@nocoo/eagle-agent 0.3.0 → 0.5.0

package/README.md

@@ -6,24 +6,24 @@ Read-only Herdr inventory, task evidence, machine resources and named TCP port c
 
 Check `node --version`, `npm --version` and `herdr --version` first. Install Node.js 24+ from https://nodejs.org/en/download if needed, and have Herdr installed and running. No Eagle repository checkout, TypeScript compiler or npm login is required to install this public package.
 
-Download and install the pinned release from the official npm registry:
+Install Agent v0.5.0 from npm. The Agent and Eagle website share the same release version:
 
 ```sh
-npm install -g @nocoo/eagle-agent@0.3.0 --registry=https://registry.npmjs.org
+npm install -g @nocoo/eagle-agent@0.5.0 --registry=https://registry.npmjs.org
 ```
 
-**If npm is unreachable or times out, use the Tencent Cloud mirror first / npm 连不上时首选腾讯云镜像：**
+**If npm downloads time out, use the Tencent Cloud mirror / 下载超时时首选腾讯云镜像：**
 
 ```sh
-npm install -g @nocoo/eagle-agent@0.3.0 --registry=https://mirrors.cloud.tencent.com/npm/
+npm install -g @nocoo/eagle-agent@0.5.0 --registry=https://mirrors.cloud.tencent.com/npm/
 ```
 
-`--registry` applies only to this installation; it does not change your global npm configuration. Mirrors may take time to synchronize a new release: for `404` / `ETARGET`, retry later or use the official registry once reachable. Keep the pinned version, HTTPS and certificate verification. Eagle credentials are unrelated to npm and must never be sent to a registry.
+`--registry` applies only to this installation; it does not change your global npm configuration. Mirrors may lag (`404` / `ETARGET`); retry later or use the official registry when reachable. Keep the pinned version, HTTPS and certificate verification. Eagle credentials are unrelated to npm and must never be sent to a registry.
 
 Verify the installation before configuring the agent:
 
 ```sh
-eagle-agent --version # expected: 0.3.0
+eagle-agent --version # expected: 0.5.0
 eagle-agent --help
 ```
 
@@ -45,8 +45,42 @@ eagle-agent heartbeat
 
 `once` collects all running Herdr sessions and sends a complete snapshot. `watch` repeats every 30 seconds by default. Set up a user launchd or systemd service to keep it running across restarts, with the correct absolute executable paths and PATH for Node and Herdr. Do not run overlapping collectors for one configuration.
 
-The machine's Durable Object maintains current state. Unacknowledged reports remain in a private local spool; retries preserve their IDs. Older reports cannot roll back current state. Hourly summaries and new D1 archive writes are paused.
+The machine's Durable Object maintains current state. Unacknowledged reports remain in a private local spool; retries preserve their IDs. Older reports cannot roll back current state. Semantic changes are retained independently in DO UTC hourly buckets and replicated to D1; whole-report archives and hourly AI aggregation remain paused.
 
 Optional `watchPorts`: `[{ "name": "Raven", "port": 7024 }]`. Only loopback TCP checks are supported; a listening port does not prove service or task health. CPU, RAM, disk and uptime are sampled automatically. Task status combines terminal summaries, goals, Git, tests, processes and deployment evidence; pane lifecycle badges are weak hints.
 
