@ouro.bot/cli 0.1.0-alpha.892 → 0.1.0-alpha.894

package/dist/senses/cmux/redact.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = redactSecrets;
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Terminal screens and Feed tool input can show credentials. Everything the cmux sense hands to a
+ * model (screen text, request previews) goes through this first. It is a best-effort net for
+ * secret-shaped strings, not a guarantee, so callers also keep their output bounded.
+ */
+const REDACTED = "[redacted]";
+const WHOLE_MATCH = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    /\bv1\.[A-Za-z0-9_-]{40,}\.[A-Za-z0-9_-]{40,}/g,
+    /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+];
+/** Keep the label (group 1), redact the value. */
+const LABELLED_VALUE = [
+    /(\b(?:Bearer|Basic)\s+)[A-Za-z0-9._~+/=-]{6,}/gi,
+    /(\b(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s'"&]+)/gi,
+    /([?&](?:token|key|api_key|access_token|sig|signature)=)[^&\s]+/gi,
+];
+function redactSecrets(text) {
+    let result = text;
+    for (const pattern of WHOLE_MATCH)
+        result = result.replace(pattern, REDACTED);
+    for (const pattern of LABELLED_VALUE)
+        result = result.replace(pattern, `$1${REDACTED}`);
+    if (result !== text) {
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_redacted", message: "redacted secret-shaped text from cmux output", meta: { removedChars: text.length - result.length } });
+    }
+    return result;
+}

