@platless/axom-cli 0.3.13 → 0.5.9

package/dist/workstation/tools/terminalRouter.js

@@ -0,0 +1,222 @@
+import { accessSync, constants, statSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { CREATE_KEYS, PTY_OPERATIONS } from '../keepers/terminal/pty.js';
+import { PTY_SESSION_LIMIT } from '../keepers/terminal/protocol.js';
+import { TERMINAL_NOT_FOUND } from '../keepers/legacy.js';
+import { identifier, integer, keys } from './validation.js';
+const LEGACY = 'legacy';
+/** The single-keeper form of {@link KitGenerations}: one generation named `kit`, running when it answers a hello. */
+function singleKit(kit) {
+    return {
+        servingGeneration: async () => ({ gen: 'kit', client: kit }),
+        running: async () => [{ gen: 'kit', client: kit }],
+    };
+}
+export class TerminalRouter {
+    deps;
+    owners = new Map();
+    kits;
+    /** Clients of the generations seen in the last listing, by generation. */
+    clients = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        if (!deps.kits && !deps.kit)
+            throw new Error('TerminalRouter needs keeper-terminal');
+        this.kits = deps.kits ?? singleKit(deps.kit);
+    }
+    /** The current owner map (tests and diagnostics): `legacy`, or a generation (`kit` with a single keeper-terminal). */
+    ownerOf(id) { return this.owners.get(id); }
+    async request(method, params) {
+        const op = method.startsWith('terminal.') ? method.slice('terminal.'.length) : '';
+        if (op === 'list') {
+            keys(params, []);
+            return { sessions: await this.list() };
+        }
+        if (op === 'create')
+            return { ...await this.create(params) };
+        if (!PTY_OPERATIONS.has(op))
+            throw new Error('Unsupported workstation tool');
+        const id = identifier(params, 'id');
+        const owner = await this.resolveOwner(id);
+        if (!owner)
+            throw new Error(TERMINAL_NOT_FOUND);
+        const kit = owner === LEGACY ? undefined : this.clients.get(owner);
+        if (owner !== LEGACY && !kit)
+            throw new Error(TERMINAL_NOT_FOUND);
+        try {
+            const result = owner === LEGACY
+                ? await this.deps.legacy.request(method, params)
+                : { ...await kit[op].call(kit, params) };
+            if (op === 'close')
+                this.owners.delete(id);
+            return result;
+        }
+        catch (error) {
+            // The owner no longer has it (closed elsewhere, keeper restarted): forget it; the next request looks it up again.
+            if (error instanceof Error && error.message === TERMINAL_NOT_FOUND)
+                this.owners.delete(id);
+            throw error;
+        }
+    }
+    async list() {
+        const { legacy, kits } = await this.refresh();
+        const seen = new Set((legacy ?? []).map((session) => session.id));
+        const out = [...(legacy ?? [])];
+        for (const sessions of kits.values())
+            for (const session of sessions ?? [])
+                if (!seen.has(session.id)) {
+                    seen.add(session.id);
+                    out.push(session);
+                }
+        return out;
+    }
+    /** Lists every side once (keeper-terminal generations only if running) and refreshes the owners of every side that answered. */
+    async refresh() {
+        const [legacy, kits] = await Promise.all([this.legacySessions(), this.kitRefresh()]);
+        if (legacy)
+            this.replaceOwners(LEGACY, legacy);
+        else if (!this.deps.legacy?.live)
+            this.replaceOwners(LEGACY, []);
+        return { legacy, kits };
+    }
+    /**
+     * Lists every running keeper-terminal generation (never starts one) and refreshes their owners: a generation that answered gets
+     * exactly its sessions; one that did not answer keeps its owners; one that is no longer running loses them (its PTYs are gone).
