@openagents-org/agent-launcher 0.2.143 → 0.2.146

package/src/paths.js

@@ -50,6 +50,12 @@ function getExtraBinDirs() {
   // Common: ~/.local/bin (pipx, user installs)
   _push(dirs, path.join(HOME, '.local', 'bin'));
 
+  // Aider (uv tool install) — its executable honors XDG_BIN_HOME /
+  // XDG_DATA_HOME/../bin / ~/.local/bin and also always lands in the uv tools
+  // venv. A GUI/daemon process won't see the installer's PATH edit, so add the
+  // real install dirs explicitly (filtered to existing dirs by the caller).
+  for (const d of aiderBinDirs()) _push(dirs, d);
+
   // Also add the directory containing the current node binary
   try {
     const nodeDir = path.dirname(process.execPath);
@@ -142,6 +148,14 @@ function whichBinary(name) {
     return cached.value;
   }
 
+  // On a non-English Windows the console OUTPUT codepage is OEM (e.g. 936/GBK on
+  // zh-CN), so `where` prints a path whose non-ASCII bytes don't match the utf-8
+  // decoding execSync does — a Chinese username comes back mangled (e.g.
+  // `C:\Users\??.?[\…`) and yields ENOENT downstream. We can't reliably re-encode
+  // it (and forcing `chcp` is unsafe under windowsHide's console-less cmd), so we
+  // existence-check every hit and only return one that's real; a mangled path
+  // fails and the caller falls through to its Node-derived tiers (built from
+  // process.env / os.homedir, which the OS hands us as correct UTF-16).
   const cmd = IS_WINDOWS ? `where ${name}` : `which ${name}`;
   try {
     const result = execSync(cmd, {
@@ -150,8 +164,12 @@ function whichBinary(name) {
       env: { ...process.env, PATH: getEnhancedPATH() },
       timeout: 5000,
       windowsHide: true,
-    }).trim();
-    const value = result.split(/\r?\n/)[0] || null;
+    });
+    let value = null;
+    for (const line of result.split(/\r?\n/)) {
+      const hit = line.trim();
+      if (hit && fs.existsSync(hit)) { value = hit; break; }
+    }
     whichBinaryCache.set(cacheKey, { value, at: Date.now() });
     return value;
   } catch {
@@ -160,6 +178,64 @@ function whichBinary(name) {
   }
 }
 
+/**
+ * Codepage-safe `where`/`which` lookup, shared by every CLI adapter.
+ *
+ * Hazard: on a non-English Windows the console output codepage is OEM (e.g.
+ * 936/GBK on zh-CN), so execSync decodes `where` stdout with the wrong codepage
+ * and mangles a non-ASCII (e.g. Chinese) username in the path — yielding ENOENT
+ * downstream (the `C:\Users\??.?[\…\claude.cmd` failure). Two safe defenses,
+ * no `chcp` (which is unreliable under windowsHide's console-less cmd):
+ *   1. (Windows) check the npm-global default `%APPDATA%\npm\<name>.cmd` FIRST.
+ *      APPDATA comes from the OS as UTF-16 via Node, so this path is always
+ *      correctly encoded — and it's where the npm-installed CLIs actually live.
+ *   2. Fall back to `where`/`which`, but existence-check every hit so a mangled
+ *      path is skipped and the caller drops to its own Node-derived tiers.
+ *
+ * @param {string|string[]} names  base name(s), e.g. 'claude' or ['cursor-agent','agent'].
+ *                                  On Windows each is tried as <name>.cmd, <name>.exe, <name>.
+ * @param {object} [env]           env for the lookup (defaults to getEnhancedEnv()).
+ * @returns {string|null}          an existing absolute path, or null.
+ */
+function whereBinary(names, env) {
+  const bases = Array.isArray(names) ? names : [names];
+
+  // 1. npm-global default, derived from Node's env (correct encoding even when
+  //    the username is non-ASCII). This is where `npm i -g <cli>` drops the shim.
+  if (IS_WINDOWS && process.env.APPDATA) {
+    for (const b of bases) {
+      const c = path.join(process.env.APPDATA, 'npm', `${b}.cmd`);
+      try { if (fs.existsSync(c)) return c; } catch {}
+    }
+  }
+
+  // 2. PATH lookup, existence-guarded.
+  let cmd;
+  if (IS_WINDOWS) {
+    const parts = [];
+    for (const b of bases) {
+      parts.push(`where ${b}.cmd 2>nul`, `where ${b}.exe 2>nul`, `where ${b} 2>nul`);
+    }
+    cmd = parts.join(' || ');
+  } else {
+    cmd = bases.map((b) => `which ${b}`).join(' || ');
+  }
+  try {
+    const out = execSync(cmd, {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 5000,
+      windowsHide: true,
+      env: env || getEnhancedEnv(),
+    });
+    for (const line of out.split(/\r?\n/)) {
+      const hit = line.trim();
+      if (hit && fs.existsSync(hit)) return hit;
+    }
+  } catch {}
+  return null;
+}
+
 // ---- Windows paths ----
 