package/dist/senses/cmux/sense.js

@@ -0,0 +1,287 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CMUX_WAKE_TRIGGER = void 0;
+exports.cmuxStatePath = cmuxStatePath;
+exports.queueEscalation = queueEscalation;
+exports.wakeForEscalations = wakeForEscalations;
+exports.startCmuxSenseApp = startCmuxSenseApp;
+const node_crypto_1 = require("node:crypto");
+const path = __importStar(require("node:path"));
+const cmux_config_1 = require("../../heart/cmux-config");
+const socket_client_1 = require("../../heart/daemon/socket-client");
+const identity_1 = require("../../heart/identity");
+const runtime_credentials_1 = require("../../heart/runtime-credentials");
+const pending_1 = require("../../mind/pending");
+const runtime_1 = require("../../nerves/runtime");
+const attention_1 = require("./attention");
+const answer_1 = require("./answer");
+const client_1 = require("./client");
+const RECONNECT_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 30_000];
+const FEED_POLL_MS = 30_000;
+const SAVE_DELAY_MS = 1_000;
+function cmuxStatePath(agentName) {
+    return path.join((0, identity_1.getAgentRoot)(agentName), "state", "senses", "cmux", "state.json");
+}
+/** The private-turn trigger the daemon's policy accepts for a cmux escalation wake. */
+exports.CMUX_WAKE_TRIGGER = "cmux-feed";
+/** cmux waits about 120 seconds; a notice the agent has not read within 30 minutes is dropped unread. */
+const ESCALATION_TTL_MS = 30 * 60_000;
+/** Queues the escalation in the agent's private runtime, as the mail sense queues its notices. */
+function queueEscalation(agent, escalation, nowMs) {
+    (0, pending_1.queuePendingMessage)((0, pending_1.getPrivateRuntimePendingDir)(agent), {
+        from: "cmux",
+        friendId: "self",
+        channel: "cmux",
+        key: "feed",
+        content: escalation.content,
+        timestamp: nowMs,
+        expiresAt: nowMs + ESCALATION_TTL_MS,
+        mode: "reflect",
+    });
+}
+/** How many request ids one wake names in its origin references. */
+const WAKE_REF_LIMIT = 20;
+/**
+ * Asks the daemon for one private turn for everything a check pass queued: the turn reads every
+ * pending message at once, so a burst of Feed requests costs one turn, not one each. A refused or
+ * failed wake leaves the messages for the next private turn.
+ */
+async function wakeForEscalations(agent, requestIds) {
+    const key = requestIds.length === 1 ? requestIds[0] : `${requestIds.length}:${(0, node_crypto_1.createHash)("sha256").update(requestIds.join("\n")).digest("hex").slice(0, 32)}`;
+    try {
+        const response = await (0, socket_client_1.requestPrivateWake)(agent, undefined, {
+            reason: requestIds.length === 1 ? "cmux Feed request" : `${requestIds.length} cmux Feed requests`,
+            triggerSource: exports.CMUX_WAKE_TRIGGER,
+            budgetClass: "interactive",
+            idempotencyKey: `cmux-feed:${agent}:${key}`,
+            originRefs: [...requestIds.slice(0, WAKE_REF_LIMIT).map((id) => ({ kind: "cmux-feed", id })), { kind: "sense", id: "cmux" }],
+        });
+        if (response && !response.ok)
+            throw new Error(response.error ?? "the daemon refused the wake");
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_wake_error", message: "could not wake the private runtime for cmux escalations; they wait for the next private turn", meta: { agent, error: error.message } });
+    }
+}
+async function startCmuxSenseApp(options) {
+    const agent = options.agentName;
+    const nowMs = options.now ?? Date.now;
+    const now = () => new Date(nowMs()).toISOString();
+    const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const resolved = (0, cmux_config_1.resolveCmuxConnection)(agent, machine.ok ? machine.config : {});
+    if (!resolved.ok)
+        throw new Error(resolved.error);
+    const client = (options.createClient ?? ((connection) => (0, client_1.createCmuxClient)(connection, { agentName: agent })))(resolved.connection);
+    const escalate = options.escalate ?? ((escalation) => queueEscalation(agent, escalation, nowMs()));
+    const wake = options.wake ?? ((requestIds) => wakeForEscalations(agent, requestIds));
+    const schedule = options.schedule ?? ((fn, ms) => {
+        const timer = setTimeout(fn, ms);
+        return () => clearTimeout(timer);
+    });
+    const statePath = cmuxStatePath(agent);
+    const answers = { agentRoot: (0, identity_1.getAgentRoot)(agent), stateDir: path.dirname(statePath), client, now: nowMs, cmuxVersion: () => state.cmuxVersion };
+    const state = (0, attention_1.readCmuxState)(statePath, now());
+    state.connected = false;
+    let stopped = false;
+    let stream = null;
+    let attempt = 0;
+    let cancelReconnect = null;
+    let cancelPoll = null;
+    let cancelSave = null;
+    let feedChain = Promise.resolve();
+    let feedQueued = false;
+    let lastWritten = null;
+    /** Writes the state file only when something other than the timestamp changed. */
+    const save = () => {
+        cancelSave?.();
+        cancelSave = null;
+        const body = JSON.stringify({ ...state, updatedAt: null });
+        if (body === lastWritten)
+            return;
+        state.updatedAt = now();
+        // A failed write is retried by the next save; it never breaks the Feed check chain.
+        try {
+            (0, attention_1.writeCmuxState)(statePath, state);
+            lastWritten = body;
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_state_write_error", message: "could not write the cmux sense state; the next save retries", meta: { agent, error: error.message } });
+        }
+    };
+    const saveSoon = () => {
+        cancelSave ??= schedule(save, SAVE_DELAY_MS);
+    };
+    /**
+     * One pending item: answered once when the code allows it, otherwise escalated with the reason.
+     * A failure while judging or answering escalates the item with the error; a failure to record the
+     * escalation leaves it unremembered, so the next check retries it. One item never blocks another.
+     */
+    async function handleItem(item) {
+        let reason;
+        let judgment = null;
+        try {
+            judgment = (0, answer_1.judgeFeedItem)(answers, item);
+            if (judgment.reply) {
+                const outcome = await (0, answer_1.answerOnce)(answers, item, judgment);
+                if (outcome === "replied_once" || outcome === "race") {
+                    (0, attention_1.rememberEscalation)(state, item.requestId);
+                    return null;
+                }
+                reason = outcome === "unconfirmed" ? "the sense's reply may or may not have reached cmux, and cmux does not show the request resolved by it" : "the sense's own reply did not go out";
+            }
+            else {
+                reason = judgment.reason;
+            }
+        }
+        catch (error) {
+            reason = `the sense could not judge or answer it: ${error.message}`;
+        }
+        const escalation = (0, attention_1.escalationMessage)(agent, item, (0, attention_1.surfaceForSession)(state, item.workstreamId), reason);
+        try {
+            await escalate(escalation);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_escalation_error", message: "could not record a cmux Feed request; the next check retries", meta: { agent, error: error.message } });
+            return null;
+        }
+        (0, attention_1.rememberEscalation)(state, item.requestId);
+        (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_escalated", message: "brought a cmux Feed request to the agent", meta: { agent, kind: item.kind, source: item.source } });
+        // The escalation is queued either way; a decision log that cannot take the line is noted, not retried.
+        try {
+            if (judgment)
+                (0, answer_1.recordDecision)(answers, item, judgment, "escalated", reason);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_decision_log_error", message: "could not log a cmux escalation", meta: { agent, error: error.message } });
+        }
+        return escalation.requestId;
+    }
+    async function checkFeed() {
+        try {
+            const items = (0, attention_1.pendingFeedItems)(await client.call("feed.list", { pending_only: true }));
+            const queued = [];
+            for (const item of items.filter((entry) => !state.escalated.includes(entry.requestId))) {
+                const id = await handleItem(item);
+                if (id !== null)
+                    queued.push(id);
+            }
+            // One wake per check pass: the private turn reads every queued escalation at once.
+            if (queued.length > 0)
+                await wake(queued);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_feed_check_error", message: "cmux Feed check failed; the next check retries", meta: { agent, error: error.message } });
+        }
+        save();
+    }
+    /** Bursts of waiting events share one queued `feed.list` read instead of stacking reads. */
+    const requestFeedCheck = () => {
+        if (feedQueued)
+            return;
+        feedQueued = true;
+        feedChain = feedChain.then(() => {
+            feedQueued = false;
+            return checkFeed();
+        });
+    };
+    /** Records the cmux version once per connection; observing works on any version. */
+    async function identify() {
+        try {
+            const result = await client.call("system.identify", {});
+            state.cmuxVersion = typeof result.version === "string" ? result.version : null;
+        }
+        catch {
+            state.cmuxVersion = null;
+        }
+        saveSoon();
+    }
+    const poll = () => {
+        cancelPoll = schedule(() => {
+            requestFeedCheck();
+            poll();
+        }, FEED_POLL_MS);
+    };
+    function connect() {
+        cancelReconnect = null;
+        stream = client.stream({ ...(state.seq !== null ? { after_seq: state.seq } : {}), categories: ["feed", "surface"] }, {
+            onFrame: (frame) => {
+                if (frame.type === "ack") {
+                    attempt = 0;
+                    const { reset } = (0, attention_1.applyAck)(state, frame);
+                    state.connected = true;
+                    state.lastError = null;
+                    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_stream_connected", message: "cmux event stream connected", meta: { agent, reset } });
+                    // The version gates answering, so the first Feed check on a connection waits for it.
+                    void identify().then(requestFeedCheck);
+                    return;
+                }
+                if (frame.type !== "event")
+                    return;
+                if ((0, attention_1.applyEventFrame)(state, frame, now()).feedCheck)
+                    requestFeedCheck();
+                saveSoon();
+            },
+            onClose: (error) => {
+                stream = null;
+                state.connected = false;
+                state.lastError = error?.message ?? null;
+                if (stopped)
+                    return;
+                const delay = RECONNECT_DELAYS_MS[Math.min(attempt, RECONNECT_DELAYS_MS.length - 1)];
+                attempt += 1;
+                (0, runtime_1.emitNervesEvent)({ level: "warn", component: "senses", event: "senses.cmux_stream_closed", message: "cmux event stream closed; reconnecting", meta: { agent, delay, error: error?.message ?? null } });
+                save();
+                cancelReconnect = schedule(connect, delay);
+            },
+        });
+    }
+    connect();
+    poll();
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_sense_started", message: "cmux sense started", meta: { agent, auth: resolved.connection.auth.kind } });
+    return {
+        statePath,
+        async stop() {
+            stopped = true;
+            cancelReconnect?.();
+            cancelPoll?.();
+            stream?.close();
+            await feedChain;
+            state.connected = false;
+            save();
+            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_sense_stopped", message: "cmux sense stopped", meta: { agent } });
+        },
+    };
+}