+     */
+    async kitRefresh() {
+        const listed = new Map();
+        let running;
+        try {
+            running = await this.kits.running();
+        }
+        catch {
+            return listed;
+        }
+        await Promise.all(running.map(async ({ gen, client }) => {
+            this.clients.set(gen, client);
+            listed.set(gen, await this.sessionsOf(client));
+        }));
+        for (const [gen, sessions] of listed)
+            if (sessions)
+                this.replaceOwners(gen, sessions);
+        for (const [id, owner] of [...this.owners])
+            if (owner !== LEGACY && !listed.has(owner))
+                this.owners.delete(id);
+        for (const gen of [...this.clients.keys()])
+            if (!listed.has(gen))
+                this.clients.delete(gen);
+        return listed;
+    }
+    replaceOwners(side, sessions) {
+        for (const [id, owner] of this.owners)
+            if (owner === side)
+                this.owners.delete(id);
+        for (const session of sessions)
+            if (side === LEGACY || !this.owners.has(session.id))
+                this.owners.set(session.id, side);
+    }
+    /** The legacy keeper's sessions; `sessions()` probes it first (read-only), so a daemon that just started finds it too. */
+    async legacySessions() {
+        return this.deps.legacy ? this.deps.legacy.sessions() : null;
+    }
+    /** One generation's sessions if it is already running; null when it is not (or did not answer): nothing is started here. */
+    async sessionsOf(client) {
+        try {
+            if (!await client.runningHello())
+                return null;
+            return (await client.list()).sessions;
+        }
+        catch {
+            return null;
+        }
+    }
+    async resolveOwner(id) {
+        const known = this.owners.get(id);
+        if ((known !== undefined && known !== LEGACY && this.clients.has(known)) || (known === LEGACY && this.deps.legacy?.live))
+            return known;
+        await this.refresh();
+        return this.owners.get(id);
+    }
+    async create(params) {
+        // The legacy keeper's checks, wording and order (tools/terminal.ts at the merge-base: id, clientId, keys, cols, rows, name,
+        // then existing, limit, cwd), all before the cwd is resolved.
+        const id = identifier(params, 'id');
+        identifier(params, 'clientId');
+        keys(params, [...CREATE_KEYS]);
+        integer(params, 'cols', 20, 300, 100);
+        integer(params, 'rows', 5, 100, 30);
+        const name = params.name;
+        if (name !== undefined && (typeof name !== 'string' || !name.length || name.length > 128 || /[\x00-\x1f]/.test(name)))
+            throw new Error('Invalid terminal name');
+        const legacy = this.deps.legacy;
+        const knownOwner = this.owners.get(id);
+        if (legacy && (knownOwner === undefined || knownOwner === LEGACY)) {
+            // The legacy keeper never gains a session after the upgrade (creates go to keeper-terminal), so the ids of its first
+            // successful list answer "is this a retry of one of its sessions?" for good — even while it is busy or hung.
+            if (legacy.knownIds === null) {
+                const sessions = await legacy.sessions(); // bounded; null at once when it is busy or absent
+                if (sessions)
+                    this.replaceOwners(LEGACY, sessions);
+            }
+            if (legacy.live && legacy.knownIds?.has(id))
+                return legacy.request('terminal.create', params);
+        }
+        // Duplicate and limit first (the legacy order), against the keeper-terminal generations already running: an idempotent create
+        // (in whichever generation has the id) costs no files-host round trip. keeper-terminal re-checks both when it really creates.
+        const listed = await this.kitRefresh();
+        for (const [gen, sessions] of listed) {
+            const existing = sessions?.find((session) => session.id === id);
+            if (existing) {
+                this.owners.set(id, gen);
+                return existing;
+            }
+        }
+        const serving = await this.kits.servingGeneration();
+        const running = listed.get(serving.gen);
+        if (running && running.length >= PTY_SESSION_LIMIT)
+            throw new Error('Terminal session limit exceeded');
+        if (params.cwd !== undefined && typeof params.cwd !== 'string')
+            throw new Error('Invalid cwd');
+        const launch = await this.deps.launch(params.cwd);
+        const created = await serving.client.create({ ...params, ...launch });
+        this.clients.set(serving.gen, serving.client);
+        this.owners.set(id, serving.gen);
+        return created;
+    }
+}
+/**
+ * The shell a new PTY runs (as a login shell, `-l`): what the legacy keeper chose (`$SHELL`, else the account's shell, else
+ * `/bin/sh`), restricted to an absolute path to an executable file, which keeper-terminal requires.
