@nocoo/eagle-agent 0.3.0 → 0.5.0

package/dist/agent/realtime.js

@@ -0,0 +1,379 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { createConnection } from "node:net";
+import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+import WebSocket from "ws";
+import { AgentMessageSchema, BridgeMessageSchema, TopologySchema, } from "../src/shared/realtime.js";
+import { checkUrl, normalizeSnapshot, redact, } from "./collector.js";
+import { submitTerminalInput } from "./terminal-input.js";
+export function redactScreen(value, secrets) {
+    // A viewport can contain only a PEM body. Conservatively hide base64 line runs,
+    // including narrow terminal wraps, even when neither boundary is visible.
+    const text = redact(value, secrets).replace(/(?:^[ \t]*[A-Za-z0-9+/]{16,}={0,2}[ \t]*(?:\r?\n|$)){2,}/gm, "[REDACTED KEY]\n");
+    const positions = [];
+    let compact = "";
+    for (let i = 0; i < text.length; i++)
+        if (!/\s/.test(text[i])) {
+            positions.push(i);
+            compact += text[i];
+        }
+    const masked = new Set();
+    const mask = (start, length) => {
+        for (let i = start; i < start + length; i++)
+            masked.add(positions[i]);
+    };
+    // Match across rendered wraps; also suppress recognizable credential fragments at viewport edges.
+    for (const secret of secrets.filter(Boolean)) {
+        const size = Math.min(8, secret.length);
+        for (let i = 0; i <= secret.length - size; i++) {
+            const part = secret.slice(i, i + size);
+            for (let at = compact.indexOf(part); at >= 0; at = compact.indexOf(part, at + 1))
+                mask(at, size);
+        }
+    }
+    for (const match of compact.matchAll(/(?:eag1\.[A-Za-z0-9_.-]+|sk-[\w-]{16,}|gh[pousr]_[\w]{20,}|github_pat_[\w]{20,}|(?:TOKEN|SECRET|PASSWORD|API_KEY|CREDENTIAL)[\w]*[=:][^,;"']+)/gi))
+        mask(match.index, match[0].length);
+    return text
+        .split("")
+        .map((c, i) => (masked.has(i) ? "*" : c))
+        .join("")
+        .replace(/\*{8,}/g, "[REDACTED]");
+}
+export function socketRequest(path, method, params, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error("Cancelled"));
+            return;
+        }
+        const socket = createConnection(path);
+        const id = randomUUID();
+        let bytes = "", settled = false;
+        const finish = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else if (result)
+                resolve(result);
+            else
+                reject(new Error("Missing response"));
+        };
+        const abort = () => finish(new Error("Cancelled"));
+        const timer = setTimeout(() => finish(new Error("Herdr timeout")), 5000);
+        signal.addEventListener("abort", abort, { once: true });
+        socket.setEncoding("utf8");
+        socket.on("error", () => finish(new Error("Herdr unavailable")));
+        socket.on("end", () => finish(new Error("Herdr disconnected")));
+        socket.on("connect", () => {
+            if (!signal.aborted)
+                socket.write(JSON.stringify({ id, method, params }) + "\n");
+        });
+        socket.on("data", (chunk) => {
+            bytes += chunk;
+            if (bytes.length > 4 * 1024 * 1024) {
+                finish(new Error("Herdr response too large"));
+                return;
+            }
+            const end = bytes.indexOf("\n");
+            if (end < 0)
+                return;
+            try {
+                const response = JSON.parse(bytes.slice(0, end));
+                if (response.id !== id || response.error || !response.result)
+                    throw new Error();
+                finish(undefined, response.result);
+            }
+            catch {
+                finish(new Error("Invalid Herdr response"));
+            }
+        });
+    });
+}
+export class LiveBridge {
+    watches = new Map();
+    secrets;
+    send;
+    resolve;
+    constructor(secrets, send, resolve) {
+        this.secrets = secrets;
+        this.send = send;
+        this.resolve = resolve;
+    }
+    receive(value) {
+        const parsed = BridgeMessageSchema.safeParse(value);
+        if (!parsed.success)
+            throw new Error("Invalid relay message");
+        const message = parsed.data;
+        if (message.type === "subscriptions") {
+            const wanted = new Map(message.spaces.map((s) => [s.spaceId, s]));
+            for (const [key, watch] of this.watches)
+                if (wanted.get(key)?.subscriptionId !== watch.subscription.subscriptionId) {
+                    watch.abort.abort();
+                    this.watches.delete(key);
+                }
+            for (const subscription of message.spaces) {
+                const previous = this.watches.get(subscription.spaceId);
+                if (previous) {
+                    previous.force = true;
+                    continue;
+                }
+                const watch = {