 Detailed configuration and manager evidence format: https://github.com/nocoo/eagle/blob/main/docs/AGENT.md
+
+## Continuous Pane summaries
+
+Eagle is agent-neutral. Reuse the machine's existing management Agent; **Hermes Agent is recommended, not required**. Cherry is one machine's local Hermes profile/alias, not a product or dependency to install. Do not search for or install an unrelated Cherry package. If no suitable Agent is configured yet, keep `eagle-agent watch` running and report that semantic setup is pending.
+
+Set `manager.command` explicitly in the existing secure config, preserving its other fields. The command is an argv array, executed without a shell: it receives a UTF-8 instruction followed by bounded input JSON on stdin and must return the requested JSON array on stdout. Use the existing model/provider/profile, disable tools and avoid interactive prompts. A small adapter script can normalize another Agent's input/output. Eagle does not install an Agent or change its model configuration.
+
+For an already configured Hermes, inspect `hermes chat --help`, locate its executable and replace the example path below. Only use flags supported by that installed version. The official project is https://github.com/NousResearch/hermes-agent; follow its installation instructions only if Hermes is actually needed. A working alternative Agent needs no Hermes installation.
+
+```json
+{
+  "manager": {
+    "id": "manager",
+    "command": ["/absolute/path/to/hermes", "chat", "--query-file", "-", "--oneshot", "--quiet", "--toolsets", "none", "--ignore-rules", "--source", "tool", "--max-turns", "1", "--run-budget", "55"],
+    "minIntervalSeconds": 120,
+    "batchSize": 8
+  }
+}
+```
+
+This is a config fragment, not a replacement for `agent.json`. For a named Hermes profile, use its existing launcher/wrapper or documented profile selection; retain the same provider credentials and service environment. The example does not pass model/provider overrides or `--ignore-user-config`. For another Agent, replace the entire `command` array with its verified stdin/noninteractive invocation or adapter; do not reuse Hermes flags blindly. Keep credentials out of argv and model input.
+
+Run `eagle-agent manager-once`, verify actual summaries, then supervise `eagle-agent manager-watch` separately from `watch` using absolute paths and the required PATH/profile environment. Alternatively schedule `manager-once` with the machine's existing cron/scheduler; verify that scheduler's syntax and do not run both schedulers. A single successful cycle does not provide continuous coverage.
+
+Manager has a 65-second subprocess deadline and a persistent 120-second minimum per Pane/task. It interprets changed inputs only; stable inputs refresh freshness without another model call or history entry. Each summary describes task, phase, progress, outcomes, blocker, next step and rationale with deterministic evidence references. Neither Agent output nor a terminal completion claim certifies tests or deployment.
+
+Preserve the existing `manager.id` and `manager-MACHINE_ID/` directory across upgrades, even if its old ID is `cherry`: IDs are durable writer identities, not executable names. Keep sequence, pending batches and cached summaries. When upgrading from 0.4.0's implicit Cherry default, explicitly configure the already working command and keep ID `cherry`; do not reset identity or install a different Agent.
+
+Protocol, independent DO streams, hourly history and retention: https://github.com/nocoo/eagle/blob/main/docs/PANE-SUMMARIES.md
+Reusable Skill: https://github.com/nocoo/eagle/blob/main/skills/eagle-report/SKILL.md
+
+## Space realtime control
+
+Run `eagle-agent realtime-watch` as a separate user service using the same secure configuration. This enables authenticated web control through an outbound WebSocket; the collector remains read-only. Open a Space in Eagle and select 实时模式, then 接管输入. Unwatched Spaces consume no screen polling. Leaving/hiding the page releases the subscription; input is never replayed after a disconnect. Details and limits: https://github.com/nocoo/eagle/blob/main/docs/REALTIME.md

package/dist/agent/cli.js

@@ -5,6 +5,8 @@ import { dirname, join } from "node:path";
 import { z } from "zod";
 import { ReportSchema, WatchPortsSchema } from "../src/shared/schema.js";
