@nocoo/eagle-agent 0.3.0

package/README.md

@@ -0,0 +1,52 @@
+# @nocoo/eagle-agent
+
+Read-only Herdr inventory, task evidence, machine resources and named TCP port checks for Eagle. Requires Node.js 24+ and the Herdr CLI on macOS or Linux.
+
+## Download and install
+
+Check `node --version`, `npm --version` and `herdr --version` first. Install Node.js 24+ from https://nodejs.org/en/download if needed, and have Herdr installed and running. No Eagle repository checkout, TypeScript compiler or npm login is required to install this public package.
+
+Download and install the pinned release from the official npm registry:
+
+```sh
+npm install -g @nocoo/eagle-agent@0.3.0 --registry=https://registry.npmjs.org
+```
+
+**If npm is unreachable or times out, use the Tencent Cloud mirror first / npm 连不上时首选腾讯云镜像：**
+
+```sh
+npm install -g @nocoo/eagle-agent@0.3.0 --registry=https://mirrors.cloud.tencent.com/npm/
+```
+
+`--registry` applies only to this installation; it does not change your global npm configuration. Mirrors may take time to synchronize a new release: for `404` / `ETARGET`, retry later or use the official registry once reachable. Keep the pinned version, HTTPS and certificate verification. Eagle credentials are unrelated to npm and must never be sent to a registry.
+
+Verify the installation before configuring the agent:
+
+```sh
+eagle-agent --version # expected: 0.3.0
+eagle-agent --help
+```
+
+If the command is missing, ensure npm's global `bin` directory is on your PATH. Use a user-owned Node/npm installation if global installation fails with `EACCES`.
+
+## Connect a machine
+
+Open Eagle's **Connect** page, create a machine and copy its onboarding prompt. Give the prompt to the management agent on that machine. It contains a machine-scoped credential shown only once.
+
+Store configuration at `~/.config/eagle/agent.json` (directory 0700, file 0600). `EAGLE_CONFIG` selects another file. `eagle-agent init` reads JSON from stdin and creates this file securely; it refuses to overwrite an existing file. Never pass a token in command arguments, commit it, print it, or include it in reports. Rotation requires updating the token in the existing secure configuration.
+
+```sh
+eagle-agent once
+eagle-agent watch
+eagle-agent collect /private/path/report.json
+eagle-agent upload /private/path/report.json
+eagle-agent heartbeat
+```
+
+`once` collects all running Herdr sessions and sends a complete snapshot. `watch` repeats every 30 seconds by default. Set up a user launchd or systemd service to keep it running across restarts, with the correct absolute executable paths and PATH for Node and Herdr. Do not run overlapping collectors for one configuration.
+
+The machine's Durable Object maintains current state. Unacknowledged reports remain in a private local spool; retries preserve their IDs. Older reports cannot roll back current state. Hourly summaries and new D1 archive writes are paused.
+
+Optional `watchPorts`: `[{ "name": "Raven", "port": 7024 }]`. Only loopback TCP checks are supported; a listening port does not prove service or task health. CPU, RAM, disk and uptime are sampled automatically. Task status combines terminal summaries, goals, Git, tests, processes and deployment evidence; pane lifecycle badges are weak hints.
+
+Detailed configuration and manager evidence format: https://github.com/nocoo/eagle/blob/main/docs/AGENT.md

package/dist/agent/cli.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { mkdir, open, readdir, readFile, rename, stat, writeFile, } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { ReportSchema, WatchPortsSchema } from "../src/shared/schema.js";
+import { checkUrl, collect, sendReport, } from "./collector.js";
+import { drainSpool } from "./spool.js";
+import { AGENT_VERSION } from "./version.js";
+const ConfigSchema = z.strictObject({
+    url: z.string().url(),
+    token: z.string().min(32),
+    machineId: z.string().regex(/^[a-z0-9][a-z0-9_-]*$/),
+    machineName: z.string().min(1),
+    evidenceFile: z.string().optional(),
+    intervalSeconds: z.number().int().min(15).max(3600).default(30),
+    codexDir: z.string().optional(),
+    spoolDir: z.string().optional(),
+    watchPorts: WatchPortsSchema.default([]),
+});
+const path = process.env.EAGLE_CONFIG || join(homedir(), ".config/eagle/agent.json");
+async function heartbeat(config, warning) {
+    const response = await fetch(`${checkUrl(config.url)}/api/v1/heartbeat`, {
+        method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(15000),
+        headers: {
+            Authorization: `Bearer ${config.token}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            schemaVersion: 1,
+            machineId: config.machineId,
+            sentAt: new Date().toISOString(),
+            ...(warning ? { warning } : {}),
+        }),
+    });
+    if (!response.ok)
+        throw new Error(`Heartbeat rejected (${response.status})`);
+}
+async function cycle(config) {
+    const spool = config.spoolDir || join(dirname(path), "spool");
+    await mkdir(spool, { recursive: true, mode: 0o700 });
+    const files = (await readdir(spool))
+        .filter((f) => f.endsWith(".json"))
+        .sort();
+    if (files.length >= 1000)
+        await drainSpool(spool, config.machineId, (pending) => sendReport(config.url, config.token, pending));
+    let report;
+    try {
+        report = await collect(config);
+    }
+    catch {