+ */
+export function terminalShell(env = process.env) {
+    let account;
+    try {
+        account = os.userInfo().shell ?? undefined;
+    }
+    catch { /* no passwd entry (some containers) */ }
+    for (const candidate of [env.SHELL, account, '/bin/sh']) {
+        if (!candidate || !path.isAbsolute(candidate))
+            continue;
+        try {
+            if (statSync(candidate).isFile()) {
+                accessSync(candidate, constants.X_OK);
+                return candidate;
+            }
+        }
+        catch { /* next */ }
+    }
+    return '/bin/sh';
+}
+/**
+ * The environment a new PTY gets: the daemon's own (the legacy keeper gave its own process.env, which was the daemon's when it
+ * was spawned), never the access token (commands/workstation.ts already drops it from the daemon; dropped again here so a
+ * future spawn path cannot leak it). keeper-terminal adds TERM and COLORTERM.
+ */
+export function terminalEnv(env = process.env) {
+    const out = {};
+    for (const [name, value] of Object.entries(env))
+        if (value !== undefined && name !== 'AXOM_ACCESS_TOKEN')
+            out[name] = value;
+    return out;
+}

package/dist/workstation/tools/validation.js

@@ -6,7 +6,9 @@ export const TOOL_METHODS = new Set([
     'browser.list', 'browser.create', 'browser.attach', 'browser.frame', 'browser.navigate', 'browser.input', 'browser.takeover', 'browser.detach', 'browser.close',
     'tools.info', 'terminal.list', 'terminal.create', 'terminal.attach', 'terminal.poll',
     'terminal.write', 'terminal.resize', 'terminal.takeover', 'terminal.detach', 'terminal.close',
-    'files.list', 'files.read', 'files.mkdir', 'files.rename', 'files.delete',
+    'files.media.prepare', 'files.media.read', 'files.media.cancel',
+    'files.media.open', 'files.media.status', 'files.media.seek', 'files.media.interest', 'files.media.object', 'files.media.release',
+    'files.list', 'files.find', 'files.read', 'files.mkdir', 'files.rename', 'files.delete',
     'files.upload.begin', 'files.upload.chunk', 'files.upload.finish', 'files.upload.cancel',
 ]);
 export function object(value) {
@@ -47,4 +49,38 @@ export function validateRequest(method, params) {
         throw new Error('Unsupported workstation tool');
     if (!object(params) || Buffer.byteLength(JSON.stringify(params)) > TOOL_REQUEST_BYTES)
         throw new Error('Invalid or oversized tool parameters');
+    const shape = MEDIA_SHAPES[method];
+    if (shape) {
+        keys(params, [...shape, 'readOnly', 'filesystem']);
+        string(params, 'path');
+        identifier(params, 'consumerId');
+        if (method !== 'files.media.open' && !/^[a-f0-9]{64}$/.test(string(params, 'version', 64)))
+            throw new Error('Invalid version');
+        for (const flag of ['readOnly', 'filesystem', 'hls', 'playing']) {
+            if (params[flag] !== undefined && typeof params[flag] !== 'boolean')
+                throw new Error(`Invalid ${flag}`);
+        }
+        if (method === 'files.media.open' && typeof params.hls !== 'boolean')
+            throw new Error('Invalid hls');
+        if (method === 'files.media.seek' || method === 'files.media.interest')
+            integer(params, 'positionMs', 0, 21_600_000);
+        if (method === 'files.media.seek')
+            integer(params, 'revision', 0, Number.MAX_SAFE_INTEGER);
+        if (method === 'files.media.interest' && typeof params.playing !== 'boolean')
+            throw new Error('Invalid playing');
+        if (method === 'files.media.object') {
+            if (!/^[A-Za-z0-9_-]+$/.test(string(params, 'objectId', 128)))
+                throw new Error('Invalid objectId');
+            integer(params, 'offset', 0, Number.MAX_SAFE_INTEGER);
+            integer(params, 'length', 1, 256 * 1024);
+        }
+    }
 }
+const MEDIA_SHAPES = {
+    'files.media.open': ['path', 'consumerId', 'hls'],
+    'files.media.status': ['path', 'version', 'consumerId'],
+    'files.media.seek': ['path', 'version', 'consumerId', 'positionMs', 'revision'],
+    'files.media.interest': ['path', 'version', 'consumerId', 'positionMs', 'playing'],
+    'files.media.object': ['path', 'version', 'consumerId', 'objectId', 'offset', 'length'],
+    'files.media.release': ['path', 'version', 'consumerId'],
+};

package/dist/workstation/update/coordinator.js

@@ -253,6 +253,9 @@ export class UpdateCoordinator {
                     this.options.tasks.accepting = true;
                 return this.transition(this.base(command, 'SUCCEEDED'));
             }
+            // Keeper-hosted agent sessions outlive this process: detach them first (head checkpoint, adapter untouched — no
+            // `session/cancel`, no failed turn), so the next daemon adopts them where they are (spec §5.5.5).