 function _addWindowsPaths(dirs) {
@@ -197,6 +273,12 @@ function _addWindowsPaths(dirs) {
   if (localAppData) _push(dirs, path.join(localAppData, 'cursor-agent'));
   _push(dirs, path.join(HOME, '.local', 'bin'));
 
+  // Amp CLI (irm https://ampcode.com/install.ps1 | iex) — same registry-PATH
+  // staleness as Cursor; add the canonical install dir(s) so an already-running
+  // daemon resolves amp without a reboot.
+  _push(dirs, path.join(HOME, '.amp', 'bin'));
+  if (localAppData) _push(dirs, path.join(localAppData, 'amp'));
+
   // Hermes CLI native (no-WSL) installer drops hermes.exe in the portable
   // venv's Scripts dir and the uv shim in %LOCALAPPDATA%\hermes\bin. Same
   // registry-PATH staleness as Cursor — add explicitly so an already-running
@@ -291,6 +373,12 @@ function _addUnixPaths(dirs) {
 
   // Cursor CLI native installer (curl https://cursor.com/install | bash)
   _push(dirs, path.join(HOME, '.cursor', 'bin'));
+
+  // Amp CLI native installer (curl https://ampcode.com/install.sh | bash)
+  // drops the binary in ~/.amp/bin and only symlinks into ~/.local/bin when
+  // that dir is already on PATH — so a GUI- or daemon-spawned process never
+  // sees it unless the canonical dir is listed here explicitly.
+  _push(dirs, path.join(HOME, '.amp', 'bin'));
 }
 
 // ---- macOS-specific ----
@@ -396,15 +484,50 @@ function clearBinaryLookupCache() {
   whichBinaryCache.clear();
 }
 
+/**
+ * Directories where the Aider CLI executable can land, in the SAME priority the
+ * official installer (aider.chat/install.{sh,ps1} → `uv tool install`) uses, so
+ * detection matches reality on every platform:
+ *   1. $XDG_BIN_HOME
+ *   2. $XDG_DATA_HOME/../bin
+ *   3. ~/.local/bin              (the default uv-tool / pipx / pip --user bin)
+ *   4. the uv tools venv for aider-chat (Scripts on Windows, bin on Unix) — the
+ *      executable always lands here on a successful `uv tool install`, even if
+ *      the bin-dir copy/PATH edit didn't happen.
+ * Uses os.homedir()/live env so it reflects the current process (test-friendly).
+ * Returns directories only; callers join the platform binary names.
+ */
+function aiderBinDirs() {
+  const home = os.homedir();
+  const dirs = [];
+  if (process.env.XDG_BIN_HOME) dirs.push(process.env.XDG_BIN_HOME);
+  if (process.env.XDG_DATA_HOME) dirs.push(path.join(process.env.XDG_DATA_HOME, '..', 'bin'));
+  dirs.push(path.join(home, '.local', 'bin'));
+  if (IS_WINDOWS) {
+    const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+    const uvTools = process.env.UV_TOOL_DIR || path.join(appData, 'uv', 'tools');
+    dirs.push(path.join(uvTools, 'aider-chat', 'Scripts'));
+    dirs.push(path.join(home, 'bin'));
+  } else {
+    const uvTools = process.env.UV_TOOL_DIR
+      || path.join(home, '.local', 'share', 'uv', 'tools');
+    dirs.push(path.join(uvTools, 'aider-chat', 'bin'));
+    dirs.push(path.join(home, 'bin'), '/usr/local/bin', '/opt/homebrew/bin');
+  }
+  return dirs;
+}
+
 module.exports = {
   getExtraBinDirs,
   getEnhancedPATH,
   getEnhancedEnv,
   whichBinary,
+  whereBinary,
   clearBinaryLookupCache,
   getRuntimePrefix,
   getCorePrefix,
   defaultAgentWorkdir,
+  aiderBinDirs,
   IS_WINDOWS,
   IS_MACOS,
   SEP,

