@nema-project/nema 0.0.0-stage → 0.1.4

package/dist/codex/adapter.js

@@ -0,0 +1,151 @@
+// codex/adapter.js
+import { spawn } from "node:child_process";
+import { lstatSync, renameSync, symlinkSync, chmodSync, readFileSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { buildEnv, checkCodexAuth, cleanupRun, prepareIsolation, preflight } from "./isolation.js";
+import { parseCodexLine } from "./events.js";
+function restoreAuthSymlink(paths, userCodexHome) {
+  const link = path.join(paths.codexHome, "auth.json");
+  try {
+    if (lstatSync(link).isSymbolicLink())
+      return;
+  } catch {
+    return;
+  }
+  const target = path.join(userCodexHome, "auth.json");
+  renameSync(link, target);
+  chmodSync(target, 384);
+  symlinkSync(target, link);
+}
+var CONFIDENTIAL_REFUSAL = "codex-cli \u9002\u914D\u5668\u5728\u4FDD\u5BC6 workspace \u4E2D\u88AB\u7981\u7528\uFF08\u9694\u79BB\u672A\u901A\u8FC7\u9A8C\u8BC1\uFF09\u3002\u8BF7\u6539\u7528 codex-direct\uFF1Anema config set adapter codex-direct\uFF0C\u6216\u5728 workspace \u8BBE\u7F6E\u4E2D\u5173\u95ED\u4FDD\u5BC6\u3002";
+var CodexAdapter = class {
+  opts;
+  name = "codex-cli";
+  constructor(opts) {
+    this.opts = opts;
+  }
+  async run(task, onEvent) {
+    if (task.confidential)
+      return { ok: false, error: CONFIDENTIAL_REFUSAL };
+    const auth = checkCodexAuth(this.opts.userCodexHome);
+    if (!auth.ok)
+      return { ok: false, error: auth.error };
+    const paths = await prepareIsolation({
+      nemaHome: this.opts.nemaHome,
+      workspaceId: task.workspaceId,
+      userCodexHome: this.opts.userCodexHome,
+      mcp: {
+        command: process.execPath,
+        args: [this.opts.cliEntry, "mcp"],
+        env: { NEMA_HUB_URL: task.hubUrl, NEMA_RUN_TOKEN: task.runToken }
+      }
+    });
+    try {
+      const pf = preflight(paths);
+      if (!pf.ok)
+        return { ok: false, error: "\u9694\u79BB\u81EA\u68C0\u5931\u8D25\uFF1A" + pf.problems.join("\uFF1B") };
+      return await this.exec(task, paths, onEvent);
+    } finally {
+      try {
+        restoreAuthSymlink(paths, this.opts.userCodexHome);
+      } catch {
+      }
+      await cleanupRun(paths);
+    }
+  }
+  exec(task, paths, onEvent) {
+    const bin = this.opts.codexBin ?? process.env.NEMA_CODEX_BIN ?? "codex";
+    const lastFile = path.join(paths.workDir, "last.txt");
+    const timeoutMs = this.opts.timeoutMs ?? 6e5;
+    return new Promise((resolve) => {
+      let settled = false;
+      let lastMessage = "";
+      let stderr = "";
+      let buf = "";
+      let exited = false;
+      let exitWait;
+      const killTree = () => {
+        try {
+          if (child.pid !== void 0)
+            process.kill(-child.pid, "SIGKILL");
+        } catch {
+        }
+      };
+      const finish = (r, kill = false) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        if (!kill)
+          return resolve(r);
+        killTree();
+        if (exited)
+          return resolve(r);
+        exitWait = setTimeout(() => resolve(r), 2e3);
+        child.once("close", () => {
+          clearTimeout(exitWait);
+          resolve(r);
+        });
+      };
+      const child = spawn(bin, ["exec", "--json", "--ephemeral", "--skip-git-repo-check", "-C", paths.workDir, "-o", lastFile, "-"], { env: buildEnv(paths, process.env), cwd: paths.workDir, stdio: ["pipe", "pipe", "pipe"], detached: true });
+      const timer = setTimeout(() => finish({ ok: false, error: "Codex \u8FD0\u884C\u8D85\u65F6" }, true), timeoutMs);
+      child.on("error", (e) => {
+        finish({ ok: false, error: e.code === "ENOENT" ? "\u627E\u4E0D\u5230 codex \u547D\u4EE4\uFF0C\u8BF7\u5148\u5B89\u88C5 Codex CLI" : `\u65E0\u6CD5\u542F\u52A8 Codex\uFF1A${e.message}` });
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(task.prompt);
+      const handleLine = (line) => {
+        const ev = parseCodexLine(line);
+        if (!ev || settled)
+          return;
+        if (ev.kind === "agent_message") {
+          lastMessage = ev.text;
+          onEvent({ type: "agent_message", text: ev.text });
+        } else if (ev.kind === "mcp_call" && ev.server !== "room") {
+          finish({ ok: false, error: `Agent \u8C03\u7528\u4E86 Room \u4EE5\u5916\u7684 MCP server\uFF1A${ev.server}` }, true);
+        }
+      };
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      child.stdout.on("data", (d) => {
+        buf += d;
+        let i;
+        while ((i = buf.indexOf("\n")) >= 0) {
+          handleLine(buf.slice(0, i));
+          buf = buf.slice(i + 1);
+        }
+      });
+      child.stderr.on("data", (d) => {
+        stderr += d;
+        if (stderr.length > 64e3)
+          stderr = stderr.slice(-64e3);
+      });
+      child.on("close", (code) => {
+        exited = true;
+        killTree();
+        if (buf.trim())
+          handleLine(buf);
+        if (settled)
+          return;
+        if (code !== 0) {
+          const tail = stderr.trimEnd().split("\n").slice(-20).join("\n");
+          return finish({ ok: false, error: `Codex \u9000\u51FA\u7801 ${code}\uFF1A${tail}` });
+        }
+        let reply = "";
+        try {
+          reply = readFileSync(lastFile, "utf8").trim();
+        } catch {
+        }
+        if (!reply)
+          reply = lastMessage.trim();
+        finish(reply ? { ok: true, reply } : { ok: false, error: "Agent \u6CA1\u6709\u8FD4\u56DE\u56DE\u590D" });
+      });
+    });
+  }
+};
+export {
+  CONFIDENTIAL_REFUSAL,
+  CodexAdapter
+};