package/dist/senses/cmux-entry.js

@@ -0,0 +1,77 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const agentArgIndex = process.argv.indexOf("--agent");
+const agentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+if (!agentName) {
+    // eslint-disable-next-line no-console -- pre-boot guard: --agent check before imports
+    console.error("Missing required --agent <name> argument.\nUsage: node dist/senses/cmux-entry.js --agent ouroboros");
+    process.exit(1);
+}
+const runtime_logging_1 = require("../heart/daemon/runtime-logging");
+const runtime_1 = require("../nerves/runtime");
+(0, runtime_logging_1.configureDaemonRuntimeLogger)("cmux");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting cmux entrypoint",
+    meta: { entry: "cmux", agentName },
+});
+Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, waitForRuntimeCredentialBootstrap }) => {
+    await waitForRuntimeCredentialBootstrap(agentName);
+    if (!readMachineRuntimeCredentialConfig(agentName).ok) {
+        const { loadOrCreateMachineIdentity } = await Promise.resolve().then(() => __importStar(require("../heart/machine-identity")));
+        await refreshMachineRuntimeCredentialConfig(agentName, loadOrCreateMachineIdentity().machineId, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
+    const { startCmuxSenseApp } = await Promise.resolve().then(() => __importStar(require("./cmux/sense")));
+    const app = await startCmuxSenseApp({ agentName: agentName });
+    const shutdown = () => {
+        void app.stop().finally(() => process.exit(0));
+    };
+    process.once("SIGTERM", shutdown);
+    process.once("SIGINT", shutdown);
+})
+    .catch((error) => {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.entry_error",
+        message: "cmux entrypoint failed",
+        meta: { entry: "cmux", agentName, error: error instanceof Error ? error.message : String(error) },
+    });
+    // eslint-disable-next-line no-console -- fatal startup guard for sense process
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.892",
+  "version": "0.1.0-alpha.894",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.892",
+      "version": "0.1.0-alpha.894",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.892",
+  "version": "0.1.0-alpha.894",
   "engines": {
     "node": ">=22"
   },