@nordbyte/nordrelay 0.4.0 → 0.4.1

package/README.md

@@ -46,6 +46,7 @@ Adapter architecture:
 - `/channels` shows available and planned messaging adapters for Discord, WhatsApp, Slack, and Matrix.
 - Codex, Pi, Hermes, OpenClaw, and Claude Code are implemented as agent adapters.
 - `/agents` shows available/planned agent adapters and whether Codex, Pi, Hermes, OpenClaw, and Claude Code are enabled.
+- Shared command-action renderers keep channel-neutral responses for adapter lists, queues, artifacts, logs, and update jobs separate from Telegram-specific keyboards and delivery.
 
 Codex runtime:
 
@@ -178,15 +179,16 @@ Operations:
 
 - Plugin command/skill starts, stops, restarts, and inspects the connector process.
 - Manual process commands support `start`, `stop`, `restart`, `status`, and `foreground`.
-- Telegram admin commands support `/logs`, `/diagnostics`, `/restart`, and `/update`.
+- Telegram admin commands support `/logs`, `/diagnostics`, `/restart`, and `/update` for NordRelay and agent CLIs.
 - `/update` detects the install type: npm installs update with `npm install -g @nordbyte/nordrelay@latest`; source checkouts pull `origin/main`, install dependencies, run check, tests, and build, then restart.
-- `/logs` renders redacted connector and update logs with local-time timestamps, levels, file path, last-modified time, and highlighted warnings/errors.
+- `/update agents`, `/update <agent>`, `/update jobs`, `/update log <id>`, `/update cancel <id>`, and `/update input <id> <text>` manage Codex, Pi, Hermes, OpenClaw, and Claude Code updater jobs from Telegram.
+- `/logs` renders redacted connector, NordRelay update, and agent update logs with local-time timestamps, levels, file path, last-modified time, and highlighted warnings/errors.
 - Logs can be emitted as timestamped plain text or JSON records with `CONNECTOR_LOG_FORMAT`.
 - Telegram sends/edits/documents are routed through a rate-limit queue that honors Telegram retry-after responses.
 - Context metadata, queues, and preferences are written atomically with backup recovery.
 - Context metadata, queues, preferences, audit events, and locks can use JSON files or the optional SQLite state backend with `NORDRELAY_STATE_BACKEND=sqlite`.
 - Runtime config, state, and logs are written under `~/.nordrelay/`.
-- `nordrelay init` creates a private runtime config, `nordrelay doctor` validates host prerequisites, and `nordrelay web` starts a full local WebUI dashboard.
+- `nordrelay init` creates a private runtime config, `nordrelay doctor` validates host prerequisites, and `nordrelay web` starts the connector plus a full local WebUI dashboard.
 - The WebUI has responsive header/sidebar/footer navigation, live chat streaming, session controls, queue/artifact/log/diagnostic views, and settings management.
 - The WebUI supports light and dark themes, tabbed settings groups, paginated session browsing, and chat uploads for images, documents, and audio transcription.
 - The WebUI exposes REST and SSE endpoints for chat streaming, sessions, settings, queue, artifacts, logs, health, and diagnostics.
@@ -270,6 +272,7 @@ Codex authentication:
 Pi setup:
 
 - Install Pi from https://pi.dev/ and confirm `pi --help` works on the host.
+- npm installs should use the current package name: `npm install -g @earendil-works/pi-coding-agent`.
 - Set `NORDRELAY_PI_ENABLED=true` in `~/.nordrelay/nordrelay.env`.
 - Keep `NORDRELAY_DEFAULT_AGENT=codex` to start chats in Codex, or set `NORDRELAY_DEFAULT_AGENT=pi` to start chats in Pi.
 - Optional: set `PI_SESSION_DIR` if your Pi sessions are not stored in `~/.pi/agent/sessions/`.
@@ -374,6 +377,7 @@ Runtime files:
 - Log file: `~/.nordrelay/nordrelay.log`
 - Home override: `NORDRELAY_HOME=/custom/path`
 - Local dashboard: `nordrelay web --host 127.0.0.1 --port 31878`
+- `nordrelay start` and `nordrelay status` print the configured WebUI URL.
 