package/dist/codex/events.d.ts

@@ -0,0 +1,16 @@
+export type CodexEvent = {
+    kind: "agent_message";
+    text: string;
+} | {
+    kind: "mcp_call";
+    server: string;
+    tool: string;
+} | {
+    kind: "turn_completed";
+} | {
+    kind: "error";
+    message: string;
+} | {
+    kind: "other";
+};
+export declare function parseCodexLine(line: string): CodexEvent | null;

package/dist/codex/events.js

@@ -0,0 +1,47 @@
+// codex/events.js
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseCodexLine(line) {
+  let raw;
+  try {
+    raw = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!isObj(raw) || typeof raw.type !== "string")
+    return null;
+  switch (raw.type) {
+    case "turn.completed":
+      return { kind: "turn_completed" };
+    case "turn.failed": {
+      const e = raw.error;
+      return { kind: "error", message: isObj(e) && typeof e.message === "string" ? e.message : "turn failed" };
+    }
+    case "error":
+      return { kind: "error", message: typeof raw.message === "string" ? raw.message : "error" };
+    case "item.started":
+    case "item.completed":
+    case "item.updated": {
+      const item = raw.item;
+      if (!isObj(item))
+        return { kind: "other" };
+      if (item.type === "agent_message" && raw.type === "item.completed" && typeof item.text === "string") {
+        return { kind: "agent_message", text: item.text };
+      }
+      if (item.type === "mcp_tool_call") {
+        return {
+          kind: "mcp_call",
+          server: typeof item.server === "string" ? item.server : "",
+          tool: typeof item.tool === "string" ? item.tool : ""
+        };
+      }
+      if (item.type === "error" && typeof item.message === "string")
+        return { kind: "error", message: item.message };
+      return { kind: "other" };
+    }
+    default:
+      return { kind: "other" };
+  }
+}
+export {
+  parseCodexLine
+};