+        await heartbeat(config, "采集失败：保留上一次完整快照，请检查本机 Agent 日志").catch(() => { });
+        throw new Error("Collection failed; previous complete inventory preserved");
+    }
+    const name = `${report.capturedAt.replaceAll(":", "-")}-${report.reportId}.json`;
+    await writeFile(join(spool, `${name}.tmp`), JSON.stringify(report), {
+        mode: 0o600,
+    });
+    await rename(join(spool, `${name}.tmp`), join(spool, name));
+    const drained = await drainSpool(spool, config.machineId, (pending) => sendReport(config.url, config.token, pending));
+    if (drained.rejected)
+        await heartbeat(config, `${drained.rejected} 份无效上报已隔离保留，请检查本机 spool/rejected`);
+    console.log(JSON.stringify({
+        event: "reported",
+        at: report.capturedAt,
+        spaces: report.spaces.length,
+        panes: report.spaces.flatMap((s) => s.tabs.flatMap((t) => t.panes))
+            .length,
+        warnings: report.warnings.length,
+    }));
+}
+async function main() {
+    const action = process.argv[2] || "once";
+    if (action === "--help" || action === "help") {
+        console.log("Eagle Agent\nCommands: init (JSON on stdin), collect <file>, upload <file>, once, watch, heartbeat\nConfig: EAGLE_CONFIG or ~/.config/eagle/agent.json (0600). Node.js 24+ and Herdr required.");
+        return;
+    }
+    if (action === "--version") {
+        console.log(AGENT_VERSION);
+        return;
+    }
+    if (action === "init") {
+        if (process.stdin.isTTY)
+            throw new Error("Pass configuration JSON through stdin; never pass credentials as arguments");
+        let input = "";
+        for await (const chunk of process.stdin) {
+            input += chunk;
+            if (input.length > 65536)
+                throw new Error("Configuration exceeds 64 KiB");
+        }
+        let value;
+        try {
+            value = JSON.parse(input);
+        }
+        catch {
+            throw new Error("Invalid configuration JSON");
+        }
+        const config = ConfigSchema.parse(value);
+        checkUrl(config.url);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const file = await open(path, "wx", 0o600);
+        try {
+            await file.writeFile(JSON.stringify(config, null, 2));
+        }
+        finally {
+            await file.close();
+        }
+        console.log("Secure configuration created. Run eagle-agent once to verify reporting.");
+        return;
+    }
+    const permissions = await stat(path);
+    if (process.platform !== "win32" && (permissions.mode & 0o077) !== 0)
+        throw new Error("Config must have mode 0600");
+    const config = ConfigSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    checkUrl(config.url);
+    if (action === "collect") {
+        const output = process.argv[3];
+        if (!output)
+            throw new Error("Usage: collect <output.json>");
+        const report = await collect(config);
+        await writeFile(output, JSON.stringify(report, null, 2), { mode: 0o600 });
+        console.log(JSON.stringify({
+            event: "collected",
+            spaces: report.spaces.length,
+            warnings: report.warnings.length,
+        }));
+    }
+    else if (action === "upload") {
+        const report = ReportSchema.parse(JSON.parse(await readFile(process.argv[3], "utf8")));
+        if (report.machine.id !== config.machineId)
+            throw new Error("Machine identity mismatch");
+        console.log(JSON.stringify(await sendReport(config.url, config.token, report)));
+    }
+    else if (action === "heartbeat") {
+        await heartbeat(config);
+        console.log("Heartbeat accepted");
+    }
+    else if (action === "once")
+        await cycle(config);
+    else if (action === "watch") {
+        let running = true;
+        process.on("SIGTERM", () => {
+            running = false;
+        });
+        process.on("SIGINT", () => {
+            running = false;
+        });
+        while (running) {
+            const start = Date.now();
+            try {
+                await cycle(config);
+            }
+            catch (e) {
+                console.error(JSON.stringify({
+                    event: "report_failed",
+                    message: e instanceof z.ZodError
+                        ? "Invalid config or report schema"
+                        : e instanceof Error
+                            ? e.message
+                            : "Unknown error",
+                }));
+            }
+            if (running)
+                await new Promise((r) => setTimeout(r, Math.max(1000, config.intervalSeconds * 1000 - (Date.now() - start))));
+        }
+    }
+    else
+        throw new Error("Commands: collect <file>, upload <file>, once, watch, heartbeat");
+}
+void main().catch((e) => {
+    console.error(e instanceof z.ZodError
+        ? "Invalid config or report schema"
+        : e instanceof Error
+            ? e.message
+            : "Agent failed");
+    process.exitCode = 1;
+});

package/dist/agent/collector.js

@@ -0,0 +1,529 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { promisify, stripVTControlCharacters } from "node:util";
+import { z } from "zod";
+import { EvidenceSchema, ReportSchema, } from "../src/shared/schema.js";
+import { collectTelemetry } from "./machine.js";
+import { AGENT_VERSION } from "./version.js";
+const exec = promisify(execFile);
+export function redact(text, secrets = []) {