+            await this.options.tasks.detachDurableSessions();
             await this.options.restart();
             return restarting;
         }

package/dist/workstation/update/ptyPreflight.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
 import path from 'node:path';
+import { PTY_UNAVAILABLE_ERROR } from '../keepers/terminal/protocol.js';
 const require = createRequire(import.meta.url);
 /**
  * Says once, at daemon start, when the installed CLI's optional `node-pty` does not load. There is
@@ -22,3 +23,23 @@ export async function preflightOptionalPty(context, deps = {}) {
         (deps.warn ?? console.warn)('[daemon] Optional node-pty does not load on this platform; the terminal tool stays unavailable.');
     }
 }
+export { PTY_UNAVAILABLE_ERROR };
+/**
+ * A cached load check of the node-pty copy the terminal would use (the same `require('node-pty')` from this package),
+ * done at most once per daemon. Answering `tools.info` must never start a keeper just to learn this.
+ */
+export function cachedPtyStatus(load = () => require('node-pty')) {
+    let status;
+    return () => {
+        if (status)
+            return status;
+        try {
+            load();
+            status = { terminal: true };
+        }
+        catch {
+            status = { terminal: false, terminalError: PTY_UNAVAILABLE_ERROR };
+        }
+        return status;
+    };
+}

package/dist/workstation/update/taskRegistry.js

@@ -10,6 +10,14 @@ export class TaskRegistry {
     idleWaiters = new Set();
     stopping = null;
     accepting = true;
+    /** Keeper-terminal execs also counted in `activeShellTasks` right now (see {@link countKeeperExec}). */
+    keeperExecsCounted = 0;
+    /**
+     * Work owned by another process that a daemon restart would interrupt (the files host's in-progress uploads plus
+     * running media encodes), sampled **now** on every snapshot — never an edge counter. Its owner calls
+     * [externalActivityChanged] when the level may have dropped, so a drain waiting on it wakes.
+     */
+    externalActivity = () => 0;
     /**
      * 忙碌是**现在采出来的**，不是攒出来的。
      *
@@ -24,6 +32,11 @@ export class TaskRegistry {
     snapshot() {
         const activeAgentRefs = new Set();
         for (const [sessionRef, session] of this.agentSessions) {
+            // Spec §8.2: `activeAgentTasks` counts only agent work a daemon restart would cut. A keeper-hosted (durable) session is not
+            // such work — its turn goes on in keeper-acp and the next daemon adopts it — so a busy one neither holds a graceful drain nor
+            // blocks an automatic patch. Fallback sessions (in this process) and in-flight open reservations are counted.
+            if (session.durable)
+                continue;
             // 一个抛异常的采样器不得让心跳和更新准入一起垮掉；读不出来就当它不主张忙碌，
             // 与未知 vendor 值的处置同一条推理。
             let busy = false;
@@ -38,7 +51,16 @@ export class TaskRegistry {
         }
         for (const sessionRef of this.agentOpenReservations.keys())
             activeAgentRefs.add(sessionRef);
-        return { activeShellTasks: this.shellTasks.size, activeAgentTasks: activeAgentRefs.size };
+        let external = 0;
+        // Same rule as the session sampler above: a failing sampler claims nothing rather than taking the heartbeat down.
+        try {
+            const sampled = this.externalActivity();
+            external = Number.isSafeInteger(sampled) && sampled > 0 ? sampled : 0;
+        }
+        catch {
+            external = 0;
+        }
+        return { activeShellTasks: this.shellTasks.size + external, activeAgentTasks: activeAgentRefs.size };
     }
     canUpdate() {
         const snapshot = this.snapshot();
@@ -79,7 +101,11 @@ export class TaskRegistry {
         for (const waiter of [...this.idleWaiters])
             waiter();
     }
-    /** Run one computer task under an abort signal which force-update owns. The method name preserves old callers. */
+    /**
+     * Run one computer task under an abort signal which force-update owns. The method name preserves old callers.
+     * `release()` stops counting the task before it ends (work a daemon restart would no longer interrupt, spec §8.2): from then on it
+     * is not in `activeShellTasks`, a drain does not wait for it and `stopAll()` does not abort it. Idempotent.
+     */
     async withShellTask(run) {
         if (!this.accepting)
             throw new Error('Workstation is not accepting new work');
@@ -87,18 +113,61 @@ export class TaskRegistry {
         let complete;
         const cleanedUp = new Promise((resolve) => { complete = resolve; });
         this.shellTasks.set(controller, cleanedUp);
+        let counted = true;
+        const release = () => {
+            if (!counted)
+                return;
+            counted = false;
+            this.shellTasks.delete(controller);
+            complete();
+            this.notifyIfIdle();
+        };
         try {
-            return await run(controller.signal);
+            return await run(controller.signal, release);
         }
         finally {
+            release();
+        }
+    }
+    /**
+     * Counts a short window of work in `activeShellTasks` WITHOUT the admission gate and without being stoppable: a drain (graceful
+     * or forced) waits for it, nothing aborts it. For work admitted while draining that a restart must not cut in half (a wire v5
+     * exec between `exec.start` and its first checkpoint, spec §8.2). Returns the release (idempotent).
+     */
+    holdShellTask() {
+        const controller = new AbortController();
+        let complete;
+        this.shellTasks.set(controller, new Promise((resolve) => { complete = resolve; }));
+        let held = true;
+        return () => {
+            if (!held)
+                return;
+            held = false;
             this.shellTasks.delete(controller);
             complete();
             this.notifyIfIdle();
-        }
+        };
     }
-    /** Register a live native agent for force-stop, plus how to ask whether it is busy right now. */
-    registerAgentSession(sessionRef, close, busy) {
-        this.agentSessions.set(sessionRef, { close, busy });
+    /**
+     * Marks one exec that runs in keeper-terminal AND is counted in `activeShellTasks` right now — a wire ≤ 4 exec (a shell task for
+     * its whole run) or a wire v5 exec before its first checkpoint (held). keeper-terminal's `execRunning` counts it too: the heartbeat
+     * reports this number (`execCounted`) so the Workstations page does not count it twice (final review minor 7). Returns the
+     * release (idempotent).
+     */
+    countKeeperExec() {
+        this.keeperExecsCounted += 1;
+        let counted = true;
+        return () => { if (!counted)
+            return; counted = false; this.keeperExecsCounted -= 1; };
+    }
+    /** How many keeper-terminal execs `activeShellTasks` includes now (see {@link countKeeperExec}). */
+    get countedKeeperExecs() { return this.keeperExecsCounted; }
+    /**
+     * Register a live native agent for force-stop, plus how to ask whether it is busy right now. A durable session's `close` must be
+     * its detach (see {@link AgentSessionRegistration}).
+     */
+    registerAgentSession(sessionRef, close, busy, registration = {}) {
+        this.agentSessions.set(sessionRef, { close, busy, durable: registration.durable === true });
     }
     /**
      * 采样式判据没有"变空闲"这个事件可以挂钩，所以持有者在可能变空闲时喊一声。
@@ -107,6 +176,10 @@ export class TaskRegistry {
     sessionBusyChanged() {
         this.notifyIfIdle();
     }
+    /** The external activity level may have changed (see [externalActivity]). */
+    externalActivityChanged() {
+        this.notifyIfIdle();
+    }
     /** Atomically admits and counts an asynchronous open before any journal or subprocess await. */
     tryReserveAgentOpen(sessionRef) {
         if (!this.accepting)
@@ -126,6 +199,10 @@ export class TaskRegistry {
     isForceStopping() {
         return this.stopping !== null;
     }
+    /** Whether `sessionRef` is registered as a keeper-hosted (durable) session: a force stop leaves it admitted (see {@link stopAll}). */
+    isDurableSession(sessionRef) {
+        return this.agentSessions.get(sessionRef)?.durable === true;
+    }
     unregisterAgentSession(sessionRef) {
         this.agentSessions.delete(sessionRef);
         this.notifyIfIdle();
@@ -134,12 +211,29 @@ export class TaskRegistry {
      * 排干期间拒收新回合。**只管准入**——它不再登记任何东西，忙碌由 [snapshot] 现场采样。
      * 这两件事以前挤在一个方法里，删计数时极易把准入一起删掉，那会让 drain 期间照收新活。
      */
-    tryAdmitTurn(_sessionRef) {
-        return this.accepting;
+    tryAdmitTurn(sessionRef) {
+        // Spec §8.2: a keeper-hosted session's prompt is admitted while draining — it enters keeper-acp's log first and a restart
+        // continues it; a fallback session's would be cut by the restart.