package/dist/codex/isolation.d.ts

@@ -0,0 +1,33 @@
+export type IsolationPaths = {
+    wsHome: string;
+    codexHome: string;
+    workDir: string;
+    tmpDir: string;
+};
+export type McpSpec = {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+};
+export declare function checkCodexAuth(userCodexHome: string): {
+    ok: true;
+    authPath: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function renderCodexConfig(mcp: McpSpec): string;
+export declare function prepareIsolation(opts: {
+    nemaHome: string;
+    workspaceId: string;
+    userCodexHome: string;
+    mcp: McpSpec;
+}): Promise<IsolationPaths>;
+export declare function buildEnv(paths: IsolationPaths, parentEnv: NodeJS.ProcessEnv): Record<string, string>;
+export declare function preflight(paths: IsolationPaths): {
+    ok: true;
+} | {
+    ok: false;
+    problems: string[];
+};
+export declare function cleanupRun(paths: IsolationPaths): Promise<void>;

package/dist/codex/isolation.js

@@ -0,0 +1,115 @@
+// codex/isolation.js
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+function checkCodexAuth(userCodexHome) {
+  const authPath = path.join(userCodexHome, "auth.json");
+  try {
+    const cfg = parseToml(readFileSync(path.join(userCodexHome, "config.toml"), "utf8"));
+    if (cfg.cli_auth_credentials_store === "keyring") {
+      return {
+        ok: false,
+        error: 'Codex \u51ED\u8BC1\u5B58\u653E\u5728\u7CFB\u7EDF\u94A5\u5319\u4E32\u4E2D\uFF0CNema \u65E0\u6CD5\u8BFB\u53D6\u3002\u8BF7\u5728 ~/.codex/config.toml \u8BBE\u7F6E cli_auth_credentials_store = "file"\uFF0C\u7136\u540E\u91CD\u65B0\u8FD0\u884C codex login\u3002'
+      };
+    }
+  } catch {
+  }
+  if (!existsSync(authPath)) {
+    return {
+      ok: false,
+      error: `\u627E\u4E0D\u5230 Codex \u767B\u5F55\u6587\u4EF6 ${authPath}\u3002\u8BF7\u5148\u8FD0\u884C codex login\uFF1B\u5982\u679C\u51ED\u8BC1\u5B58\u5728\u7CFB\u7EDF\u94A5\u5319\u4E32\u91CC\uFF0C\u8BF7\u5728 ~/.codex/config.toml \u8BBE\u7F6E cli_auth_credentials_store = "file" \u540E\u91CD\u65B0\u767B\u5F55\u3002`
+    };
+  }
+  return { ok: true, authPath };
+}
+function renderCodexConfig(mcp) {
+  return stringifyToml({
+    approval_policy: "never",
+    sandbox_mode: "read-only",
+    web_search: "disabled",
+    check_for_update_on_startup: false,
+    history: { persistence: "none" },
+    features: { memories: false },
+    analytics: { enabled: false },
+    shell_environment_policy: { inherit: "core" },
+    mcp_servers: { room: { command: mcp.command, args: mcp.args, env: mcp.env, default_tools_approval_mode: "approve" } }
+  }) + "\n";
+}
+async function prepareIsolation(opts) {
+  if (!/^[A-Za-z0-9_-]+$/.test(opts.workspaceId))
