
+    "#   - dsh",
+    "#   - copilot"
+  );
+
   lines.push(
     "",
     "# Uncomment to use custom envs, such as proxy.",

package/bin/conductor-diagnose.js

@@ -6,6 +6,8 @@ import { hideBin } from "yargs/helpers";
 
 import { loadConfig } from "@love-moon/conductor-sdk";
 
+import { envForExplicitConfigFile } from "../src/config-env.js";
+
 const CLI_NAME = process.env.CONDUCTOR_CLI_NAME || "conductor diagnose";
 const DEFAULT_TIMEOUT_MS = 8000;
 
@@ -45,7 +47,7 @@ main().catch((error) => {
 });
 
 async function main() {
-  const config = loadConfig(args.configFile);
+  const config = loadConfig(args.configFile, { env: envForExplicitConfigFile(args.configFile) });
   const timeoutMs = normalizePositiveInt(args.timeoutMs, DEFAULT_TIMEOUT_MS);
   const baseUrl = String(config.backendUrl || "").replace(/\/+$/, "");
   const endpoint = `${baseUrl}/api/diagnostics/tasks/${encodeURIComponent(taskId)}`;

package/bin/conductor-fire.js

@@ -583,6 +583,17 @@ export function createPendingRemoteInterruptQueue() {
 async function main() {
   syncPwdEnvWithProcessCwdForDaemonLaunch();
   const cliArgs = await parseCliArgs();
+  if (cliArgs.configFile) {
+    // An explicit --config-file must win over CONDUCTOR_* backend/token env
+    // injected by an owning daemon or session (same convention as
+    // envForExplicitConfigFile); otherwise fire dials the file's websocket
+    // with the inherited token and loops on 4002 invalid-token.
+    delete process.env.CONDUCTOR_AGENT_TOKEN;
+    delete process.env.CONDUCTOR_BACKEND_URL;
+    delete process.env.CONDUCTOR_WS_URL;
+    delete process.env.CONDUCTOR_BACKEND_WS_URL;
+    process.env.CONDUCTOR_CONFIG = cliArgs.configFile;
+  }
   let runtimeProjectPath = process.cwd();
   let backendSession = null;
 

package/bin/conductor-update.js

@@ -17,6 +17,7 @@ import {
   fetchLatestVersion,
   isNewerVersion,
   detectPackageManager,
+  resolveGlobalInstallPrefix,
 } from "../src/version-check.js";
 import {
   buildPnpmAllowBuildArgs,
@@ -163,6 +164,18 @@ async function performUpdate() {
   console.log(`   Using package manager: ${colorize(packageManager, "cyan")}`);
   console.log("");
 
+  // `npm install -g` targets whichever npm wins the PATH lookup, which is not necessarily the
+  // one that installed us -- a Conductor-managed Node, an nvm shim and a system npm all resolve
+  // to different prefixes. When they disagree the update lands in a tree nobody runs, so
+  // `conductor --version` keeps reporting the old build and the next update repeats the cycle.
+  // Pin every child command to the prefix the running package actually lives in.
+  const installPrefix = packageManager === "npm" ? resolveGlobalInstallPrefix(PKG_ROOT) : null;
+  if (installPrefix) {
+    process.env.npm_config_prefix = installPrefix;
+    console.log(`   Install prefix: ${colorize(installPrefix, "cyan")}`);
+    console.log("");
+  }
+
   if (packageManager === "pnpm") {
     console.log("   Preparing pnpm native dependency allowlist...");
     await ensurePnpmOnlyBuiltDependencies({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@love-moon/conductor-cli",
-  "version": "0.9.0",
-  "gitCommitId": "606e5a6",
+  "version": "0.10.0",
+  "gitCommitId": "bc7b3a5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lovemoon-ai/conductor.git"
@@ -24,8 +24,8 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@love-moon/ai-sdk": "0.9.0",
-    "@love-moon/conductor-sdk": "0.9.0",
+    "@love-moon/ai-sdk": "0.10.0",
+    "@love-moon/conductor-sdk": "0.10.0",
     "@github/copilot-sdk": "^0.3.0",
     "chrome-launcher": "^1.2.1",
     "chrome-remote-interface": "^0.33.0",
@@ -38,7 +38,7 @@
   },
   "optionalDependencies": {
     "@roamhq/wrtc": "^0.10.0",
-    "@love-moon/chat-web": "0.9.0"
+    "@love-moon/chat-web": "0.10.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/src/daemon.js

@@ -353,6 +353,57 @@ function serializeRuntimeBackendMap(runtimeBackendMap) {
     .join(",");
 }
 