+                    subscription,
+                    abort: new AbortController(),
+                    force: true,
+                    screens: new Map(),
+                    frameSequence: 0,
+                    queue: Promise.resolve(),
+                };
+                this.watches.set(subscription.spaceId, watch);
+                void this.watch(watch);
+            }
+        }
+        else if (message.type === "input") {
+            const watch = this.watches.get(message.spaceId);
+            const ack = (status) => this.send({
+                type: "ack",
+                clientId: message.clientId,
+                seq: message.seq,
+                status,
+            });
+            if (!watch ||
+                watch.subscription.subscriptionId !== message.subscriptionId) {
+                ack("rejected");
+                return;
+            }
+            watch.queue = watch.queue.then(async () => {
+                try {
+                    if (!watch.path ||
+                        watch.abort.signal.aborted ||
+                        redact(message.text, this.secrets) !== message.text) {
+                        ack("rejected");
+                        return;
+                    }
+                    const result = await socketRequest(watch.path, "session.snapshot", {}, watch.abort.signal);
+                    const raw = result.snapshot;
+                    const pane = raw.panes.find((p) => p.pane_id === message.paneId &&
+                        p.terminal_id === message.terminalId &&
+                        `${message.spaceId.slice(0, message.spaceId.indexOf(":"))}:${p.workspace_id}` ===
+                            message.spaceId);
+                    if (!pane || watch.abort.signal.aborted) {
+                        ack("rejected");
+                        return;
+                    }
+                    const rect = raw.layouts
+                        .find((l) => l.tab_id === pane.tab_id)
+                        ?.panes.find((p) => p.pane_id === pane.pane_id)?.rect;
+                    if (!rect) {
+                        ack("rejected");
+                        return;
+                    }
+                    const status = await submitTerminalInput(watch.path, message, { width: rect.width, height: Math.max(1, rect.height - 1) }, watch.abort.signal, async () => {
+                        const latest = (await socketRequest(watch.path ?? "", "session.snapshot", {}, watch.abort.signal)).snapshot;
+                        return latest.panes.some((p) => p.pane_id === pane.pane_id &&
+                            p.terminal_id === message.terminalId &&
+                            p.workspace_id === pane.workspace_id &&
+                            p.tab_id === pane.tab_id);
+                    });
+                    watch.force = true;
+                    ack(status);
+                }
+                catch {
+                    ack("rejected");
+                }
+            });
+        }
+    }
+    async watch(watch) {
+        const { spaceId } = watch.subscription;
+        const session = spaceId.slice(0, spaceId.indexOf(":"));
+        const signal = watch.abort.signal;
+        try {
+            watch.path = await this.resolve(session, signal);
+            while (!signal.aborted) {
+                const result = await socketRequest(watch.path, "session.snapshot", {}, signal);
+                const raw = result.snapshot;
+                const space = normalizeSnapshot(raw, session, this.secrets).find((s) => s.id === spaceId);
+                if (!space)
+                    throw new Error("Space unavailable");
+                const topology = TopologySchema.parse({
+                    type: "topology",
+                    ...watch.subscription,
+                    tabs: space.tabs.map((t) => ({
+                        id: t.id,
+                        name: redactScreen(t.name, this.secrets).slice(0, 240),
+                        panes: t.panes.map((p) => ({
+                            id: p.id,
+                            terminalId: raw.panes.find((r) => r.pane_id === p.id)
+                                ?.terminal_id,
+                            title: redactScreen(p.title, this.secrets).slice(0, 240),
+                            rect: p.rect,
+                        })),
+                    })),
+                });
+                const force = watch.force ||
+                    JSON.stringify(topology) !== JSON.stringify(watch.topology);
+                watch.force = false;
+                if (signal.aborted)
+                    return;
+                if (force) {
+                    this.send(topology);
+                    watch.topology = topology;
+                }
+                const panes = topology.tabs.flatMap((t) => t.panes);
+                const pending = [];
+                // Herdr 0.9.1 screen revisions can be zero. Compare content after bounded reads.