package/src/tui.js

@@ -13,6 +13,7 @@ const path = require('path');
 const fs = require('fs');
 const { spawn } = require('child_process');
 const { getExtraBinDirs } = require('./paths');
+const { hasCredentialMetadata, formatAuthGuidance } = require('./auth-guidance');
 
 const IS_WINDOWS = process.platform === 'win32';
 
@@ -67,7 +68,14 @@ function getConnector() {
 
 function describeHealth(health) {
   if (!health) return '';
-  if (!health.ready) return health.message || 'Not configured';
+  if (!health.ready) {
+    // "Not installed" is reserved for a genuinely missing executable; an
+    // installed-but-signed-out agent shows its login/config message instead.
+    if (health.reason === 'not_installed' || health.installed === false) {
+      return 'Not installed';
+    }
+    return health.message || 'Not configured';
+  }
   const parts = ['Ready'];
   if (health.auth_mode === 'api_key') parts.push('API key');
   else if (health.auth_mode === 'cli_login') parts.push('CLI login');
@@ -283,11 +291,14 @@ function createTUI() {
         // Local-only agents (no workspace) show a dimmed "(local)" marker.
         const ws = r.workspace || `{gray-fg}${r.workspaceLabel}{/gray-fg}`;
         items.push(`  ${r.name.padEnd(22)} ${r.type.padEnd(14)} ${state.padEnd(30)} ${ws}`);
-        // Detail row: working dir + config warning
+        // Detail row: working dir + config warning + the REAL runtime error
+        // (spawn/join/heartbeat) when the daemon reported one, so a failure shows
+        // its actual cause instead of a swallowed/"Not installed" guess.
         const details = [];
         details.push(r.path || process.env.HOME || '~');
         if (r.health) details.push(`{cyan-fg}${describeHealth(r.health)}{/cyan-fg}`);
         if (r.notReadyMsg) details.push(`{yellow-fg}⚠ ${r.notReadyMsg}{/yellow-fg}`);
+        if (r.lastError) details.push(`{red-fg}✗ ${r.lastError}{/red-fg}`);
         items.push(`  {gray-fg}  ${details.join('  |  ')}{/gray-fg}`);
       }
       agentList.setItems(items);
@@ -754,6 +765,22 @@ function createTUI() {
     currentView = 'configure';
     const envFields = connector.registry.getEnvFields(agent.type);
     if (!envFields || envFields.length === 0) {
+      // Some agents declare no env_config yet still REQUIRE a sign-in/credential
+      // (e.g. Gemini's OAuth login). Detect that via the registry's check_ready
+      // and show readiness + login guidance instead of a misleading "no
+      // configuration required". Agents without any credential metadata keep the
+      // original message — this is gated, so other agents are untouched.
+      const entry = connector.registry.getEntry(agent.type);
+      const checkReady = entry && entry.check_ready;
+      if (hasCredentialMetadata(checkReady)) {
+        let health = null;
+        try { health = connector.healthCheck(agent.type); } catch {}
+        const g = formatAuthGuidance(entry, health);
+        const tag = g.ready ? 'green-fg' : 'yellow-fg';
+        log(`{bold}{${tag}}${entry.label || agent.type} authentication: ${g.ready ? 'Ready' : 'Not ready'}{/}{/bold}`);
+        for (const line of g.lines) log(`{gray-fg}${line}{/gray-fg}`);
+        return;
+      }
       log('{gray-fg}No configuration required for this agent type.{/gray-fg}');
       return;
     }