 ## WebUI Dashboard
 
@@ -383,6 +387,8 @@ Start the local WebUI:
 nordrelay web
 ```
 
+If the connector is not already running, `nordrelay web` starts it automatically before binding the dashboard.
+
 Open:
 
 ```text
@@ -403,7 +409,10 @@ The dashboard is a second NordRelay client next to Telegram. It can:
 - Browse, preview, download, ZIP, and delete artifacts.
 - Inspect the activity timeline for WebUI and mirrored CLI turns.
 - Edit all supported runtime settings from tabbed Settings groups with option selects, validation feedback, and restart actions.
-- View filtered logs, structured diagnostics, enabled channels, and agent adapters.
+- View filtered connector/update/agent-update logs, structured diagnostics, enabled channels, and agent adapters.
+- Inspect a per-agent capability matrix showing model, reasoning, launch, fast mode, attachments, activity, usage, auth, login/logout, and handback support.
+- Check NordRelay and agent CLI versions, then start Codex, Pi, Hermes, OpenClaw, or Claude Code updates from outdated version rows with live output, cancel, full-log, and stdin response controls for interactive updaters.
+- Load dashboard CSS and client JavaScript as authenticated static assets instead of inline HTML, keeping the server shell, style, and browser client modules separate.
 
 Dashboard API endpoints are served under `/api/*`. Streaming uses `GET /api/events`.
 
@@ -492,10 +501,12 @@ Run NordRelay behind your reverse proxy so the public URL forwards to `http://12
 - `/version` reports connector, Codex CLI, Pi CLI, Hermes CLI, OpenClaw CLI, and Claude Code CLI paths plus installed/latest NordRelay, Codex, Pi, Hermes, OpenClaw, and Claude Code versions with status icons.
 - `/logs [lines]` shows a redacted, timestamped connector log tail. Admin only.
 - `/logs update [lines]` shows the self-update log. Admin only.
-- `/logs all [lines]` shows connector and self-update logs together. Admin only.
+- `/logs agent [lines]` shows the aggregate agent updater log. Admin only.
+- `/logs all [lines]` shows connector, self-update, and agent update logs together. Admin only.
 - `/diagnostics` shows redacted connector diagnostics. Admin only.
 - `/restart` restarts the connector process. Admin only.
 - `/update` updates through npm or git depending on the detected install type, then restarts only on success. Admin only.
+- `/update agents`, `/update <agent>`, `/update jobs`, `/update log <id>`, `/update cancel <id>`, and `/update input <id> <text>` manage agent CLI update jobs. Admin only.
 
 ## Command Examples
 
@@ -820,6 +831,7 @@ NordRelay wrapper:
 - `NORDRELAY_HOME`: config/state/log directory override. Defaults to `~/.nordrelay`.
 - `NORDRELAY_SOURCE_ROOT`: runtime source root override. Useful when the plugin is launched from Codex cache.
 - `NORDRELAY_UPDATE_METHOD`: optional `auto`, `npm`, or `git` self-update method override. Auto uses git when the runtime root has a `.git` directory and npm otherwise.
+- Agent updates from the dashboard and Telegram use each agent's native updater where possible: `codex update`, `pi update pi`, `hermes update --yes`, `openclaw update --yes`, and `claude update`.
 - `NORDRELAY_KEEP_PENDING_UPDATES`: set true to avoid dropping pending Telegram updates on start.
 - `NORDRELAY_FORWARD_TOOL_OUTPUT`: backward-compatible alias that sets `TOOL_VERBOSITY=all` when `TOOL_VERBOSITY` is unset.
 - `NORDRELAY_STATE_FILE`: internal state-file path passed by the wrapper.

package/dist/access-control.js

@@ -114,6 +114,9 @@ export function permissionForCallbackData(callbackData) {
     if (/^(launch_|launchconfirm_|model_|effort_|agent_)/.test(callbackData)) {
         return "settings";
     }
+    if (callbackData.startsWith("upd_")) {
+        return "admin";
+    }
     if (callbackData.startsWith("approval_") || callbackData.startsWith("codex_abort:") || callbackData.startsWith("agent_abort:")) {
         return "prompt";
     }

package/dist/agent-feature-matrix.js

@@ -0,0 +1,42 @@
+import { escapeHTML } from "./format.js";
+export const AGENT_FEATURES = [
+    { key: "modelSelection", label: "Model", description: "Pick the model used for new turns or sessions." },
+    { key: "reasoningSelection", label: "Reasoning", description: "Pick thinking/reasoning effort where the agent exposes it." },
+    { key: "launchProfiles", label: "Launch profiles", description: "Switch sandbox/approval launch behavior for new sessions." },
+    { key: "fastMode", label: "Fast mode", description: "Toggle the agent-specific low-latency mode." },
+    { key: "workspaces", label: "Workspaces", description: "List and switch allowed workspaces." },
+    { key: "attachments", label: "Files/images", description: "Send files, photos, staged attachments, and voice transcripts." },
+    { key: "externalActivity", label: "External busy", description: "Detect active CLI turns started outside NordRelay." },
+    { key: "cliMirror", label: "CLI mirror", description: "Mirror CLI-started turns back to Telegram/WebUI." },
+    { key: "activityLog", label: "Activity", description: "Read activity timelines for sessions and turns." },
+    { key: "usageStats", label: "Usage stats", description: "Show token/context usage reported by the agent." },
+    { key: "subscriptionLimits", label: "Limits", description: "Show subscription/quota limits when the agent exposes them." },
+    { key: "auth", label: "Auth status", description: "Check whether the agent is authenticated." },
+    { key: "login", label: "Login", description: "Start an agent login flow from NordRelay." },
+    { key: "logout", label: "Logout", description: "Sign out of the agent from NordRelay." },
+    { key: "handback", label: "Handback", description: "Return a remote session to the native CLI." },
+];
+export function agentFeatureStates(capabilities) {
+    return AGENT_FEATURES.map((feature) => ({
+        ...feature,
+        supported: Boolean(capabilities[feature.key]),
+    }));
+}
+export function formatAgentFeatureSummaryPlain(capabilities) {
+    const states = agentFeatureStates(capabilities);
+    const supported = states.filter((feature) => feature.supported).map((feature) => feature.label);
+    const unsupported = states.filter((feature) => !feature.supported).map((feature) => feature.label);
+    return [
+        `Supported: ${supported.join(", ") || "-"}`,
+        `Not supported: ${unsupported.join(", ") || "-"}`,
+    ];
+}
+export function formatAgentFeatureSummaryHTML(capabilities) {
+    const states = agentFeatureStates(capabilities);
+    const supported = states.filter((feature) => feature.supported).map((feature) => feature.label);
+    const unsupported = states.filter((feature) => !feature.supported).map((feature) => feature.label);
+    return [
+        `<b>Supported:</b> ${escapeHTML(supported.join(", ") || "-")}`,
+        `<b>Not supported:</b> ${escapeHTML(unsupported.join(", ") || "-")}`,
+    ];
+}

package/dist/agent-updates.js

@@ -0,0 +1,294 @@
+import { spawn } from "node:child_process";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { agentLabel } from "./agent.js";
+import { resolveClaudeCodeCli } from "./claude-code-cli.js";
+import { resolveCodexCli } from "./codex-cli.js";
+import { resolveHermesCli } from "./hermes-cli.js";
+import { resolveOpenClawCli } from "./openclaw-cli.js";
+import { getAgentUpdateLogPath, getConnectorHome } from "./operations.js";
+import { resolvePiCli } from "./pi-cli.js";
+import { redactText } from "./redaction.js";
+export class AgentUpdateManager {
+    options;
+    jobs = new Map();
+    home;
+    manifestPath;
+    aggregateLogPath;
+    constructor(options = {}) {
+        this.options = options;
+        this.home = options.home ?? getConnectorHome();
+        this.manifestPath = path.join(this.home, "updates", "jobs.json");
+        this.aggregateLogPath = getAgentUpdateLogPath(this.home);
+        this.loadPersistedJobs();
+    }
+    list() {
+        return [...this.jobs.values()]
+            .sort((left, right) => right.startedAt.localeCompare(left.startedAt))
+            .map((job) => this.snapshot(job));
+    }
+    get(id) {
+        const job = this.jobs.get(id);
+        return job ? this.snapshot(job) : null;
+    }
+    readLog(id) {
+        const job = this.requireJob(id);
+        try {
+            return { job: this.snapshot(job), plain: redactText(readFileSync(job.logPath, "utf8")) };
+        }
+        catch (error) {
+            return {
+                job: this.snapshot(job),
+                plain: `Cannot read update log: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
+    start(agentId, context = {}) {
+        const running = [...this.jobs.values()].find((job) => job.agentId === agentId && job.status === "running");
+        if (running) {
+            throw new Error(`${agentLabel(agentId)} update is already running.`);
+        }
+        const plan = resolveAgentUpdatePlan(agentId, { ...context, env: context.env ?? this.options.env });
+        const now = new Date().toISOString();
+        const id = `${agentId.replace(/[^a-z0-9]/gi, "")}-${Date.now().toString(36)}`;
+        const logPath = path.join(this.home, "updates", `${id}.log`);
+        mkdirSync(path.dirname(logPath), { recursive: true });
+        const job = {
+            id,
+            agentId,
+            agentLabel: plan.agentLabel,
+            status: "running",
+            method: plan.method,
+            command: plan.command,
+            args: plan.args,
+            cwd: plan.cwd,
+            summary: plan.summary,
+            interactive: plan.interactive,
+            canInput: true,
+            needsInput: false,
+            startedAt: now,
+            updatedAt: now,
+            logPath,
+            ownerPid: process.pid,
+            output: "",
+            outputTail: "",
+        };
+        this.jobs.set(id, job);
+        this.persistJobs();
+        this.append(job, [
+            `[${now}] Starting ${job.agentLabel} update`,
+            `Method: ${job.method}`,
+            `Command: ${[job.command, ...job.args].join(" ")}`,
+            `Working directory: ${job.cwd}`,
+            "",
+        ].join("\n"));
+        const child = spawn(plan.command, plan.args, {
+            cwd: plan.cwd,
+            env: { ...process.env, ...(this.options.env ?? {}), ...(context.env ?? {}) },
+            shell: process.platform === "win32",
+            windowsHide: true,
+            stdio: "pipe",
+        });
+        job.child = child;
+        child.stdin.setDefaultEncoding("utf8");
+        child.stdout.on("data", (chunk) => this.append(job, chunk.toString("utf8")));
+        child.stderr.on("data", (chunk) => this.append(job, chunk.toString("utf8")));
+        child.on("error", (error) => {
+            this.finish(job, "failed", null, null, error.message);
+        });
+        child.on("close", (code, signal) => {
+            if (job.status !== "running") {
+                return;
+            }
+            this.finish(job, code === 0 ? "completed" : "failed", code, signal, code === 0 ? undefined : `Update exited with code ${code ?? "unknown"}`);
+        });
+        this.emit(job);
+        return this.snapshot(job);
+    }
+    sendInput(id, input) {
+        const job = this.requireJob(id);
+        if (job.status !== "running" || !job.child?.stdin.writable) {
+            throw new Error("Update job is not accepting input.");
+        }
+        const line = input.endsWith("\n") ? input : `${input}\n`;
+        job.child.stdin.write(line);
+        job.needsInput = false;
+        this.append(job, `[${new Date().toISOString()}] Input sent from dashboard.\n`);
+        return this.snapshot(job);
+    }
+    cancel(id) {
+        const job = this.requireJob(id);
+        if (job.status !== "running") {
+            return this.snapshot(job);
+        }
+        job.child?.kill("SIGTERM");
+        this.finish(job, "cancelled", null, "SIGTERM", "Cancelled from dashboard.");
+        return this.snapshot(job);
+    }
+    cancelAll() {
+        for (const job of this.jobs.values()) {
+            if (job.status === "running") {
+                job.child?.kill("SIGTERM");
+            }
+        }
+    }
+    requireJob(id) {
+        const job = this.jobs.get(id);
+        if (!job) {
+            throw new Error(`Unknown update job: ${id}`);
+        }
+        return job;
+    }
+    append(job, text) {
+        const redacted = redactText(text);
+        job.output += redacted;
+        if (job.output.length > 120_000) {
+            job.output = job.output.slice(-120_000);
+        }
+        job.outputTail = job.output.slice(-16_000);
+        job.updatedAt = new Date().toISOString();
+        job.needsInput = job.status === "running" && looksLikePrompt(job.outputTail);
+        writeFileSync(job.logPath, redacted, { flag: "a", encoding: "utf8" });
+        this.appendAggregate(job, redacted);
+        this.persistJobs();
+        this.emit(job);
+    }
+    finish(job, status, code, signal, error) {
+        job.status = status;
+        job.canInput = false;
+        job.needsInput = false;
+        job.exitCode = code;
+        job.signal = signal;
+        job.error = error ? redactText(error) : undefined;
+        job.finishedAt = new Date().toISOString();
+        job.updatedAt = job.finishedAt;
+        job.child = undefined;
+        this.append(job, `\n[${job.finishedAt}] ${job.agentLabel} update ${status}${error ? `: ${job.error}` : ""}\n`);
+    }
+    emit(job) {
+        this.options.onUpdate?.(this.snapshot(job));
+    }
+    snapshot(job) {
+        const { child: _child, output: _output, ...snapshot } = job;
+        return { ...snapshot };
+    }
+    loadPersistedJobs() {
+        if (!existsSync(this.manifestPath)) {
+            return;
+        }
+        try {
+            const parsed = JSON.parse(readFileSync(this.manifestPath, "utf8"));
+            let changed = false;
+            for (const snapshot of parsed) {
+                const staleRunning = snapshot.status === "running" && !isProcessRunning(snapshot.ownerPid);
+                if (staleRunning) {
+                    changed = true;
+                }
+                const job = {
+                    ...snapshot,
+                    status: staleRunning ? "failed" : snapshot.status,
+                    canInput: false,
+                    needsInput: false,
+                    error: staleRunning
+                        ? "Update process was still running when NordRelay restarted; inspect the agent update log before retrying."
+                        : snapshot.error,
+                    finishedAt: staleRunning ? new Date().toISOString() : snapshot.finishedAt,
+                    updatedAt: staleRunning ? new Date().toISOString() : snapshot.updatedAt,
+                    output: snapshot.outputTail ?? "",
+                    outputTail: snapshot.outputTail ?? "",
+                };
+                this.jobs.set(job.id, job);
+            }
+            if (changed) {
+                this.persistJobs();
+            }
+        }
+        catch {
+            this.jobs.clear();
+        }
+    }
+    persistJobs() {
+        mkdirSync(path.dirname(this.manifestPath), { recursive: true });
+        const snapshots = this.list().slice(0, 100);
+        writeFileSync(this.manifestPath, `${JSON.stringify(snapshots, null, 2)}\n`, "utf8");
+    }
+    appendAggregate(job, text) {
+        const lines = text.split(/\r?\n/).filter((line) => line.trim().length > 0);
+        if (lines.length === 0) {
+            return;
+        }
+        mkdirSync(path.dirname(this.aggregateLogPath), { recursive: true });
+        const now = new Date().toISOString();
+        const prefix = `[${now}] INFO [${job.id}]`;
+        appendFileSync(this.aggregateLogPath, `${lines.map((line) => `${prefix} ${line}`).join("\n")}\n`, "utf8");
+    }
+}
+function isProcessRunning(pid) {
+    if (!Number.isInteger(pid) || pid <= 0) {
+        return false;
+    }
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function resolveAgentUpdatePlan(agentId, context = {}) {
+    const env = context.env ?? process.env;
+    switch (agentId) {
+        case "codex": {
+            const cli = resolveCodexCli(env);
+            if (!cli.path) {
+                throw new Error("Codex CLI is not installed on PATH. Install or update it with npm i -g @openai/codex@latest.");
+            }
+            return plan(agentId, "codex update", cli.path, ["update"], "Runs the Codex CLI self-updater. If this install cannot self-update, use npm i -g @openai/codex@latest.", env);
+        }
+        case "pi": {
+            const cli = resolvePiCli(env, context.piCliPath);
+            if (!cli.path) {
+                throw new Error("Pi CLI is not installed on PATH. Install or update it with npm install -g @earendil-works/pi-coding-agent@latest.");
+            }
+            return plan(agentId, "pi update pi", cli.path, ["update", "pi"], "Updates only the Pi coding agent, not installed Pi extensions.", env);
+        }
+        case "hermes": {
+            const cli = resolveHermesCli(env, context.hermesCliPath);
+            if (!cli.path) {
+                throw new Error("Hermes CLI is not installed on PATH. Install Hermes with the official installer before updating.");
+            }
+            return plan(agentId, "hermes update --yes", cli.path, ["update", "--yes"], "Runs the Hermes git/dependency updater with confirmation prompts accepted where supported.", env);
+        }
+        case "openclaw": {
+            const cli = resolveOpenClawCli(env, context.openClawCliPath);
+            if (!cli.path) {
+                throw new Error("OpenClaw CLI is not installed on PATH. Install OpenClaw before updating.");
+            }
+            return plan(agentId, "openclaw update --yes", cli.path, ["update", "--yes"], "Runs the OpenClaw updater, which detects npm/git installs and may restart the Gateway.", env);
+        }
+        case "claude-code": {
+            const cli = resolveClaudeCodeCli(env, context.claudeCodeCliPath);
+            if (!cli.path) {
+                throw new Error("Claude Code host CLI is not installed on PATH. Bundled SDK updates arrive with NordRelay releases.");
+            }
+            return plan(agentId, "claude update", cli.path, ["update"], "Runs the Claude Code updater. Some package-manager installs may print a manual command instead.", env);
+        }
+    }
+}
+function plan(agentId, method, command, args, summary, env) {
+    return {
+        agentId,
+        agentLabel: agentLabel(agentId),
+        method,
+        command,
+        args,
+        cwd: env.HOME || os.homedir(),
+        summary,
+        interactive: true,
+    };
+}
+function looksLikePrompt(text) {
+    const tail = text.split(/\r?\n/).slice(-4).join("\n");
+    return /\b(y\/n|yes\/no|continue|proceed|confirm|password|passphrase|token|api key|enter|select)\b|[?>]\s*$/i.test(tail);
+}