+                for (let i = 0; i < panes.length; i += 4)
+                    await Promise.all(panes.slice(i, i + 4).map(async (p) => {
+                        const result = await socketRequest(watch.path ?? "", "pane.read", {
+                            pane_id: p.id,
+                            source: "visible",
+                            format: "text",
+                            strip_ansi: true,
+                        }, signal);
+                        const read = result.read;
+                        const original = raw.panes.find((r) => r.pane_id === p.id);
+                        if (read.pane_id !== p.id ||
+                            read.workspace_id !== original?.workspace_id ||
+                            read.tab_id !== original?.tab_id)
+                            return;
+                        pending.push({
+                            pane: p,
+                            text: redactScreen(read.text, this.secrets).slice(-32000),
+                            tab: read.tab_id,
+                        });
+                    }));
+                const after = (await socketRequest(watch.path, "session.snapshot", {}, signal)).snapshot;
+                if (signal.aborted)
+                    return;
+                for (const { pane: p, text, tab } of pending) {
+                    const current = after.panes.find((r) => r.pane_id === p.id &&
+                        r.terminal_id === p.terminalId &&
+                        r.tab_id === tab &&
+                        `${session}:${r.workspace_id}` === spaceId);
+                    if (!current) {
+                        watch.force = true;
+                        continue;
+                    }
+                    if (!force && watch.screens.get(p.terminalId) === text)
+                        continue;
+                    this.send(AgentMessageSchema.parse({
+                        type: "frame",
+                        ...watch.subscription,
+                        paneId: p.id,
+                        terminalId: p.terminalId,
+                        revision: ++watch.frameSequence,
+                        text,
+                        observedAt: new Date().toISOString(),
+                    }));
+                    watch.screens.set(p.terminalId, text);
+                }
+                for (const key of watch.screens.keys())
+                    if (!panes.some((p) => p.terminalId === key))
+                        watch.screens.delete(key);
+                await delay(350, undefined, { signal });
+            }
+        }
+        catch {
+            if (!signal.aborted)
+                this.send({ type: "unavailable", ...watch.subscription });
+        }
+        finally {
+            watch.abort.abort();
+            if (this.watches.get(spaceId) === watch)
+                this.watches.delete(spaceId);
+        }
+    }
+    close() {
+        for (const watch of this.watches.values())
+            watch.abort.abort();
+        this.watches.clear();
+    }
+}
+export async function realtimeWatch(config, signal) {
+    const url = new URL("/api/v1/realtime-agent", checkUrl(config.url));
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    let retry = 1000;
+    while (!signal.aborted) {
+        let authFailure = false;
+        await new Promise((resolve) => {
+            const ws = new WebSocket(url, {
+                headers: {
+                    Authorization: `Bearer ${config.token}`,
+                    "X-Eagle-Machine": config.machineId,
+                },
+                handshakeTimeout: 10000,
+                maxPayload: 262144,
+                followRedirects: false,
+            });
+            const bridge = new LiveBridge([config.token], (message) => {
+                if (ws.readyState !== WebSocket.OPEN)
+                    return;
+                if (ws.bufferedAmount > 524288) {
+                    bridge.close();
+                    ws.terminate();
+                    return;
+                }
+                ws.send(JSON.stringify(message));
+            }, async (session, watchSignal) => {
+                const { stdout } = await promisify(execFile)("herdr", ["session", "list", "--json"], { timeout: 8000, maxBuffer: 1048576, signal: watchSignal });