+    let clean = stripVTControlCharacters(text)
+        .replace(/-----BEGIN [\w ]*PRIVATE KEY-----[\s\S]*?-----END [\w ]*PRIVATE KEY-----/g, "[REDACTED KEY]")
+        .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]")
+        .replace(/\beag1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
+        .replace(/((?:[A-Z_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|CREDENTIAL)[A-Z_]*)\s*[=:]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;]+)/gi, "$1[REDACTED]")
+        .replace(/\b(?:sk-[\w-]{16,}|gh[pousr]_[\w]{20,}|github_pat_[\w]{20,})\b/g, "[REDACTED]");
+    for (const secret of secrets)
+        if (secret)
+            clean = clean.replaceAll(secret, "[REDACTED]");
+    return clean;
+}
+export function normalizeSnapshot(snapshot, session) {
+    if (!Array.isArray(snapshot.workspaces) ||
+        !Array.isArray(snapshot.tabs) ||
+        !Array.isArray(snapshot.panes) ||
+        !Array.isArray(snapshot.layouts))
+        throw new Error("Unsupported Herdr snapshot");
+    return snapshot.workspaces.map((w) => ({
+        id: `${session}:${w.workspace_id}`,
+        name: w.label || w.workspace_id,
+        session,
+        objective: "",
+        tabs: snapshot.tabs
+            .filter((t) => t.workspace_id === w.workspace_id)
+            .map((t) => {
+            const layout = snapshot.layouts.find((l) => l.tab_id === t.tab_id);
+            const rawPanes = snapshot.panes.filter((p) => p.tab_id === t.tab_id);
+            return {
+                id: t.tab_id,
+                name: t.label || t.tab_id,
+                panes: rawPanes.map((p, index) => {
+                    const rect = layout?.panes.find((r) => r.pane_id === p.pane_id)?.rect;
+                    const area = layout?.area;
+                    const title = (p.title ||
+                        p.terminal_title_stripped ||
+                        `${p.agent || "终端"} · ${w.label}`).slice(0, 240);
+                    return {
+                        id: p.pane_id,
+                        title,
+                        agent: p.agent || "",
+                        hint: ["working", "idle", "done", "blocked"].includes(p.agent_status ?? "")
+                            ? p.agent_status
+                            : "unknown",
+                        task: {
+                            id: createHash("sha256")
+                                .update(`${session}:${p.pane_id}:${p.agent_session?.value || "shell"}:${p.agent === "codex" ? "" : title}`)
+                                .digest("hex")
+                                .slice(0, 32),
+                            title,
+                            requiresDeployment: true,
+                        },
+                        rect: rect && area?.width && area?.height
+                            ? {
+                                x: (rect.x - area.x) / area.width,
+                                y: (rect.y - area.y) / area.height,
+                                width: rect.width / area.width,
+                                height: rect.height / area.height,
+                            }
+                            : {
+                                x: index / rawPanes.length,
+                                y: 0,
+                                width: 1 / rawPanes.length,
+                                height: 1,
+                            },
+                        evidence: [],
+                    };
+                }),
+            };
+        }),
+    }));
+}
+export function transcriptContext(text) {
+    let current;
+    for (const line of text.split("\n")) {
+        try {
+            const event = JSON.parse(line);
+            const turnId = event.payload?.turn_id;
+            if (typeof turnId === "string" &&
+                typeof event.timestamp === "string" &&
+                ["event_msg", "turn_context"].includes(event.type) &&
+                current?.turnId !== turnId) {
+                current = { turnId, startedAt: event.timestamp };
+            }
+        }
+        catch {
+            /* Bounded tail can start mid-line. */
+        }
+    }
+    return current;
+}
+export function transcriptEvidence(text, taskId) {
+    let summary;
+    let process;
+    for (const line of text.split("\n")) {
+        try {
+            const e = JSON.parse(line);
+            const p = e.payload;
+            if (!p || !e.timestamp || Number.isNaN(Date.parse(e.timestamp)))
+                continue;
+            const observedAt = new Date(e.timestamp).toISOString();
+            if (e.type === "response_item" &&
+                ["function_call", "custom_tool_call"].includes(p.type)) {
+                summary = undefined;
+                process = {
+                    kind: "process",
+                    status: "running",
+                    summary: "Agent 正在调用工具执行任务",
+                    source: "codex:tool-event (不含参数)",
+                    observedAt,
+                    taskId,
+                };
+            }
+            if (e.type === "event_msg" &&
+                ["task_started", "task_complete", "task_interrupted"].includes(p.type)) {
+                process = {
+                    kind: "process",
+                    status: p.type === "task_started" ? "running" : "unknown",
+                    summary: p.type === "task_started"
+                        ? "Agent 回合正在执行；尚未出现回合结束事件"
+                        : "Agent 回合已结束，任务结果仍需核对",
+                    source: "codex:turn-event",
+                    observedAt,
+                    taskId,
+                };
+                if (p.type === "task_started")
+                    summary = undefined;
+            }
+            if (e.type === "response_item" &&
+                p.role === "assistant" &&
+                ["final", "final_answer"].includes(p.phase)) {
+                if (process)
+                    process = {
+                        ...process,
+                        status: "unknown",
+                        observedAt,
+                        summary: "Agent 已给出最终回复，交付结论待交叉核对",
+                    };
+                const content = (p.content ?? [])
+                    .filter((c) => typeof c.text === "string")
+                    .map((c) => c.text)
+                    .join("\n");
+                if (content)
+                    summary = {
+                        kind: "summary",
+                        status: "unknown",
+                        summary: content.slice(0, 2000),
+                        source: "codex:final-message",
+                        observedAt,
+                        taskId,
+                    };
+            }
+        }
+        catch {
+            /* A bounded tail may begin in the middle of a JSON line. */
+        }
+    }
+    return [process, summary].filter((e) => !!e);
+}
+async function tail(path) {
+    const f = await open(path, "r");
+    try {
+        const stat = await f.stat();
+        const size = Math.min(stat.size, 524288);
+        const bytes = Buffer.alloc(size);
+        await f.read(bytes, 0, size, stat.size - size);
+        return bytes.toString("utf8");
+    }
+    finally {
+        await f.close();
+    }
+}
+async function command(file, args, cwd) {
+    return (await exec(file, args, { cwd, timeout: 8000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
+}
+async function herdr(args, session) {
+    return command("herdr", [
+        ...(session ? ["--session", session] : []),
+        ...args,
+    ]);
+}
+const ManagerSchema = z.record(z.string(), z.strictObject({
+    task: z.strictObject({
+        id: z.string(),
+        title: z.string().max(500),
+        requiresDeployment: z.boolean(),
+    }),
+    evidence: z.array(EvidenceSchema).max(20),
+}));
+export function applyManager(pane, managed) {
+    if (managed.task.id !== pane.task.id)
+        return false;
+    pane.task = managed.task;
+    pane.evidence.push(...managed.evidence);
+    return true;
+}
+export function preserveStopped(current, previous, stopped) {
+    return [
+        ...current,
+        ...previous
+            .filter((s) => stopped.includes(s.session))
+            .map((s) => ({ ...s, availability: "unavailable" })),
+    ];
+}
+export function conversationTaskId(text, sessionId) {
+    let lastUser;
+    for (const line of text.split("\n")) {
+        try {
+            const e = JSON.parse(line);
+            if ((e.type === "user" && !e.synthetic_reason) ||
+                (e.type === "message" && e.message?.role === "user"))
+                lastUser = JSON.stringify(e.type === "user" ? e.content : e.message.content);
+        }
+        catch {
+            /* Bounded tail can begin mid-line. */
+        }
+    }
+    return lastUser
+        ? createHash("sha256")
+            .update(`${sessionId}:${lastUser}`)
+            .digest("hex")
+            .slice(0, 32)
+        : undefined;
+}
+export async function collect(config) {
+    const capturedAt = new Date().toISOString();
+    const warnings = [];
+    const telemetry = await collectTelemetry(config.watchPorts);
+    if (!telemetry.resources)
+        warnings.push("机器资源采集失败，端口检查结果仍保留");
+    else if (!telemetry.resources.disk)
+        warnings.push("主目录磁盘信息不可读");
+    let spaces = [];
+    const cachePath = join(dirname(config.spoolDir ?? join(homedir(), ".config/eagle/spool")), "latest-report.json");
+    let previous;
+    try {
+        const cached = ReportSchema.parse(JSON.parse(await readFile(cachePath, "utf8")));
+        if (cached.machine.id === config.machineId)
+            previous = cached;
+    }
+    catch {
+        /* First collection has no cache. */
+    }
+    const sessions = JSON.parse(await herdr(["session", "list", "--json"])).sessions;
+    if (!sessions.some((s) => s.running) && !previous)
+        throw new Error("No running Herdr sessions; preserving previous inventory");
+    const manager = config.evidenceFile
+        ? ManagerSchema.parse(JSON.parse(await readFile(config.evidenceFile, "utf8")))
+        : {};
+    // ponytail: optional Codex v5/v1 adapter. Unsupported local DB schemas remain unknown; manager evidence is portable.
+    let state;
+    let goals;
+    const codexDir = config.codexDir ?? join(homedir(), ".codex");
+    try {
+        state = new DatabaseSync(join(codexDir, "state_5.sqlite"), {
+            readOnly: true,
+        });
+    }
+    catch {
+        warnings.push("Codex 会话数据库不可读；使用终端证据");
+    }
+    try {
+        goals = new DatabaseSync(join(codexDir, "goals_1.sqlite"), {
+            readOnly: true,
+        });
+    }
+    catch {
+        warnings.push("Codex Goal 数据库不可读；等待管理 Agent 补充");
+    }
+    try {
+        for (const session of sessions.filter((s) => s.running)) {
+            // Any session failure aborts the whole snapshot, so a partial inventory never closes Spaces.
+            const raw = JSON.parse(await herdr(["api", "snapshot"], session.name))
+                .result.snapshot;
+            const normalized = normalizeSnapshot(raw, session.name);
+            for (const space of normalized) {
+                for (const pane of space.tabs.flatMap((t) => t.panes)) {
+                    const original = raw.panes.find((p) => p.pane_id === pane.id);
+                    const managed = manager[`${session.name}:${pane.id}`];
+                    const sessionId = original?.agent_session?.kind === "id"
+                        ? original.agent_session.value
+                        : undefined;
+                    if (pane.agent === "codex" && sessionId) {
+                        try {
+                            const thread = state
+                                ?.prepare("SELECT title, rollout_path FROM threads WHERE id = ?")
+                                .get(sessionId);
+                            let currentContext;
+                            if (thread) {
+                                const transcript = await tail(thread.rollout_path);
+                                currentContext = transcriptContext(transcript);
+                                if (currentContext)
+                                    pane.task.id = createHash("sha256")
+                                        .update(`${sessionId}:${currentContext.turnId}`)
+                                        .digest("hex")
+                                        .slice(0, 32);
+                                pane.task.title = thread.title.slice(0, 500);
+                                pane.evidence.push(...transcriptEvidence(transcript, pane.task.id));
+                            }
+                            const goal = goals
+                                ?.prepare("SELECT objective, status, updated_at_ms FROM thread_goals WHERE thread_id = ?")
+                                .get(sessionId);
+                            if (goal &&
+                                currentContext &&
+                                goal.updated_at_ms >= Date.parse(currentContext.startedAt))
+                                pane.evidence.push({
+                                    kind: "goal",
+                                    status: goal.status === "active"
+                                        ? "running"
+                                        : goal.status === "complete"
+                                            ? "success"
+                                            : "waiting",
+                                    summary: goal.objective.slice(0, 2000),
+                                    source: "codex:thread-goal",
+                                    observedAt: new Date(goal.updated_at_ms).toISOString(),
+                                    taskId: pane.task.id,
+                                });
+                        }
+                        catch {
+                            warnings.push(`${space.name}/${pane.id}：原生会话证据不可读`);
+                        }
+                    }
+                    if (pane.agent === "grok" || pane.agent === "pi") {
+                        try {
+                            const identity = original?.agent_session?.value;
+                            const cwd = original?.cwd;
+                            const path = pane.agent === "pi"
+                                ? identity
+                                : identity && cwd
+                                    ? join(homedir(), ".grok/sessions", encodeURIComponent(cwd), identity, "chat_history.jsonl")
+                                    : undefined;
+                            if (path && identity) {
+                                const taskId = conversationTaskId(await tail(path), identity);
+                                if (taskId)
+                                    pane.task.id = taskId;
+                            }
+                        }
+                        catch {
+                            /* Portable manager evidence remains available when native history is absent. */
+                        }
+                    }
+                    if (managed && !applyManager(pane, managed))
+                        warnings.push(`${space.name}/${pane.id}：管理证据属于旧任务，已忽略`);
+                    if (!pane.evidence.some((e) => e.kind === "summary")) {
+                        try {
+                            const terminal = await herdr(["pane", "read", pane.id, "--source", "visible"], session.name);
+                            const lines = terminal
+                                .split("\n")
+                                .map((l) => l.trim())
+                                .filter((l) => l && !/^[─━╭╰│┃█\s]+$/.test(l));
+                            pane.evidence.push({
+                                kind: "summary",
+                                status: "unknown",
+                                summary: lines.slice(-12).join("\n").slice(0, 1500),
+                                source: "herdr:visible (当前画面，非最终结论)",
+                                observedAt: capturedAt,
+                                taskId: pane.task.id,
+                            });
+                        }
+                        catch {
+                            warnings.push(`${space.name}/${pane.id}：终端证据缺失`);
+                        }
+                    }
+                    const cwd = original?.foreground_cwd || original?.cwd;
+                    if (cwd) {
+                        try {
+                            const revision = await command("git", ["rev-parse", "HEAD"], cwd);
+                            const dirty = await command("git", ["status", "--porcelain", "--untracked-files=normal"], cwd);
+                            const branch = await command("git", ["branch", "--show-current"], cwd);
+                            pane.evidence.push({
+                                kind: "git",
+                                status: dirty ? "unknown" : "success",
+                                revision,
+                                summary: `${branch || "detached"} · ${revision.slice(0, 8)} · ${dirty ? `${dirty.split("\n").length} 项未提交变更` : "工作树干净"}`,
+                                source: "git:HEAD+status",
+                                observedAt: capturedAt,
+                                taskId: pane.task.id,
+                            });
+                        }
+                        catch {
+                            /* Shells outside a repository have no Git evidence. */
+                        }
+                    }
+                    try {
+                        const info = JSON.parse(await herdr(["pane", "process-info", "--pane", pane.id], session.name)).result.process_info;
+                        const names = (info.foreground_processes ?? [])
+                            .map((p) => p.name)
+                            .join(", ");
+                        // Presence of an agent harness is deliberately not evidence that a task is running.