+    throw new Error(`invalid workspace id: ${opts.workspaceId}`);
+  const wsHome = path.join(opts.nemaHome, "ws", opts.workspaceId);
+  const codexHome = path.join(wsHome, "codex-home");
+  await fs.mkdir(codexHome, { recursive: true, mode: 448 });
+  await fs.chmod(wsHome, 448);
+  await fs.chmod(codexHome, 448);
+  const link = path.join(codexHome, "auth.json");
+  await fs.rm(link, { force: true });
+  await fs.symlink(path.join(opts.userCodexHome, "auth.json"), link);
+  const cfgPath = path.join(codexHome, "config.toml");
+  await fs.writeFile(cfgPath, renderCodexConfig(opts.mcp), { mode: 384 });
+  await fs.chmod(cfgPath, 384);
+  const workDir = await fs.mkdtemp(path.join(os.tmpdir(), "nema-run-"));
+  const tmpDir = path.join(workDir, ".tmp");
+  await fs.mkdir(tmpDir, { recursive: true, mode: 448 });
+  return { wsHome, codexHome, workDir, tmpDir };
+}
+function buildEnv(paths, parentEnv) {
+  const env = {};
+  for (const k of ["PATH", "LANG", "LC_ALL", "TERM"]) {
+    const v = parentEnv[k];
+    if (v !== void 0)
+      env[k] = v;
+  }
+  env.HOME = paths.wsHome;
+  env.CODEX_HOME = paths.codexHome;
+  env.TMPDIR = paths.tmpDir;
+  return env;
+}
+function preflight(paths) {
+  const problems = [];
+  for (const f of ["AGENTS.md", "AGENTS.override.md", "instructions.md"]) {
+    if (existsSync(path.join(paths.codexHome, f)))
+      problems.push(`codexHome \u4E2D\u5B58\u5728\u4E0D\u5E94\u6709\u7684 ${f}`);
+  }
+  try {
+    const cfg = parseToml(readFileSync(path.join(paths.codexHome, "config.toml"), "utf8"));
+    const names = Object.keys(cfg.mcp_servers ?? {});
+    if (names.length !== 1 || names[0] !== "room") {
+      problems.push(`config.toml \u7684 mcp_servers \u5FC5\u987B\u6070\u597D\u53EA\u6709 room\uFF0C\u5B9E\u9645\u4E3A [${names.join(", ")}]`);
+    }
+  } catch (e) {
+    problems.push(`\u65E0\u6CD5\u8BFB\u53D6\u6216\u89E3\u6790 config.toml\uFF1A${e instanceof Error ? e.message : String(e)}`);
+  }
+  try {
+    if (!lstatSync(path.join(paths.codexHome, "auth.json")).isSymbolicLink())
+      problems.push("auth.json \u4E0D\u662F\u7B26\u53F7\u94FE\u63A5");
+  } catch {
+    problems.push("auth.json \u4E0D\u5B58\u5728");
+  }
+  let dir = path.resolve(paths.workDir);
+  for (; ; ) {
+    for (const f of [".git", "AGENTS.md", "AGENTS.override.md"]) {
+      if (existsSync(path.join(dir, f)))
+        problems.push(`${dir} \u4E2D\u5B58\u5728 ${f}`);
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return problems.length ? { ok: false, problems } : { ok: true };
+}
+async function cleanupRun(paths) {
+  await fs.rm(paths.workDir, { recursive: true, force: true });
+}
+export {
+  buildEnv,
+  checkCodexAuth,
+  cleanupRun,
+  preflight,
+  prepareIsolation,
+  renderCodexConfig
+};