+                const found = JSON.parse(stdout).sessions.find((s) => s.name === session && s.running);
+                if (!found?.socket_path)
+                    throw new Error("Session unavailable");
+                return found.socket_path;
+            });
+            let lastMessage = Date.now();
+            const heartbeat = setInterval(() => {
+                if (Date.now() - lastMessage > 30000) {
+                    bridge.close();
+                    ws.terminate();
+                }
+                else if (ws.readyState === WebSocket.OPEN)
+                    ws.send(JSON.stringify({ type: "ping" }));
+            }, 10000);
+            const stop = () => {
+                bridge.close();
+                ws.terminate();
+            };
+            signal.addEventListener("abort", stop, { once: true });
+            ws.on("open", () => {
+                ws.send(JSON.stringify({ type: "ping" }));
+                retry = 1000;
+                console.log(JSON.stringify({ event: "realtime_connected" }));
+            });
+            ws.on("message", (data) => {
+                lastMessage = Date.now();
+                try {
+                    bridge.receive(JSON.parse(String(data)));
+                }
+                catch {
+                    bridge.close();
+                    ws.terminate();
+                }
+            });
+            ws.on("unexpected-response", (_request, response) => {
+                bridge.close();
+                authFailure = [401, 403].includes(response.statusCode ?? 0);
+                response.destroy();
+                ws.terminate();
+            });
+            ws.on("error", () => { });
+            ws.on("close", () => {
+                clearInterval(heartbeat);
+                signal.removeEventListener("abort", stop);
+                bridge.close();
+                resolve();
+            });
+        });
+        if (authFailure)
+            throw new Error("Realtime authentication rejected; fix secure configuration");
+        if (!signal.aborted) {
+            await delay(retry, undefined, { signal }).catch(() => { });
+            retry = Math.min(retry * 2, 30000);
+        }
+    }
+}

package/dist/agent/terminal-input.js

@@ -0,0 +1,210 @@
+import { createConnection } from "node:net";
+import { dirname, join, parse } from "node:path";
+// Herdr 0.9.1 protocol 22: bincode standard, prefixed by a u32 LE length.
+// Only strict AttachTerminal is used. ControlTerminal can fall back to a pane/name.
+const integer = (n) => {
+    if (!Number.isSafeInteger(n) || n < 0 || n > 0xffffffff)
+        throw new Error("Invalid integer");
+    if (n < 251)
+        return Buffer.from([n]);
+    const b = Buffer.alloc(n <= 65535 ? 3 : 5);
+    b[0] = b.length === 3 ? 251 : 252;
+    if (b.length === 3)
+        b.writeUInt16LE(n, 1);
+    else
+        b.writeUInt32LE(n, 1);
+    return b;
+};
+const vector = (value) => {
+    const b = Buffer.from(value);
+    return Buffer.concat([integer(b.length), b]);
+};
+const frame = (...parts) => {
+    const b = Buffer.concat(parts);
+    const prefix = Buffer.alloc(4);
+    prefix.writeUInt32LE(b.length);
+    return Buffer.concat([prefix, b]);
+};
+class Reader {
+    at = 0;
+    data;
+    constructor(data) {
+        this.data = data;
+    }
+    number() {
+        const tag = this.data.readUInt8(this.at++);
+        if (tag < 251)
+            return tag;
+        const size = tag === 251 ? 2 : tag === 252 ? 4 : tag === 253 ? 8 : 0;
+        if (!size)
+            throw new Error("Invalid varint");
+        const n = size === 8
+            ? Number(this.data.readBigUInt64LE(this.at))
+            : this.data.readUIntLE(this.at, size);
+        this.at += size;
+        if (!Number.isSafeInteger(n))
+            throw new Error("Integer overflow");
+        return n;
+    }
+    bytes() {
+        const length = this.number();
+        if (length > this.data.length - this.at)
+            throw new Error("Invalid vector");
+        const b = this.data.subarray(this.at, this.at + length);
+        this.at += length;
+        return b;
+    }
+    done() {
+        if (this.at !== this.data.length)