+                        if (!pane.evidence.some((e) => e.kind === "process"))
+                            pane.evidence.push({
+                                kind: "process",
+                                status: "unknown",
+                                summary: names
+                                    ? `前台进程：${names}；进程存在不等于任务执行中`
+                                    : "没有前台任务进程",
+                                source: "herdr:process-info (仅进程名)",
+                                observedAt: capturedAt,
+                                taskId: pane.task.id,
+                            });
+                    }
+                    catch {
+                        warnings.push(`${space.name}/${pane.id}：进程证据缺失`);
+                    }
+                }
+                space.objective =
+                    space.tabs.flatMap((t) => t.panes).find((p) => p.agent === "codex")
+                        ?.task.title ??
+                        space.tabs[0]?.panes[0]?.task.title ??
+                        "";
+            }
+            spaces.push(...normalized);
+        }
+    }
+    finally {
+        state?.close();
+        goals?.close();
+    }
+    const stopped = sessions.filter((s) => !s.running).map((s) => s.name);
+    spaces = preserveStopped(spaces, previous?.spaces ?? [], stopped);
+    for (const session of stopped)
+        warnings.push(`${session}：Session 已停止，保留最近已知拓扑`);
+    const value = {
+        schemaVersion: 1,
+        reportId: randomUUID(),
+        capturedAt,
+        machine: {
+            id: config.machineId,
+            name: config.machineName,
+            platform: platform(),
+            collectorVersion: AGENT_VERSION,
+            telemetry,
+        },
+        spaces,
+        warnings: warnings.slice(0, 100),
+    };
+    // Scrub every string, including task titles and manager evidence, before disk spool or transport.
+    function scrub(v) {
+        if (typeof v === "string")
+            return redact(v, [config.token]).slice(0, v.length);
+        if (Array.isArray(v))
+            return v.map(scrub);
+        if (v && typeof v === "object")
+            return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, scrub(x)]));
+        return v;
+    }
+    const report = ReportSchema.parse(scrub(value));
+    await mkdir(dirname(cachePath), { recursive: true, mode: 0o700 });
+    await writeFile(`${cachePath}.${report.reportId}.tmp`, JSON.stringify(report), { mode: 0o600 });
+    await rename(`${cachePath}.${report.reportId}.tmp`, cachePath);
+    return report;
+}
+export function checkUrl(value) {
+    const url = new URL(value);
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/")
+        throw new Error("Use a plain Eagle origin");
+    if (url.protocol !== "https:" &&
+        !(url.protocol === "http:" &&
+            ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))
+        throw new Error("HTTPS is required outside loopback");
+    return url.origin;
+}
+export class UploadRejectedError extends Error {
+    status;
+    constructor(status) {
+        super(`Upload rejected (${status}); report retained`);
+        this.status = status;
+    }
+}
+export async function sendReport(url, token, report, transport = fetch, delayMs = 1000) {
+    const origin = checkUrl(url);
+    const payload = JSON.stringify(ReportSchema.parse(report));
+    for (let attempt = 0; attempt < 3; attempt++) {
+        let response;
+        try {
+            response = await transport(`${origin}/api/v1/reports`, {
+                method: "POST",
+                redirect: "error",
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "Content-Type": "application/json",
+                },
+                body: payload,
+                signal: AbortSignal.timeout(15000),
+            });
+        }
+        catch {
+            if (attempt === 2)
+                throw new Error("Upload network failure; report retained for retry");
+            await new Promise((r) => setTimeout(r, delayMs * 2 ** attempt));
+            continue;
+        }
+        if (response.ok) {
+            try {
+                return z
+                    .object({
+                    accepted: z.literal(true),
+                    duplicate: z.boolean(),
+                    seq: z.number().int().positive(),
+                })
+                    .parse(await response.json());
+            }
+            catch {
+                throw new Error("Invalid upload acknowledgement; report retained for retry");
+            }
+        }
+        if (response.status < 500 && response.status !== 429)
+            throw new UploadRejectedError(response.status);
+        if (attempt === 2)
+            throw new Error(`Upload unavailable (${response.status}); report retained`);
+        await new Promise((r) => setTimeout(r, delayMs * 2 ** attempt));
+    }
+}

package/dist/agent/machine.js

@@ -0,0 +1,85 @@
+import { statfs } from "node:fs/promises";
+import { createConnection } from "node:net";
+import { availableParallelism, cpus, freemem, homedir, loadavg, platform, totalmem, uptime, } from "node:os";
+import { setTimeout as delay } from "node:timers/promises";
+import { MachineTelemetrySchema, WatchPortsSchema, } from "../src/shared/schema.js";
+export function cpuUsage(before, after) {
+    const total = after.total - before.total;
+    const idle = after.idle - before.idle;
+    if (total <= 0 || idle < 0 || idle > total)
+        return null;
+    return Math.round((1 - idle / total) * 1000) / 10;
+}
+function cpuSample(values) {
+    return values.reduce((sum, cpu) => ({
+        idle: sum.idle + cpu.times.idle,
+        total: sum.total + Object.values(cpu.times).reduce((a, b) => a + b, 0),
+    }), { idle: 0, total: 0 });
+}
+async function resources() {
+    const processors = cpus();
+    const before = cpuSample(processors);
+    const started = performance.now();
+    // A short fresh sample also works for one-shot collectors; no process-lifetime counters.