package/dist/config.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+export declare const DEFAULT_BYOK_BASE_URL = "https://api.openai.com/v1";
+export declare function normalizeByokBaseUrl(raw: string): string;
+declare const ConfigSchema: z.ZodObject<{
+    adapter: z.ZodEnum<{
+        "codex-direct": "codex-direct";
+        "claude-code": "claude-code";
+    }>;
+    model: z.ZodOptional<z.ZodString>;
+    reasoningEffort: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>;
+    authMode: z.ZodEnum<{
+        siwc: "siwc";
+        compat: "compat";
+        byok: "byok";
+    }>;
+    byokBaseUrl: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strict>;
+export type NemaConfig = z.infer<typeof ConfigSchema>;
+/** The one default config: used by loadConfig and by the Runner when no config getter is given. */
+export declare const DEFAULT_CONFIG: Readonly<NemaConfig>;
+/** A user-facing Chinese message for an unreadable config.json (bad JSON or schema), without zod/stack noise. */
+export declare function configErrorMessage(e: unknown): string;
+export declare function loadConfig(nemaHome: string): NemaConfig;
+export declare function saveConfig(nemaHome: string, patch: Partial<NemaConfig>): NemaConfig;
+export {};

package/dist/config.js

@@ -0,0 +1,75 @@
+// config.js
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { protectPrivatePath } from "./secrets/permissions.js";
+var DEFAULT_BYOK_BASE_URL = "https://api.openai.com/v1";
+var BYOK_BASE_URL_ERROR = "byokBaseUrl \u53EA\u5141\u8BB8 https\uFF0C\u6216 http://127.0.0.1 \u4E0E http://localhost\uFF08\u53EF\u5E26\u7AEF\u53E3\uFF09";
+function normalizeByokBaseUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(BYOK_BASE_URL_ERROR);
+  }
+  const localHttp = url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "localhost");
+  if (url.protocol !== "https:" && !localHttp || url.username !== "" || url.password !== "" || raw.includes("?") || raw.includes("#") || raw !== raw.trim()) {
+    throw new Error(BYOK_BASE_URL_ERROR);
+  }
+  return raw.endsWith("/") ? raw.slice(0, -1) : raw;
+}
+var ConfigSchema = z.object({
+  adapter: z.enum(["codex-direct", "claude-code"]),
+  model: z.string().min(1).optional(),
+  reasoningEffort: z.enum(["low", "medium", "high"]),
+  authMode: z.enum(["siwc", "compat", "byok"]),
+  byokBaseUrl: z.string().transform(normalizeByokBaseUrl).optional()
+}).strict();
+var DEFAULT_CONFIG = Object.freeze({ adapter: "codex-direct", reasoningEffort: "medium", authMode: "siwc" });
+function configErrorMessage(e) {
+  let detail;
+  if (e instanceof z.ZodError)
+    detail = e.issues.map((i) => `${i.path.join(".") || "(\u6839)"}\uFF1A${i.message}`).join("\uFF1B");
+  else if (e instanceof SyntaxError)
+    detail = `\u4E0D\u662F\u5408\u6CD5\u7684 JSON\uFF08${e.message}\uFF09`;
+  else
+    detail = e instanceof Error ? e.message : String(e);
+  return `\u914D\u7F6E\u6587\u4EF6 ~/.nema/config.json \u65E0\u6CD5\u8BFB\u53D6\uFF1A${detail}`;
+}
+var configFile = (nemaHome) => path.join(nemaHome, "config.json");
+function migrateRetiredCli(stored) {
+  if (stored.adapter !== "codex" && stored.adapter !== "codex-cli")
+    return stored;
+  return { ...stored, adapter: "codex-direct", authMode: "compat" };
+}
+function loadConfig(nemaHome) {
+  let raw;
+  try {
+    raw = readFileSync(configFile(nemaHome), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return { ...DEFAULT_CONFIG };
+    throw e;
+  }
+  const stored = z.object({}).passthrough().parse(JSON.parse(raw));
+  return ConfigSchema.parse({ ...DEFAULT_CONFIG, ...migrateRetiredCli(stored) });
+}
+function saveConfig(nemaHome, patch) {
+  const next = ConfigSchema.parse({ ...loadConfig(nemaHome), ...patch });
+  mkdirSync(nemaHome, { recursive: true });
+  protectPrivatePath(nemaHome, 448);
+  const file = configFile(nemaHome);
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+  protectPrivatePath(tmp);
+  renameSync(tmp, file);
+  return next;
+}
+export {
+  DEFAULT_BYOK_BASE_URL,
+  DEFAULT_CONFIG,
+  configErrorMessage,
+  loadConfig,
+  normalizeByokBaseUrl,
+  saveConfig
+};