 import { checkUrl, collect, sendReport, } from "./collector.js";
+import { ManagerConfigSchema, managerTick } from "./manager.js";
+import { realtimeWatch } from "./realtime.js";
 import { drainSpool } from "./spool.js";
 import { AGENT_VERSION } from "./version.js";
 const ConfigSchema = z.strictObject({
@@ -17,6 +19,7 @@ const ConfigSchema = z.strictObject({
     codexDir: z.string().optional(),
     spoolDir: z.string().optional(),
     watchPorts: WatchPortsSchema.default([]),
+    manager: ManagerConfigSchema.optional(),
 });
 const path = process.env.EAGLE_CONFIG || join(homedir(), ".config/eagle/agent.json");
 async function heartbeat(config, warning) {
@@ -74,7 +77,7 @@ async function cycle(config) {
 async function main() {
     const action = process.argv[2] || "once";
     if (action === "--help" || action === "help") {
-        console.log("Eagle Agent\nCommands: init (JSON on stdin), collect <file>, upload <file>, once, watch, heartbeat\nConfig: EAGLE_CONFIG or ~/.config/eagle/agent.json (0600). Node.js 24+ and Herdr required.");
+        console.log("Eagle Agent\nCommands: init (JSON on stdin), collect <file>, upload <file>, once, watch, realtime-watch, heartbeat, manager-once, manager-watch\nConfig: EAGLE_CONFIG or ~/.config/eagle/agent.json (0600). Node.js 24+ and Herdr required. Manager requires explicit manager.command for your existing agent (Hermes recommended); deterministic collection is independent.");
         return;
     }
     if (action === "--version") {
@@ -115,6 +118,8 @@ async function main() {
         throw new Error("Config must have mode 0600");
     const config = ConfigSchema.parse(JSON.parse(await readFile(path, "utf8")));
     checkUrl(config.url);
+    if (action.startsWith("manager-") && !config.manager?.command)
+        throw new Error("Configure manager.command for your existing agent (Hermes recommended) before starting Manager; watch works independently.");
     if (action === "collect") {
         const output = process.argv[3];
         if (!output)
@@ -133,13 +138,21 @@ async function main() {
             throw new Error("Machine identity mismatch");
         console.log(JSON.stringify(await sendReport(config.url, config.token, report)));
     }
+    else if (action === "realtime-watch") {
+        const stop = new AbortController();
+        process.once("SIGTERM", () => stop.abort());
+        process.once("SIGINT", () => stop.abort());
+        await realtimeWatch(config, stop.signal);
+    }
     else if (action === "heartbeat") {
         await heartbeat(config);
         console.log("Heartbeat accepted");
     }
     else if (action === "once")
         await cycle(config);
-    else if (action === "watch") {
+    else if (action === "manager-once")
+        console.log(JSON.stringify(await managerTick(config, join(dirname(path), `manager-${config.machineId}`))));
+    else if (action === "watch" || action === "manager-watch") {
         let running = true;
         process.on("SIGTERM", () => {
             running = false;
@@ -150,11 +163,18 @@ async function main() {
         while (running) {
             const start = Date.now();
             try {
-                await cycle(config);
+                if (action === "manager-watch")
+                    console.log(JSON.stringify({
+                        event: "manager_reported",
+                        at: new Date().toISOString(),
+                        ...(await managerTick(config, join(dirname(path), `manager-${config.machineId}`))),
+                    }));
+                else
+                    await cycle(config);
             }
             catch (e) {
                 console.error(JSON.stringify({
-                    event: "report_failed",
+                    event: action === "manager-watch" ? "manager_failed" : "report_failed",
                     message: e instanceof z.ZodError
                         ? "Invalid config or report schema"
                         : e instanceof Error
@@ -167,7 +187,7 @@ async function main() {
         }
     }
     else
-        throw new Error("Commands: collect <file>, upload <file>, once, watch, heartbeat");
+        throw new Error("Commands: collect <file>, upload <file>, once, watch, realtime-watch, heartbeat, manager-once, manager-watch");
 }
 void main().catch((e) => {
     console.error(e instanceof z.ZodError