+            throw new Error("Unexpected payload");
+    }
+}
+const basic = {
+    enter: [13, "\r"],
+    esc: [27, "\x1b"],
+    tab: [9, "\t"],
+    "shift+tab": [9, "\x1b[Z"],
+    backspace: [127, "\x7f"],
+    "ctrl+c": [99, "\x03"],
+    "ctrl+d": [100, "\x04"],
+    "ctrl+l": [108, "\x0c"],
+};
+function keyBytes(key, flags, modify) {
+    const [code, legacy] = basic[key];
+    const modifier = key.startsWith("ctrl+") ? 5 : key === "shift+tab" ? 2 : 1;
+    if (modify > 2)
+        throw new Error("Unsupported keyboard mode");
+    if (flags && (flags & 8 || modifier !== 1 || key === "esc")) {
+        const press = `\x1b[${code};${modifier}${flags & 2 ? ":1" : ""}u`;
+        const release = flags & 2 && (flags & 8 || key !== "shift+tab")
+            ? `\x1b[${code};${modifier}:3u`
+            : "";
+        return press + release;
+    }
+    return modify === 2 && modifier !== 1
+        ? `\x1b[27;${modifier};${code}~`
+        : legacy;
+}
+export async function submitTerminalInput(apiPath, input, size, signal, validate) {
+    if (signal.aborted ||
+        [...input.text].some((c) => (c.charCodeAt(0) < 32 && c !== "\n" && c !== "\t") ||
+            c.charCodeAt(0) === 127) ||
+        ![size.width, size.height].every((n) => Number.isInteger(n) && n > 0 && n <= 65535))
+        return "rejected";
+    return new Promise((resolve) => {
+        const socket = createConnection(join(dirname(apiPath), `${parse(apiPath).name}-client.sock`));
+        let bytes = Buffer.alloc(0), received = 0, welcomed = false, screen = false, sent = false, checking = false, settled = false;
+        let keyboard;
+        const finish = (status = sent ? "unknown" : "rejected") => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            socket.destroy();
+            resolve(status);
+        };
+        const abort = () => finish();
+        const timer = setTimeout(abort, 5000);
+        signal.addEventListener("abort", abort, { once: true });
+        const send = async () => {
+            if (!screen || !keyboard || checking || settled)
+                return;
+            checking = true;
+            try {
+                if (!(await validate()) || signal.aborted || settled) {
+                    finish();
+                    return;
+                }
+                const mode = keyboard;
+                const keys = input.keys.map((key) => keyBytes(key, mode.flags, mode.modify));
+                const messages = [];
+                // Complete paste in its own Input: Herdr applies the runtime's paste mode.
+                if (input.text)
+                    messages.push(frame(integer(1), vector(`\x1b[200~${input.text}\x1b[201~`)));
+                for (const key of keys)
+                    messages.push(frame(integer(1), vector(key)));
+                messages.push(frame(integer(4)));
+                sent = true;
+                socket.write(Buffer.concat(messages));
+            }
+            catch {
+                finish();
+            }
+        };
+        socket.on("error", abort);
+        socket.on("end", abort);
+        socket.on("close", abort);
+        socket.on("connect", () => {
+            if (signal.aborted) {
+                finish();
+                return;
+            }
+            socket.write(frame(integer(0), integer(22), integer(size.width), integer(size.height), integer(0), integer(0), integer(0)));
+        });
+        socket.on("data", (chunk) => {
+            received += chunk.length;
+            if (received > 8 * 1024 * 1024) {
+                finish();
+                return;
+            }
+            bytes = Buffer.concat([bytes, Buffer.from(chunk)]);
+            try {
+                while (bytes.length >= 4 && !settled) {
+                    const length = bytes.readUInt32LE();
+                    if (length === 0 || length > 2 * 1024 * 1024)
+                        throw new Error("Invalid frame size");
+                    if (bytes.length < length + 4)
+                        break;
+                    const reader = new Reader(bytes.subarray(4, length + 4));
+                    bytes = bytes.subarray(length + 4);
+                    const type = reader.number();