package/dist/configCommands.d.ts

@@ -0,0 +1,13 @@
+import type { Out } from "./direct/authCommands.js";
+export declare const CONFIG_KEYS: readonly ["adapter", "model", "reasoningEffort", "authMode", "byokBaseUrl"];
+export declare function configGet(o: {
+    nemaHome: string;
+    out: Out;
+    key?: string;
+}): number;
+export declare function configSet(o: {
+    nemaHome: string;
+    out: Out;
+    key: string;
+    value: string;
+}): number;

package/dist/configCommands.js

@@ -0,0 +1,69 @@
+// configCommands.js
+import { configErrorMessage, loadConfig, saveConfig } from "./config.js";
+var CONFIG_KEYS = ["adapter", "model", "reasoningEffort", "authMode", "byokBaseUrl"];
+var ENUMS = {
+  adapter: ["codex-direct", "claude-code"],
+  reasoningEffort: ["low", "medium", "high"],
+  authMode: ["siwc", "compat", "byok"]
+};
+var isKey = (k) => CONFIG_KEYS.includes(k);
+var unknownKey = (k) => `\u672A\u77E5\u914D\u7F6E\u9879 ${JSON.stringify(k)}\uFF1B\u53EF\u7528\uFF1A${CONFIG_KEYS.join("\u3001")}`;
+var msg = (e) => e instanceof Error ? e.message : String(e);
+function configGet(o) {
+  if (o.key !== void 0 && !isKey(o.key)) {
+    o.out.error(unknownKey(o.key));
+    return 1;
+  }
+  let config;
+  try {
+    config = loadConfig(o.nemaHome);
+  } catch (e) {
+    o.out.error(configErrorMessage(e));
+    return 1;
+  }
+  if (o.key !== void 0) {
+    o.out.log(String(config[o.key] ?? ""));
+    return 0;
+  }
+  for (const k of CONFIG_KEYS)
+    o.out.log(`${k}=${config[k] ?? ""}`);
+  return 0;
+}
+function configSet(o) {
+  if (!isKey(o.key)) {
+    o.out.error(unknownKey(o.key));
+    return 1;
+  }
+  if (o.key === "adapter" && (o.value === "codex-cli" || o.value === "codex")) {
+    o.out.error("codex-cli \u9002\u914D\u5668\u5DF2\u53D6\u6D88\uFF0C\u672C\u9879\u76EE\u4E0D\u518D\u542F\u52A8 Codex CLI\u3002\u8BF7\u4FDD\u6301 adapter=codex-direct\uFF0C\u5E76\u7528 nema config set authMode compat \u8BFB\u53D6\u5DF2\u6709\u7684 Codex \u767B\u5F55\u3002");
+    return 1;
+  }
+  const allowed = ENUMS[o.key];
+  if (allowed && !allowed.includes(o.value)) {
+    o.out.error(`${o.key} \u7684\u503C\u5FC5\u987B\u662F ${allowed.join(" | ")}\uFF08\u6536\u5230 ${JSON.stringify(o.value)}\uFF09`);
+    return 1;
+  }
+  if (o.key === "model" && o.value.trim() === "") {
+    o.out.error("model \u4E0D\u80FD\u4E3A\u7A7A");
+    return 1;
+  }
+  try {
+    loadConfig(o.nemaHome);
+  } catch (e) {
+    o.out.error(configErrorMessage(e));
+    return 1;
+  }
+  try {
+    saveConfig(o.nemaHome, { [o.key]: o.value });
+  } catch (e) {
+    o.out.error(`\u65E0\u6CD5\u4FDD\u5B58\u914D\u7F6E\uFF1A${msg(e)}`);
+    return 1;
+  }
+  o.out.log(`\u5DF2\u8BBE\u7F6E ${o.key}=${o.value}`);
+  return 0;
+}
+export {
+  CONFIG_KEYS,
+  configGet,
+  configSet
+};