+// Backends whose install/auth health can be probed via the AI manager. Others
+// (external providers) are left out of the advertised health map so the web
+// runtime preflight fails open for them.
+const RUNTIME_HEALTH_TOOLS = new Set(["codex", "claude", "copilot", "kimi", "dsh"]);
+
+function runtimeHealthToolForBackend(backend, runtimeBackendMap) {
+  const normalized = String(backend || "").trim().toLowerCase();
+  if (RUNTIME_HEALTH_TOOLS.has(normalized)) {
+    return normalized;
+  }
+  const runtime = String(runtimeBackendMap?.[normalized] || "").trim().toLowerCase();
+  return RUNTIME_HEALTH_TOOLS.has(runtime) ? runtime : null;
+}
+
+function serializeRuntimeHealth(runtimeHealth) {
+  if (!runtimeHealth || typeof runtimeHealth !== "object") {
+    return "";
+  }
+  return Object.entries(runtimeHealth)
+    .filter(([backend, state]) => backend && state)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([backend, state]) => `${backend}=${state}`)
+    .join(",");
+}
+
+// Best-effort per-backend runtime health for the web runtime preflight. Only a
+// cheap install probe (which/--version) runs, once at startup. We advertise
+// only a POSITIVE `ready` confirmation: a supported backend whose default-name
+// `which` probe fails is very likely resolved via a custom or absolute path
+// (allow_cli_list, or a systemd PATH that differs from the login shell) and is
+// still runnable, so reporting it as "missing" would be an unreliable false
+// negative that could wrongly block task creation. Omitting it lets the web
+// preflight fail open for that backend.
+async function computeAdvertisedRuntimeHealth(manager, supportedBackends, runtimeBackendMap) {
+  if (!manager || typeof manager.checkInstallAll !== "function") {
+    return {};
+  }
+  const install = await manager.checkInstallAll();
+  const runtimeHealth = {};
+  for (const backend of supportedBackends || []) {
+    const tool = runtimeHealthToolForBackend(backend, runtimeBackendMap);
+    if (!tool) {
+      continue;
+    }
+    if (install?.[tool]?.installed) {
+      runtimeHealth[String(backend).trim().toLowerCase()] = "ready";
+    }
+  }
+  return runtimeHealth;
+}
+
 async function defaultCreatePty(command, args, options) {
   if (!nodePtySpawnPromise) {
     const spawnHelperInfo = ensureNodePtySpawnHelperExecutable();
@@ -3085,6 +3136,28 @@ export function startDaemon(config = {}, deps = {}) {
     if (typeof client?.setExtraHeaders === "function") {
       client.setExtraHeaders(extraHeaders);
     }
+
+    // Advertise best-effort runtime health so the backend can reject a task
+    // whose backend is configured but cannot start (CLI missing/not signed in)
+    // before creating any timeline activity. Fully additive and guarded: any
+    // failure just omits the header and the preflight fails open.
+    try {
+      const runtimeHealth = await computeAdvertisedRuntimeHealth(
+        aiManagerHandlers?.manager,
+        SUPPORTED_BACKENDS,
+        SUPPORTED_BACKEND_RUNTIME_MAP,
+      );
+      const serializedRuntimeHealth = serializeRuntimeHealth(runtimeHealth);
+      if (serializedRuntimeHealth) {
+        extraHeaders["x-conductor-runtime-health"] = serializedRuntimeHealth;
+        if (typeof client?.setExtraHeaders === "function") {
+          client.setExtraHeaders(extraHeaders);
+        }
+      }
+    } catch (error) {
+      logError(`Failed to probe runtime health: ${error?.message || error}`);
+    }
+
     if (daemonShuttingDown) {
       return;
     }

package/src/runtime-backends.js

@@ -366,6 +366,46 @@ function readConfigEnvValue(configFilePath, key) {
   }
 }
 
+// Read the top-level `disable_built_in_cli_list` config key: the mirror of
+// `allow_cli_list` for the command-optional built-in backends (copilot, dsh)
+// that are advertised WITHOUT any allow_cli_list entry. Listing a name here
+// suppresses that automatic advertising so an operator can opt out of a
+// built-in they don't want. Scoped to command-optional built-ins on purpose:
+// a stray external or PATH-CLI name (e.g. "codex") is a documented no-op,
+// since those never auto-advertise in the first place.
+function readDisabledBuiltInBackends(configFilePath) {
+  const targetPath = resolveConductorConfigPath(configFilePath);
+  try {
+    if (!targetPath || !fs.existsSync(targetPath)) {
+      return new Set();
+    }
+    const parsed = yaml.load(fs.readFileSync(targetPath, "utf8"));
+    const raw = parsed?.disable_built_in_cli_list;
+    if (!Array.isArray(raw)) {
+      return new Set();
+    }
+    return new Set(
+      raw
+        .map((value) => normalizeRuntimeBackendName(value))
+        .filter((value) => value && isCommandOptionalBuiltInRuntimeBackend(value)),
+    );
+  } catch {
+    return new Set();
+  }
+}
+
+// Reuse a caller-provided disabled set when present (so a hot loop reads the
+// config file once), else read it now. Keeps every call site one line.
+function resolveDisabledBuiltIns(options = {}) {
+  return options.disabledBuiltIns instanceof Set
+    ? options.disabledBuiltIns
+    : readDisabledBuiltInBackends(options.configFilePath);
+}
+
+export function isDisabledBuiltInRuntimeBackend(backend, options = {}) {
+  return resolveDisabledBuiltIns(options).has(normalizeRuntimeBackendName(backend));
+}
+
 function resolveProviderModulePaths(options = {}) {
   return [
     ...listProviderModulePaths(process.env.AISDK_PROVIDER_PATH),
@@ -577,6 +617,21 @@ export async function filterRuntimeSupportedAllowCliList(allowCliList, options =
 }
 
 export async function resolveConfiguredRuntimeBackend(backend, allowCliList, options = {}) {
+  const resolved = await resolveConfiguredRuntimeBackendInner(backend, allowCliList, options);
+  if (!resolved?.runtimeBackend) {
+    return resolved;
+  }
+  // A disabled command-optional built-in (copilot/dsh via
+  // `disable_built_in_cli_list`) is never resolvable, whether it reached here
+  // through an explicit allow_cli_list entry or the command-optional fallback.
+  const disabled = resolveDisabledBuiltIns(options);
+  if (disabled.has(resolved.runtimeBackend) || disabled.has(resolved.requestedBackend)) {
+    return null;
+  }
+  return resolved;
+}
+
+async function resolveConfiguredRuntimeBackendInner(backend, allowCliList, options = {}) {
   const normalizedBackend = normalizeRuntimeBackendName(backend);
   if (!normalizedBackend || LEGACY_RUNTIME_BACKEND_ALIASES.has(normalizedBackend)) {
     return null;
@@ -634,6 +689,9 @@ export async function listAdvertisedBackends(allowCliList, options = {}) {
         )
       : {};
   const configuredBackends = Object.keys(filteredAllowCliList);
+  // Read the disable list once and thread it through every per-backend
+  // resolve below, so this whole pass touches the config file a single time.
+  const resolveOptions = { ...options, disabledBuiltIns: readDisabledBuiltInBackends(options.configFilePath) };
   let runtimeBackends = [...BUILT_IN_RUNTIME_BACKENDS];
   let discoveryError = null;
   try {
@@ -647,7 +705,7 @@ export async function listAdvertisedBackends(allowCliList, options = {}) {
 
   for (const backend of configuredBackends) {
     try {
-      const configuredBackend = await resolveConfiguredRuntimeBackend(backend, filteredAllowCliList, options);
+      const configuredBackend = await resolveConfiguredRuntimeBackend(backend, filteredAllowCliList, resolveOptions);
       if (!configuredBackend?.runtimeBackend) {
         continue;
       }
@@ -683,7 +741,10 @@ export async function listAdvertisedBackends(allowCliList, options = {}) {
   }
 
   const commandOptionalBuiltIns = BUILT_IN_RUNTIME_BACKENDS.filter(
-    (backend) => isCommandOptionalBuiltInRuntimeBackend(backend) && !runtimeBackendMap[backend],
+    (backend) =>
+      isCommandOptionalBuiltInRuntimeBackend(backend) &&
+      !runtimeBackendMap[backend] &&
+      !resolveOptions.disabledBuiltIns.has(backend),
   );
   for (const backend of commandOptionalBuiltIns) {
     runtimeBackendMap[backend] = backend;

package/src/version-check.js

@@ -13,6 +13,7 @@ export const DEFAULT_HOMEBREW_FORMULA = "lovemoon-ai/tap/conductor";
 const DEFAULT_UPDATE_WINDOW = { startMinutes: 120, endMinutes: 240 };
 const REQUEST_TIMEOUT_MS = 10_000;
 const INSTALL_METHOD_FILENAME = ".install-method";
+const GLOBAL_PACKAGE_MARKER = `${path.sep}lib${path.sep}node_modules${path.sep}`;
 
 function resolveTimeoutMs(value) {
   const parsed = Number.parseInt(String(value ?? ""), 10);
@@ -139,6 +140,28 @@ export function resolveInstallMethod(options = {}) {
   }
 }
 
+/**
+ * Derive the npm global prefix that the currently running package was installed into.
+ *
+ * A global install always lands at `<prefix>/lib/node_modules/<package>`, so the prefix is
+ * whatever precedes that marker. Returns `null` for layouts that are not a global install
+ * (git checkout, project-local `node_modules`), where the caller should leave npm's own
+ * prefix resolution alone.
+ */
+export function resolveGlobalInstallPrefix(packageRoot) {
+  if (typeof packageRoot !== "string" || !packageRoot.trim()) {
+    return null;
+  }
+
+  const normalized = path.resolve(packageRoot);
+  const markerIndex = normalized.lastIndexOf(GLOBAL_PACKAGE_MARKER);
+  if (markerIndex <= 0) {
+    return null;
+  }
+
+  return normalized.slice(0, markerIndex);
+}
+
 export function buildUpgradeCommand(options = {}) {
   const installMethod = resolveInstallMethod(options);
   if (installMethod === "homebrew") {