+    await delay(250);
+    const after = cpus();
+    const cpuSampleMs = Math.round(performance.now() - started);
+    const disk = await statfs(homedir())
+        .then((fs) => ({
+        totalBytes: fs.blocks * fs.bsize,
+        availableBytes: fs.bavail * fs.bsize,
+    }))
+        .catch(() => null);
+    return {
+        cpuModel: processors[0]?.model || "",
+        cpuCores: processors.length || availableParallelism(),
+        cpuUsagePercent: processors.length === after.length
+            ? cpuUsage(before, cpuSample(after))
+            : null,
+        cpuSampleMs,
+        loadAverage: platform() === "win32" ? null : loadavg(),
+        memory: { totalBytes: totalmem(), freeBytes: freemem() },
+        disk,
+        uptimeSeconds: Math.floor(uptime()),
+    };
+}
+function checkPort(target) {
+    return new Promise((resolve) => {
+        const started = performance.now();
+        const socket = createConnection({ host: target.host, port: target.port });
+        let settled = false;
+        const finish = (status) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve({
+                ...target,
+                status,
+                latencyMs: status === "open"
+                    ? Math.round((performance.now() - started) * 10) / 10
+                    : null,
+                checkedAt: new Date().toISOString(),
+            });
+        };
+        socket.setTimeout(1000, () => finish("timeout"));
+        socket.once("connect", () => finish("open"));
+        socket.once("error", (error) => finish(error.code === "ECONNREFUSED"
+            ? "closed"
+            : error.code === "ETIMEDOUT"
+                ? "timeout"
+                : "error"));
+    });
+}
+export async function collectTelemetry(watchPorts = []) {
+    const targets = WatchPortsSchema.parse(watchPorts);
+    const [sample, ports] = await Promise.all([
+        resources().catch(() => null),
+        Promise.all(targets.map(checkPort)),
+    ]);
+    return MachineTelemetrySchema.parse({
+        observedAt: new Date().toISOString(),
+        resources: sample,
+        ports,
+    });
+}

package/dist/agent/spool.js

@@ -0,0 +1,37 @@
+import { mkdir, readdir, readFile, rename, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { ZodError } from "zod";
+import { ReportSchema } from "../src/shared/schema.js";
+import { UploadRejectedError } from "./collector.js";
+export async function drainSpool(directory, machineId, send) {
+    let sent = 0;
+    const files = (await readdir(directory))
+        .filter((f) => f.endsWith(".json"))
+        .sort()
+        .reverse(); // Timestamp-prefixed files: restore current state before replaying backlog.
+    for (const file of files) {
+        const path = join(directory, file);
+        try {
+            const report = ReportSchema.parse(JSON.parse(await readFile(path, "utf8")));
+            if (report.machine.id !== machineId)
+                throw new UploadRejectedError(400);
+            await send(report);
+            await unlink(path);
+            sent++;
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError ||
+                error instanceof ZodError ||
+                (error instanceof UploadRejectedError &&
+                    [400, 409, 413, 415].includes(error.status))))
+                throw error;
+            await mkdir(join(directory, "rejected"), {
+                recursive: true,
+                mode: 0o700,
+            });
+            await rename(path, join(directory, "rejected", file));
+        }
+    }
+    const rejected = await readdir(join(directory, "rejected")).then((f) => f.length, () => 0);
+    return { sent, rejected };
+}

package/dist/agent/version.js

@@ -0,0 +1 @@
+export const AGENT_VERSION = "0.3.0";

package/dist/src/shared/schema.js

@@ -0,0 +1,144 @@
+import { z } from "zod";
+const id = z
+    .string()
+    .min(1)
+    .max(160)
+    .regex(/^[\w.:/-]+$/);
+const text = z.string().max(2000);
+const timestamp = z.iso
+    .datetime({ offset: false })
+    .transform((value) => new Date(value).toISOString());
+const bytes = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+export const WatchPortSchema = z.strictObject({
+    name: z.string().trim().min(1).max(80),
+    host: z.enum(["127.0.0.1", "::1"]).default("127.0.0.1"),
+    port: z.number().int().min(1).max(65535),
+});
+export const WatchPortsSchema = z
+    .array(WatchPortSchema)
+    .max(32)
+    .refine((ports) => new Set(ports.map((p) => `${p.host}:${p.port}`)).size === ports.length, "Duplicate watched port");
+export const PortCheckSchema = WatchPortSchema.extend({
+    status: z.enum(["open", "closed", "timeout", "error"]),
+    latencyMs: z.number().nonnegative().nullable(),
+    checkedAt: timestamp,
+});
+export const MachineTelemetrySchema = z.strictObject({
+    observedAt: timestamp,
+    resources: z
+        .strictObject({
+        cpuModel: z.string().max(240),
+        cpuCores: z.number().int().positive().max(4096),
+        cpuUsagePercent: z.number().min(0).max(100).nullable(),
+        cpuSampleMs: z.number().positive(),
+        loadAverage: z
+            .tuple([
+            z.number().nonnegative(),
+            z.number().nonnegative(),
+            z.number().nonnegative(),
+        ])
+            .nullable(),
+        memory: z
+            .strictObject({ totalBytes: bytes.positive(), freeBytes: bytes })
+            .refine((m) => m.freeBytes <= m.totalBytes, "Free memory exceeds total"),
+        disk: z
+            .strictObject({ totalBytes: bytes.positive(), availableBytes: bytes })
+            .refine((d) => d.availableBytes <= d.totalBytes, "Available disk exceeds total")
+            .nullable(),
+        uptimeSeconds: z.number().int().nonnegative(),
+    })
+        .nullable(),
+    ports: z
+        .array(PortCheckSchema)
+        .max(32)
+        .refine((ports) => new Set(ports.map((p) => `${p.host}:${p.port}`)).size === ports.length, "Duplicate watched port"),
+});
+export const EvidenceSchema = z.strictObject({
+    kind: z.enum(["summary", "goal", "git", "test", "process", "deployment"]),
+    status: z.enum(["success", "failure", "running", "waiting", "unknown"]),
+    summary: text,
+    source: z.string().min(1).max(240),
+    observedAt: timestamp,
+    taskId: id,
+    revision: z.string().max(100).optional(),
+});
+export const PaneSchema = z.strictObject({
+    id,
+    title: z.string().max(240),
+    agent: z.string().max(80),
+    hint: z.enum(["working", "idle", "done", "blocked", "unknown"]),
+    task: z.strictObject({
+        id,
+        title: z.string().max(500),
+        requiresDeployment: z.boolean(),
+    }),
+    rect: z
+        .strictObject({
+        x: z.number().min(0).max(1),
+        y: z.number().min(0).max(1),
+        width: z.number().positive().max(1),
+        height: z.number().positive().max(1),
+    })
+        .refine((r) => r.x + r.width <= 1.001 && r.y + r.height <= 1.001, "Pane lies outside tab"),
+    evidence: z.array(EvidenceSchema).max(30),
+});
+export const SpaceSchema = z.strictObject({
+    availability: z.literal("unavailable").optional(),
+    id,
+    name: z.string().min(1).max(240),
+    session: z.string().min(1).max(100),
+    objective: z.string().max(1000),
+    tabs: z
+        .array(z.strictObject({
+        id,
+        name: z.string().max(240),
+        panes: z.array(PaneSchema).max(100),
+    }))
+        .max(50),
+});
+export const ReportSchema = z
+    .strictObject({
+    schemaVersion: z.literal(1),
+    reportId: id,
+    capturedAt: timestamp,
+    machine: z.strictObject({
+        id: z
+            .string()
+            .min(1)
+            .max(80)
+            .regex(/^[a-z0-9][a-z0-9_-]*$/),
+        name: z.string().min(1).max(120),
+        platform: z.string().max(80),
+        collectorVersion: z.string().max(80),
+        telemetry: MachineTelemetrySchema.optional(),
+    }),
+    spaces: z.array(SpaceSchema).max(200),
+    warnings: z.array(z.string().max(500)).max(100),
+})
+    .superRefine((report, ctx) => {
+    const unique = (ids) => new Set(ids).size === ids.length;
+    if (!unique(report.spaces.map((s) => s.id)))
+        ctx.addIssue({ code: "custom", message: "Duplicate space ID" });
+    let count = 0;
+    for (const space of report.spaces) {
+        const panes = space.tabs.flatMap((t) => t.panes);
+        count += panes.length;
+        if (!unique(space.tabs.map((t) => t.id)) ||
+            !unique(panes.map((p) => p.id)))
+            ctx.addIssue({ code: "custom", message: "Duplicate tab/pane ID" });
+    }
+    if (count > 1000)
+        ctx.addIssue({ code: "custom", message: "Too many panes" });
+});
+export const HeartbeatSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    machineId: id,
+    sentAt: timestamp,
+    warning: z.string().max(500).optional(),
+});
+export const STATE_LABEL = {
+    verified: "已验证完成",
+    active: "进行中",
+    attention: "需关注",
+    unverified: "待核实",
+};

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@nocoo/eagle-agent",
+  "version": "0.3.0",
+  "description": "Report all local Herdr spaces and machine resources to Eagle",
+  "type": "module",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nocoo/eagle.git",
+    "directory": "agent"
+  },
+  "bin": {
+    "eagle-agent": "dist/agent/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "zod": "^4.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}