+                    if (!welcomed) {
+                        if (type !== 0 ||
+                            reader.number() !== 22 ||
+                            reader.number() !== 1 ||
+                            reader.number() !== 0)
+                            throw new Error("Unsupported handshake");
+                        reader.done();
+                        welcomed = true;
+                        socket.write(frame(integer(5), vector(input.terminalId), integer(0)));
+                    }
+                    else if (type === 1) {
+                        reader.number();
+                        const columns = reader.number(), rows = reader.number();
+                        if (columns < 1 || rows < 1 || columns > 65535 || rows > 65535)
+                            throw new Error("Invalid screen size");
+                        const full = reader.number();
+                        if (full > 1)
+                            throw new Error("Invalid full-frame flag");
+                        reader.bytes();
+                        reader.done();
+                        if (full === 1)
+                            screen = true;
+                        void send();
+                    }
+                    else if (type === 16) {
+                        const flags = reader.number(), modify = reader.number();
+                        reader.done();
+                        if (flags > 31)
+                            throw new Error("Unsupported keyboard mode");
+                        keyboard = { flags, modify };
+                        void send();
+                    }
+                    else if (type === 3) {
+                        const option = reader.number();
+                        if (option > 1)
+                            throw new Error("Invalid option");
+                        const reason = option === 1 ? reader.bytes().toString() : "";
+                        reader.done();
+                        finish(sent && reason === "detached" ? "submitted" : undefined);
+                    }
+                    // Graphics/notifications are discarded locally, never logged or forwarded.
+                }
+            }
+            catch {
+                finish();
+            }
+        });
+    });
+}

package/dist/agent/version.js

@@ -1 +1,2 @@
-export const AGENT_VERSION = "0.3.0";
+import pkg from "../package.json" with { type: "json" };
+export const AGENT_VERSION = pkg.version;

package/dist/package.json

@@ -0,0 +1,50 @@
+{
+    "name": "eagle",
+    "version": "0.5.0",
+    "private": true,
+    "type": "module",
+    "scripts": {
+        "dev": "vite --host 127.0.0.1 --port 7053 --strictPort",
+        "dev:api": "wrangler dev --port 37053 --inspector-port 38053",
+        "build": "vite build",
+        "typecheck": "tsc --noEmit",
+        "lint": "biome check .",
+        "format": "biome check --write .",
+        "test": "node --test tests/*.test.ts",
+        "test:browser": "playwright test",
+        "check": "npm run test && npm run typecheck && npm run lint && npm run build",
+        "deploy": "node scripts/deploy.ts",
+        "agent": "node agent/cli.ts",
+        "db:local": "wrangler d1 migrations apply eagle --local",
+        "db:remote": "wrangler d1 migrations apply eagle --remote"
+    },
+    "dependencies": {
+        "@ai-sdk/anthropic": "^4.0.58",
+        "@ai-sdk/openai": "^4.0.71",
+        "@nocoo/basalt": "2.1.8",
+        "@nocoo/next-ai": "^0.4.0",
+        "ai": "^7.0.107",
+        "jose": "^6.2.12",
+        "lucide-react": "^1.34.0",
+        "react": "^19.2.8",
+        "react-dom": "^19.2.8",
+        "recharts": "^3.10.1",
+        "ws": "^8.21.3",
+        "zod": "^4.1.0"
+    },
+    "devDependencies": {
+        "@biomejs/biome": "2.5.10",
+        "@playwright/test": "^1.62.1",
+        "@tailwindcss/vite": "^4.3.3",
+        "@types/node": "^25.0.0",
+        "@types/react": "^19.2.18",
+        "@types/react-dom": "^19.2.5",
+        "@types/ws": "^8.18.1",
+        "@vitejs/plugin-react": "^6.1.0",
+        "miniflare": "5.20260918.0-alpha",
+        "tailwindcss": "^4.3.3",
+        "typescript": "7.0.2",
+        "vite": "^8.2.2",
+        "wrangler": "4.135.0"
+    }
+}