package/dist/agent/collector.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, stat, writeFile, } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
@@ -12,7 +12,8 @@ import { AGENT_VERSION } from "./version.js";
 const exec = promisify(execFile);
 export function redact(text, secrets = []) {
     let clean = stripVTControlCharacters(text)
-        .replace(/-----BEGIN [\w ]*PRIVATE KEY-----[\s\S]*?-----END [\w ]*PRIVATE KEY-----/g, "[REDACTED KEY]")
+        .replace(/-----BEGIN [\w ]*PRIVATE KEY-----[\s\S]*?(?:-----END [\w ]*PRIVATE KEY-----|$)/g, "[REDACTED KEY]")
+        .replace(/(?:^[ \t]*[A-Za-z0-9+/]+={0,2}[ \t]*\r?\n)+[ \t]*-----END [\w ]*PRIVATE KEY-----/gm, "[REDACTED KEY]")
         .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]")
         .replace(/\beag1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
         .replace(/((?:[A-Z_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|CREDENTIAL)[A-Z_]*)\s*[=:]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;]+)/gi, "$1[REDACTED]")
@@ -22,7 +23,7 @@ export function redact(text, secrets = []) {
             clean = clean.replaceAll(secret, "[REDACTED]");
     return clean;
 }
-export function normalizeSnapshot(snapshot, session) {
+export function normalizeSnapshot(snapshot, session, secrets = []) {
     if (!Array.isArray(snapshot.workspaces) ||
         !Array.isArray(snapshot.tabs) ||
         !Array.isArray(snapshot.panes) ||
@@ -44,9 +45,9 @@ export function normalizeSnapshot(snapshot, session) {
                 panes: rawPanes.map((p, index) => {
                     const rect = layout?.panes.find((r) => r.pane_id === p.pane_id)?.rect;
                     const area = layout?.area;
-                    const title = (p.title ||
+                    const title = redact(p.title ||
                         p.terminal_title_stripped ||
-                        `${p.agent || "终端"} · ${w.label}`).slice(0, 240);
+                        `${p.agent || "终端"} · ${w.label}`, secrets).slice(0, 240);
                     return {
                         id: p.pane_id,
                         title,
@@ -56,7 +57,7 @@ export function normalizeSnapshot(snapshot, session) {
                             : "unknown",
                         task: {
                             id: createHash("sha256")
-                                .update(`${session}:${p.pane_id}:${p.agent_session?.value || "shell"}:${p.agent === "codex" ? "" : title}`)
+                                .update(`${session}:${p.pane_id}:${p.agent || "shell"}:${p.agent_session?.agent && p.agent_session.agent !== p.agent ? (p.terminal_id ?? "") : (p.agent_session?.value ?? p.terminal_id ?? "")}`)
                                 .digest("hex")
                                 .slice(0, 32),
                             title,
@@ -202,8 +203,12 @@ const ManagerSchema = z.record(z.string(), z.strictObject({
 export function applyManager(pane, managed) {
     if (managed.task.id !== pane.task.id)
         return false;
-    pane.task = managed.task;
-    pane.evidence.push(...managed.evidence);
+    pane.task.title = managed.task.title;
+    pane.evidence.push(...managed.evidence.map((e) => ({
+        ...e,
+        status: "unknown",
+        source: `manager:legacy:${e.source}`.slice(0, 240),
+    })));
     return true;
 }
 export function preserveStopped(current, previous, stopped) {
@@ -234,6 +239,51 @@ export function conversationTaskId(text, sessionId) {
             .slice(0, 32)
         : undefined;
 }
+export function conversationEvidence(text, agent, taskId, modifiedAt) {
+    let final;
+    for (const line of text.split("\n")) {
+        try {
+            const event = JSON.parse(line);
+            const message = event.type === "message" ? event.message : event;
+            if ((event.type === "user" && !event.synthetic_reason) ||
+                (event.type === "message" && message.role === "user"))
+                final = undefined;
+            if (!(event.type === "assistant" || message?.role === "assistant"))
+                continue;
+            if (message.tool_calls?.length ||
+                (message.stopReason && message.stopReason !== "stop"))
+                continue;
+            if (Array.isArray(message.content) &&
+                message.content.some((c) => c.type === "toolCall" || c.type === "tool_use"))
+                continue;
+            const content = typeof message.content === "string"
+                ? message.content
+                : Array.isArray(message.content)
+                    ? message.content
+                        .filter((c) => c.type === "text")
+                        .map((c) => c.text)
+                        .join("\n")
+                    : "";
+            if (!content.trim())
+                continue;
+            const timestamp = Date.parse(event.timestamp ?? message.timestamp);
+            final = {
+                kind: "summary",
+                status: "unknown",
+                summary: content.slice(-2000),
+                source: `${agent}:final-message`,
+                taskId,
+                observedAt: Number.isFinite(timestamp)
+                    ? new Date(timestamp).toISOString()
+                    : modifiedAt,
+            };
+        }
+        catch {
+            /* A bounded native transcript can begin mid-line. */
+        }
+    }
+    return final ? [final] : [];
+}
 export async function collect(config) {
     const capturedAt = new Date().toISOString();
     const warnings = [];
@@ -284,12 +334,14 @@ export async function collect(config) {
             // Any session failure aborts the whole snapshot, so a partial inventory never closes Spaces.
             const raw = JSON.parse(await herdr(["api", "snapshot"], session.name))
                 .result.snapshot;
-            const normalized = normalizeSnapshot(raw, session.name);
+            const normalized = normalizeSnapshot(raw, session.name, [config.token]);
             for (const space of normalized) {
                 for (const pane of space.tabs.flatMap((t) => t.panes)) {
                     const original = raw.panes.find((p) => p.pane_id === pane.id);
                     const managed = manager[`${session.name}:${pane.id}`];
-                    const sessionId = original?.agent_session?.kind === "id"
+                    const sessionId = original?.agent_session?.kind === "id" &&
+                        (!original.agent_session.agent ||
+                            original.agent_session.agent === pane.agent)
                         ? original.agent_session.value
                         : undefined;
                     if (pane.agent === "codex" && sessionId) {
@@ -334,7 +386,10 @@ export async function collect(config) {
                     }
                     if (pane.agent === "grok" || pane.agent === "pi") {
                         try {
-                            const identity = original?.agent_session?.value;
+                            const identity = original?.agent_session?.agent &&
+                                original.agent_session.agent !== pane.agent
+                                ? undefined
+                                : original?.agent_session?.value;
                             const cwd = original?.cwd;
                             const path = pane.agent === "pi"
                                 ? identity
@@ -342,9 +397,11 @@ export async function collect(config) {
                                     ? join(homedir(), ".grok/sessions", encodeURIComponent(cwd), identity, "chat_history.jsonl")
                                     : undefined;
                             if (path && identity) {
-                                const taskId = conversationTaskId(await tail(path), identity);
+                                const transcript = await tail(path);
+                                const taskId = conversationTaskId(transcript, identity);
                                 if (taskId)
                                     pane.task.id = taskId;
+                                pane.evidence.push(...conversationEvidence(transcript, pane.agent, pane.task.id, (await stat(path)).mtime.toISOString()));
                             }
                         }
                         catch {