package/src/update-check.js

@@ -88,20 +88,31 @@ async function checkForUpdate() {
 }
 
 /**
- * Walk up from __dirname until we find the enclosing node_modules; the
- * directory containing node_modules is the install prefix.
+ * Derive the npm `--prefix` for a global install from the npm binary location.
+ *
+ * npm resolves `-g` installs relative to a PREFIX, and the layout differs by
+ * platform:
+ *   Unix:    packages → {prefix}/lib/node_modules   (npm bin at {prefix}/bin)
+ *   Windows: packages → {prefix}/node_modules        (npm bin at {prefix})
+ *
+ * So the prefix is the PARENT of npm's bin dir on Unix, and the bin dir itself
+ * on Windows. The previous implementation walked up to the enclosing
+ * node_modules and returned the directory containing it — which on Unix is
+ * `{prefix}/lib`. Passing THAT as `--prefix` made npm append `lib/node_modules`
+ * again, installing into `{prefix}/lib/lib/node_modules` while the running `agn`
+ * (loaded from `{prefix}/lib/node_modules`) never changed: `agn update` reported
+ * success but silently no-op'd on every Unix host.
  */
-function detectInstallPrefix() {
-  let dir = __dirname;
-  for (let i = 0; i < 10; i++) {
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    if (path.basename(parent) === 'node_modules') {
-      return path.dirname(parent);
-    }
-    dir = parent;
-  }
-  return null;
+function npmPrefixFromBin(npmBin, platform = process.platform) {
+  if (!npmBin) return null;
+  // Use the target platform's path semantics so a Windows path resolves
+  // correctly even when this runs on a POSIX host (and vice versa).
+  const p = platform === 'win32' ? path.win32 : path.posix;
+  const binDir = p.dirname(npmBin);
+  // A bare name (e.g. 'npm' from the PATH hard-fallback) has no usable
+  // directory — let npm resolve its own default global prefix instead.
+  if (binDir === '.' || binDir === '') return null;
+  return platform === 'win32' ? binDir : p.dirname(binDir);
 }
 
 /**
@@ -139,7 +150,7 @@ function runUpdate(opts = {}) {
   const platform = opts.platform || process.platform;
   const spawn = opts.spawn || spawnSync;
   const npmBin = opts.npmBin || findNpmBin({ platform });
-  const prefix = opts.prefix !== undefined ? opts.prefix : detectInstallPrefix();
+  const prefix = opts.prefix !== undefined ? opts.prefix : npmPrefixFromBin(npmBin, platform);
   // Use a GLOBAL install (-g). A LOCAL install (`npm install <pkg> --prefix
   // <dir>`) treats <dir> as a project root and prunes every node_modules entry
   // not reachable from its package.json. When the prefix is the portable node
@@ -228,5 +239,6 @@ module.exports = {
   notifyAndMaybeUpdate,
   runUpdate,
   findNpmBin,
+  npmPrefixFromBin,
   currentVersion,
 };

package/src/workspace-client.js

@@ -156,15 +156,12 @@ class WorkspaceClient {
    */
   async sendMessage(workspaceId, channelName, token, content, {
     senderType = 'agent', senderName, messageType = 'chat', metadata, attachments, sessionId,
-    spec, specToolCallId,
   } = {}) {
     const sourcePrefix = senderType === 'agent' ? 'openagents' : 'human';
     const source = senderName ? `${sourcePrefix}:${senderName}` : `${sourcePrefix}:unknown`;
 
     const payload = { content, message_type: messageType };
     if (attachments && attachments.length) payload.attachments = attachments;
-    if (spec) payload.spec = spec;
-    if (specToolCallId) payload.spec_tool_call_id = specToolCallId;
 
     return this.sendEvent(workspaceId, {
       type: 'workspace.message.posted',
@@ -175,30 +172,6 @@ class WorkspaceClient {
     }, token, sessionId);
   }
 