package/dist/daemon/cleanup.d.ts

@@ -0,0 +1,5 @@
+export declare const WORKSPACE_ID_RE: RegExp;
+/** Removes `<nemaHome>/ws/<id>`. Returns whether something was removed; invalid ids are ignored. */
+export declare function removeWorkspaceDir(nemaHome: string, workspaceId: string): Promise<boolean>;
+/** Removes the isolation dirs of every workspace not in `existingIds`. Returns the removed ids. */
+export declare function reconcileWorkspaceDirs(nemaHome: string, existingIds: Iterable<string>): Promise<string[]>;

package/dist/daemon/cleanup.js

@@ -0,0 +1,49 @@
+// daemon/cleanup.js
+import fs from "node:fs/promises";
+import path from "node:path";
+var WORKSPACE_ID_RE = /^ws_[A-Za-z0-9_-]{1,32}$/;
+async function wsRoot(nemaHome) {
+  const root = path.join(nemaHome, "ws");
+  try {
+    const st = await fs.lstat(root);
+    return st.isDirectory() && !st.isSymbolicLink() ? root : null;
+  } catch {
+    return null;
+  }
+}
+async function removeWorkspaceDir(nemaHome, workspaceId) {
+  if (!WORKSPACE_ID_RE.test(workspaceId))
+    return false;
+  const root = await wsRoot(nemaHome);
+  if (!root)
+    return false;
+  const target = path.join(root, workspaceId);
+  if (path.dirname(target) !== root)
+    return false;
+  try {
+    await fs.lstat(target);
+  } catch {
+    return false;
+  }
+  await fs.rm(target, { recursive: true, force: true });
+  return true;
+}
+async function reconcileWorkspaceDirs(nemaHome, existingIds) {
+  const root = await wsRoot(nemaHome);
+  if (!root)
+    return [];
+  const keep = new Set(existingIds);
+  const removed = [];
+  for (const name of await fs.readdir(root)) {
+    if (keep.has(name) || !WORKSPACE_ID_RE.test(name))
+      continue;
+    if (await removeWorkspaceDir(nemaHome, name))
+      removed.push(name);
+  }
+  return removed;
+}
+export {
+  WORKSPACE_ID_RE,
+  reconcileWorkspaceDirs,
+  removeWorkspaceDir
+};

package/dist/daemon/connection.d.ts

@@ -0,0 +1,22 @@
+import type { RpcRouter } from "./rpc.js";
+import type { Runner } from "./runner.js";
+export type DaemonOpts = {
+    hubUrl: string;
+    token: string;
+    runner: Runner;
+    reconnectMs?: number;
+    /** `~/.nema`: when set, isolation dirs of deleted workspaces (`<nemaHome>/ws/<id>`) are removed. */
+    nemaHome?: string;
+    /** Whose `report-token` the hello registers; defaults to `nemaHome`. The desktop app points it at the user-level `~/.nema` its hooks use. */
+    reportTokenHome?: string;
+    /** Reported in `hello` (defaults to apps/cli/package.json's version). */
+    version?: string;
+    /** When set, `rpc.request` is answered immediately and does not wait for the task runner. */
+    rpc?: RpcRouter;
+    /** Called with the live socket send, and with null when that socket closes. */
+    bindSend?: (send: ((message: unknown) => boolean) | null) => void;
+};
+export declare const VERSION_SKEW_ERROR = "hub \u4E0E nema CLI \u7248\u672C\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u540C\u65F6\u66F4\u65B0\uFF08\u91CD\u65B0\u6784\u5EFA compose \u5E76\u91CD\u542F nema daemon\uFF09";
+export declare function connectDaemon(opts: DaemonOpts): {
+    close(): Promise<void>;
+};