+        return this.accepting || this.agentSessions.get(sessionRef)?.durable === true;
+    }
+    /**
+     * The restart path of an update (Task 21, spec §5.5.5): every durable session is detached (its registered close), so the next daemon
+     * adopts it with a head checkpoint; fallback sessions are left as they are (they end with this process, their outboxes kept).
+     * Bounded by `timeoutMs`: a restart never waits on a session longer than that. All are attempted even when one fails.
+     */
+    async detachDurableSessions(timeoutMs = 5_000) {
+        const durable = [...this.agentSessions.values()].filter((session) => session.durable);
+        const all = Promise.allSettled(durable.map(async (session) => session.close()));
+        let timer;
+        await Promise.race([all, new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })]);
+        clearTimeout(timer);
     }
     /**
      * Atomically refuse future work, signal every shell process group through its owning executor,
-     * and close every native agent. All closes are attempted even when one bridge fails.
+     * and close every native agent that runs in this process. A durable (keeper-hosted) session is left alone: it stays registered,
+     * attached and admitted (spec §8.2, the same as a graceful drain) — the restart path detaches it right before the hand-off
+     * ({@link detachDurableSessions}), and a forced update that fails before that leaves it exactly as it was. All closes are
+     * attempted even when one bridge fails.
      */
     async stopAll() {
         if (this.stopping)
@@ -154,7 +248,7 @@ export class TaskRegistry {
             this.agentOpenReservations.clear();
             this.notifyIfIdle();
             const [outcomes] = await Promise.all([
-                Promise.allSettled([...this.agentSessions.values()].map(async (session) => session.close())),
+                Promise.allSettled([...this.agentSessions.values()].filter((session) => !session.durable).map(async (session) => session.close())),
                 Promise.all(shells.map(([, cleanedUp]) => cleanedUp)),
             ]);
             const failures = outcomes.filter((outcome) => outcome.status === 'rejected');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platless/axom-cli",
-  "version": "0.3.13",
+  "version": "0.5.9",
   "description": "Axomwork CLI - manage Axomwork structures, records and executions over MCP",
   "type": "module",
   "bin": {
@@ -11,33 +11,36 @@
     "skills"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc && node scripts/copy-patches.mjs",
+    "build": "rm -rf dist && tsc && node scripts/copy-patches.mjs && node scripts/copy-runtime-deps.mjs && node scripts/bundle-keepers.mjs",
     "pretest": "npm run build",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
-    "prepack": "node scripts/copy-patches.mjs --check"
+    "prepack": "node scripts/copy-patches.mjs --check && node scripts/copy-runtime-deps.mjs --check && node scripts/bundle-keepers.mjs --check"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^1.4.0",
+    "@agentclientprotocol/sdk": "1.4.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.1.3",
-    "@qoder-ai/qoder-agent-sdk": "1.0.50",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "commander": "^15.0.0",
     "js-yaml": "^4.1.0",
+    "proper-lockfile": "4.1.2",
     "semver": "^7.8.5",
     "ws": "^8.18.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@qoder-ai/qoder-agent-sdk": "1.0.50",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.11.0",
+    "@types/node": "^24.19.2",
+    "@types/proper-lockfile": "4.1.4",
     "@types/semver": "^7.8.0",
     "@types/ws": "^8.5.13",
+    "esbuild": "0.27.7",
     "typescript": "^5.2.2",
     "vitest": "^2.1.9"
   },