-  /**
-   * Poll workspace.tool_result events — the client's response to an agent's
-   * render_ui invocation. Returns events directly (no message normalization)
-   * because the caller treats them differently than chat messages.
-   */
-  async pollToolResults(workspaceId, token, { after, limit = 50 } = {}) {
-    const params = new URLSearchParams({
-      network: workspaceId,
-      type: 'workspace.tool_result',
-      limit: String(limit),
-    });
-    if (after) params.set('after', after);
-
-    const data = await this._get(`/v1/events?${params}`, this._wsHeaders(token));
-    const result = data.data || data;
-    const events = (result && result.events) || [];
-
-    let cursor = null;
-    if (events.length > 0) {
-      cursor = events[events.length - 1].id || null;
-    }
-    return { events, cursor };
-  }
-
   /**
    * Poll messages in a channel via GET /v1/events.
    * @returns {Array} message-compatible objects
@@ -275,6 +248,11 @@ class WorkspaceClient {
     const params = new URLSearchParams({
       network: workspaceId,
       type: 'workspace.message.posted',
+      // Server-side pre-filter: only return events routed to this agent (plus
+      // untargeted ones) instead of the whole network's traffic. Backward
+      // compatible — older backends ignore the unknown param and return
+      // everything, so the client-side filter below stays as the safety net.
+      target_agents: agentName,
       limit: String(limit),
     });
     if (after) params.set('after', after);
@@ -283,12 +261,23 @@ class WorkspaceClient {
     const result = data.data || data;
     const events = (result && result.events) || [];
 
+    // Prefer the server's next_cursor: with server-side target filtering the
+    // last returned event lags the stream tip, so advancing by it alone would
+    // re-scan the same range every poll. next_cursor jumps past other agents'
+    // events once ours are drained. Older backends don't send it — fall back
+    // to the last returned event id (they return the full stream, so that IS
+    // the tip).
     let cursor = null;
-    if (events.length > 0) {
+    if (result && result.next_cursor) {
+      cursor = result.next_cursor;
+    } else if (events.length > 0) {
       cursor = events[events.length - 1].id || null;
     }
 
-    // Filter for messages targeted at this agent.
+    // Filter for messages targeted at this agent. With a targeting-aware
+    // backend this is mostly a no-op (server already narrowed the set); it
+    // remains authoritative for older backends and for the untargeted events
+    // the server includes as a safe superset.
     //
     // target_agents semantics:
     //   • absent            → legacy server with no routing decision
@@ -802,6 +791,14 @@ class WorkspaceClient {
         method: 'GET',
         headers,
         timeout,
+        // Hard end-to-end deadline. The `timeout` option above is only a SOCKET
+        // inactivity timeout — it is NOT armed until a socket exists, so it does
+        // not bound DNS resolution or TCP connect. During a network partition a
+        // request stuck in getaddrinfo/connect never fires 'timeout', so the
+        // await never settles and the caller's single poll loop wedges forever
+        // (the agent stays "online" via its separate heartbeat but stops
+        // consuming messages). AbortSignal.timeout fires in ANY phase.
+        signal: AbortSignal.timeout(timeout),
       }, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
@@ -836,6 +833,7 @@ class WorkspaceClient {
         method: 'GET',
         headers,
         timeout,
+        signal: AbortSignal.timeout(timeout), // hard deadline (covers DNS/connect); see _get
       }, (res) => {
         const chunks = [];
         res.on('data', (chunk) => { chunks.push(chunk); });
@@ -868,6 +866,7 @@ class WorkspaceClient {
         method: 'POST',
         headers: { ...headers, 'Content-Length': Buffer.byteLength(jsonBody) },
         timeout,
+        signal: AbortSignal.timeout(timeout), // hard deadline (covers DNS/connect); see _get
       }, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
@@ -910,6 +909,7 @@ class WorkspaceClient {
         method: 'PUT',
         headers: { ...headers, 'Content-Length': Buffer.byteLength(jsonBody) },
         timeout,
+        signal: AbortSignal.timeout(timeout), // hard deadline (covers DNS/connect); see _get
       }, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
@@ -952,6 +952,7 @@ class WorkspaceClient {
         method: 'PATCH',
         headers: { ...headers, 'Content-Length': Buffer.byteLength(jsonBody) },
         timeout,
+        signal: AbortSignal.timeout(timeout), // hard deadline (covers DNS/connect); see _get
       }, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
@@ -987,6 +988,7 @@ class WorkspaceClient {
         method: 'DELETE',
         headers,
         timeout: 15000,
+        signal: AbortSignal.timeout(15000), // hard deadline (covers DNS/connect); see _get
       }, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });