@nocoo/eagle-agent 0.6.0 → 0.7.0

package/README.md

@@ -6,16 +6,16 @@ Read-only Herdr inventory, task evidence, machine resources and named TCP port c
 
 Check `node --version`, `npm --version` and `herdr --version` first. Install Node.js 24+ from https://nodejs.org/en/download if needed, and have Herdr installed and running. No Eagle repository checkout, TypeScript compiler or npm login is required to install this public package.
 
-Install Agent v0.6.0 from npm. The Agent and Eagle website share the same release version:
+Install Agent v0.7.0 from npm. The Agent and Eagle website share the same release version:
 
 ```sh
-npm install -g @nocoo/eagle-agent@0.6.0 --registry=https://registry.npmjs.org
+npm install -g @nocoo/eagle-agent@0.7.0 --registry=https://registry.npmjs.org
 ```
 
 **If npm downloads time out, use the Tencent Cloud mirror / 下载超时时首选腾讯云镜像：**
 
 ```sh
-npm install -g @nocoo/eagle-agent@0.6.0 --registry=https://mirrors.cloud.tencent.com/npm/
+npm install -g @nocoo/eagle-agent@0.7.0 --registry=https://mirrors.cloud.tencent.com/npm/
 ```
 
 `--registry` applies only to this installation; it does not change your global npm configuration. Mirrors may lag (`404` / `ETARGET`); retry later or use the official registry when reachable. Keep the pinned version, HTTPS and certificate verification. Eagle credentials are unrelated to npm and must never be sent to a registry.
@@ -23,7 +23,7 @@ npm install -g @nocoo/eagle-agent@0.6.0 --registry=https://mirrors.cloud.tencent
 Verify the installation before configuring the agent:
 
 ```sh
-eagle-agent --version # expected: 0.6.0
+eagle-agent --version # expected: 0.7.0
 eagle-agent --help
 ```
 
@@ -31,6 +31,14 @@ If the command is missing, ensure npm's global `bin` directory is on your PATH.
 
 ## Connect a machine
 
+When an Agent is already configured, check the service's `EAGLE_CONFIG`, machine
+ID **and URL origin** first. Only a matching ID and origin permits token-only
+rotation. Moving to another deployment requires a separate private config
+directory and explicit new `spoolDir`; preserve, but do not replay, the old queue,
+cache or Manager state. Verify the new destination before switching the service,
+and set its `EAGLE_CONFIG` explicitly. See `docs/AGENT.md` in the repository for
+the rotation/migration procedure. Do not overwrite a different machine identity.
+
 Open Eagle's **Connect** page, create a machine and copy its onboarding prompt. Give the prompt to the management agent on that machine. It contains a machine-scoped credential shown only once.
 
 Store configuration at `~/.config/eagle/agent.json` (directory 0700, file 0600). `EAGLE_CONFIG` selects another file. `eagle-agent init` reads JSON from stdin and creates this file securely; it refuses to overwrite an existing file. Never pass a token in command arguments, commit it, print it, or include it in reports. Rotation requires updating the token in the existing secure configuration.

package/dist/agent/realtime.js

@@ -5,6 +5,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { promisify } from "node:util";
 import WebSocket from "ws";
 import { AgentMessageSchema, BridgeMessageSchema, TopologySchema, } from "../src/shared/realtime.js";
+import { parseTerminalScreen, restyleRedactedText, } from "../src/shared/terminal.js";
 import { checkUrl, normalizeSnapshot, redact, } from "./collector.js";
 import { submitTerminalInput } from "./terminal-input.js";
 export function redactScreen(value, secrets) {
@@ -40,6 +41,44 @@ export function redactScreen(value, secrets) {
         .join("")
         .replace(/\*{8,}/g, "[REDACTED]");
 }
+export function terminalScreen(value, secrets) {
+    const parsed = parseTerminalScreen(value);
+    const redacted = redactScreen(parsed.text, secrets);
+    const text = redacted.slice(-32000);
+    // Rebuild runs from already redacted characters, copying only style metadata.
+    // The schema also enforces that joined runs equal the safe plain text.
+    const styled = restyleRedactedText(parsed.runs, redacted);
+    let skip = Math.max(0, redacted.length - 32000);
+    const runs = styled.flatMap((run) => {
+        const cut = Math.min(skip, run.text.length);
+        skip -= cut;
+        return cut === run.text.length
+            ? []
+            : [{ ...run, text: run.text.slice(cut) }];
+    });
+    // Keep the newest visible styles first; simplify older styling rather than
+    // dropping all colors because one screen exceeds the run/byte budget.
+    let keep = Math.min(runs.length, 512);
+    while (keep > 0) {
+        const bounded = keep === runs.length
+            ? runs
+            : [
+                {
+                    text: runs
+                        .slice(0, runs.length - keep + 1)
+                        .map((run) => run.text)
+                        .join(""),
+                },
+                ...runs.slice(runs.length - keep + 1),
+            ];
+        if (!bounded.some((run) => Object.keys(run).length > 1))
+            break;
+        if (new TextEncoder().encode(JSON.stringify(bounded)).length <= 64000)
+            return { text, runs: bounded };
+        keep = Math.floor(keep / 2);
+    }
+    return { text };
+}
 export function socketRequest(path, method, params, signal) {
     return new Promise((resolve, reject) => {
         if (signal.aborted) {
@@ -95,6 +134,7 @@ export function socketRequest(path, method, params, signal) {
     });
 }
 export class LiveBridge {
+    styledFrames = false;
     watches = new Map();
     secrets;
     send;
@@ -110,6 +150,7 @@ export class LiveBridge {
             throw new Error("Invalid relay message");
         const message = parsed.data;
         if (message.type === "subscriptions") {
+            this.styledFrames = message.format === "styled-text-v1";
             const wanted = new Map(message.spaces.map((s) => [s.spaceId, s]));
             for (const [key, watch] of this.watches)
                 if (wanted.get(key)?.subscriptionId !== watch.subscription.subscriptionId) {
@@ -232,8 +273,8 @@ export class LiveBridge {
                         const result = await socketRequest(watch.path ?? "", "pane.read", {
                             pane_id: p.id,
                             source: "visible",
-                            format: "text",
-                            strip_ansi: true,
+                            format: "ansi",
+                            strip_ansi: false,
                         }, signal);
                         const read = result.read;
                         const original = raw.panes.find((r) => r.pane_id === p.id);
@@ -243,14 +284,14 @@ export class LiveBridge {
                             return;
                         pending.push({
                             pane: p,
-                            text: redactScreen(read.text, this.secrets).slice(-32000),
+                            screen: terminalScreen(read.text, this.secrets),
                             tab: read.tab_id,
                         });
                     }));
                 const after = (await socketRequest(watch.path, "session.snapshot", {}, signal)).snapshot;
                 if (signal.aborted)
                     return;
-                for (const { pane: p, text, tab } of pending) {
+                for (const { pane: p, screen, tab } of pending) {
                     const current = after.panes.find((r) => r.pane_id === p.id &&
                         r.terminal_id === p.terminalId &&
                         r.tab_id === tab &&
@@ -259,7 +300,8 @@ export class LiveBridge {
                         watch.force = true;
                         continue;
                     }
-                    if (!force && watch.screens.get(p.terminalId) === text)
+                    const fingerprint = JSON.stringify(screen);
+                    if (!force && watch.screens.get(p.terminalId) === fingerprint)
                         continue;
                     this.send(AgentMessageSchema.parse({
                         type: "frame",
@@ -267,10 +309,10 @@ export class LiveBridge {
                         paneId: p.id,
                         terminalId: p.terminalId,
                         revision: ++watch.frameSequence,
-                        text,
+                        ...(this.styledFrames ? screen : { text: screen.text }),
                         observedAt: new Date().toISOString(),
                     }));
-                    watch.screens.set(p.terminalId, text);
+                    watch.screens.set(p.terminalId, fingerprint);
                 }
                 for (const key of watch.screens.keys())
                     if (!panes.some((p) => p.terminalId === key))
@@ -305,6 +347,7 @@ export async function realtimeWatch(config, signal) {
                 headers: {
                     Authorization: `Bearer ${config.token}`,
                     "X-Eagle-Machine": config.machineId,
+                    "X-Eagle-Realtime-Format": "styled-text-v1",
                 },
                 handshakeTimeout: 10000,
                 maxPayload: 262144,

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "eagle",
-    "version": "0.6.0",
+    "version": "0.7.0",
     "private": true,
     "type": "module",
     "scripts": {

package/dist/src/shared/realtime.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { TerminalRunSchema } from "./terminal.js";
 const id = z.string().min(1).max(160);
 export const SubscriptionSchema = z.strictObject({
     spaceId: id,
@@ -62,10 +63,13 @@ export const FrameSchema = SubscriptionSchema.extend({
     terminalId: id,
     revision: z.number().int().nonnegative(),
     text: z.string().max(32000),
+    runs: z.array(TerminalRunSchema).max(512).optional(),
     observedAt: z.string().datetime(),
     deliveryId: z.number().int().positive().optional(),
     deliveryBytes: z.number().int().positive().optional(),
-});
+}).refine((v) => !v.runs ||
+    (v.runs.map((r) => r.text).join("") === v.text &&
+        new TextEncoder().encode(JSON.stringify(v.runs)).length <= 64000), "Styled runs must match the redacted text and stay within the transport budget");
 export const AckSchema = z.strictObject({
     type: z.literal("ack"),
     clientId: id,
@@ -83,6 +87,7 @@ export const BridgeMessageSchema = z.union([
     z.strictObject({
         type: z.literal("subscriptions"),
         spaces: z.array(SubscriptionSchema).max(4),
+        format: z.literal("styled-text-v1").optional(),
     }),
     InputSchema.safeExtend({ ...SubscriptionSchema.shape, clientId: id }),
     z.strictObject({ type: z.literal("pong") }),

package/dist/src/shared/terminal.js

@@ -0,0 +1,193 @@
+import { z } from "zod";
+const channel = z.number().int().min(0).max(255);
+export const TerminalColorSchema = z.union([
+    channel,
+    z.tuple([channel, channel, channel]),
+]);
+export const TerminalRunSchema = z.strictObject({
+    text: z.string().min(1).max(32000),
+    fg: TerminalColorSchema.optional(),
+    bg: TerminalColorSchema.optional(),
+    bold: z.literal(true).optional(),
+    dim: z.literal(true).optional(),
+    italic: z.literal(true).optional(),
+    underline: z.literal(true).optional(),
+    inverse: z.literal(true).optional(),
+});
+/** Reuse styles only. Every emitted character comes from the redacted string. */
+export function restyleRedactedText(original, redacted) {
+    let boundary = 0;
+    const source = original.map((run) => {
+        const start = boundary;
+        boundary += run.text.length;
+        const { text: _text, ...style } = run;
+        return { start, end: boundary, style };
+    });
+    const plain = original.map((run) => run.text).join("");
+    const output = [];
+    let cursor = 0, runIndex = 0;
+    const append = (text, style = {}) => {
+        if (!text)
+            return;
+        const previous = output.at(-1);
+        const { text: _text, ...previousStyle } = previous ?? { text: "" };
+        if (previous && JSON.stringify(previousStyle) === JSON.stringify(style))
+            previous.text += text;
+        else
+            output.push({ ...style, text });
+    };
+    if (plain === redacted) {
+        for (let i = 0; i < original.length; i++)
+            append(original[i].text, source[i].style);
+        return output;
+    }
+    // Replacement markers have neutral styling. Exact surviving segments may
+    // borrow source styling, but never source text (even for ambiguous matches).
+    for (const part of redacted.split(/(\[REDACTED(?: KEY)?\]|\*+)/g)) {
+        if (!part)
+            continue;
+        if (/^(?:\[REDACTED(?: KEY)?\]|\*+)$/.test(part)) {
+            append(part);
+            continue;
+        }
+        const start = plain.indexOf(part, cursor);
+        if (start < 0) {
+            append(part);
+            continue;
+        }
+        let at = start;
+        const end = start + part.length;
+        while (at < end) {
+            while (runIndex < source.length && source[runIndex].end <= at)
+                runIndex++;
+            const run = source[runIndex];
+            const next = Math.min(end, run?.end ?? end);
+            append(part.slice(at - start, next - start), run?.style);
+            at = next;
+        }
+        cursor = end;
+    }
+    return output;
+}
+/** Parse styling only: OSC, cursor commands and all executable controls are discarded. */
+export function parseTerminalScreen(value) {
+    let style = {};
+    let hidden = false;
+    const runs = [];
+    const append = (text) => {
+        const clean = text.replace(
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: Remove terminal control bytes, preserving tabs and line breaks.
+        /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
+        if (clean)
+            runs.push({
+                ...style,
+                text: hidden ? clean.replace(/[^\n\t]/g, "•") : clean,
+            });
+    };
+    // Unterminated OSC/DCS strings are discarded through the end, never rendered as links/HTML.
+    const escapes = 
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Recognize ANSI escapes in untrusted terminal text.
+    /\u001b(?:\][\s\S]*?(?:\u0007|\u001b\\|$)|[PX^_][\s\S]*?(?:\u001b\\|$)|\[[0-?]*[ -/]*[@-~]|[ -/]*[@-~]|$)/g;
+    let offset = 0;
+    for (const match of value.matchAll(escapes)) {
+        append(value.slice(offset, match.index));
+        offset = match.index + match[0].length;
+        const code = match[0];
+        if (!code.startsWith("\u001b[") || !code.endsWith("m"))
+            continue;
+        const raw = code.slice(2, -1);
+        if (!/^[\d;]*$/.test(raw))
+            continue;
+        const params = raw.split(";").map(Number);
+        for (let i = 0; i < params.length; i++) {
+            const p = params[i];
+            if (p === 0) {
+                style = {};
+                hidden = false;
+            }
+            else if (p === 1)
+                style.bold = true;
+            else if (p === 2)
+                style.dim = true;
+            else if (p === 3)
+                style.italic = true;
+            else if (p === 4)
+                style.underline = true;
+            else if (p === 7)
+                style.inverse = true;
+            else if (p === 8)
+                hidden = true;
+            else if (p === 22) {
+                delete style.bold;
+                delete style.dim;
+            }
+            else if (p === 23)
+                delete style.italic;
+            else if (p === 24)
+                delete style.underline;
+            else if (p === 27)
+                delete style.inverse;
+            else if (p === 28)
+                hidden = false;
+            else if (p === 39)
+                delete style.fg;
+            else if (p === 49)
+                delete style.bg;
+            else if (p >= 30 && p <= 37)
+                style.fg = p - 30;
+            else if (p >= 90 && p <= 97)
+                style.fg = p - 90 + 8;
+            else if (p >= 40 && p <= 47)
+                style.bg = p - 40;
+            else if (p >= 100 && p <= 107)
+                style.bg = p - 100 + 8;
+            else if (p === 38 || p === 48) {
+                const field = p === 38 ? "fg" : "bg";
+                const mode = params[++i];
+                const size = mode === 5 ? 1 : mode === 2 ? 3 : 0;
+                const values = params.slice(i + 1, i + 1 + size);
+                if (size &&
+                    values.length === size &&
+                    values.every((v) => v >= 0 && v <= 255))
+                    style[field] =
+                        size === 1 ? values[0] : values;
+                i += size;
+            }
+        }
+    }
+    append(value.slice(offset));
+    return { text: runs.map((r) => r.text).join(""), runs };
+}
+/** Standard terminal palette; only validated integers can reach CSS. */
+export function terminalColor(color) {
+    if (color === undefined)
+        return undefined;
+    if (Array.isArray(color))
+        return `rgb(${color.join(", ")})`;
+    const basic = [
+        "#000000",
+        "#cd3131",
+        "#0dbc79",
+        "#e5e510",
+        "#2472c8",
+        "#bc3fbc",
+        "#11a8cd",
+        "#e5e5e5",
+        "#666666",
+        "#f14c4c",
+        "#23d18b",
+        "#f5f543",
+        "#3b8eea",
+        "#d670d6",
+        "#29b8db",
+        "#ffffff",
+    ];
+    if (color < 16)
+        return `var(--terminal-color-${color}, ${basic[color]})`;
+    if (color >= 232)
+        return `rgb(${Array(3)
+            .fill(8 + (color - 232) * 10)
+            .join(", ")})`;
+    const n = color - 16, levels = [0, 95, 135, 175, 215, 255];
+    return `rgb(${[levels[Math.floor(n / 36)], levels[Math.floor(n / 6) % 6], levels[n % 6]].join(", ")})`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocoo/eagle-agent",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Report all local Herdr spaces and machine resources to Eagle",
   "type": "module",
   "license": "UNLICENSED",