@prohost/cli 0.5.0 → 0.7.0

package/dist/agent/run.js

@@ -25,9 +25,12 @@
 import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
+import { HarnessAccount } from './account_runtime.js';
+import { EVENT_AGENT_CONFIG_UPDATED, machineId } from './accounts.js';
 import { completeRun, describeFailure, isIdempotencyInFlight, postReply } from './api.js';
 import { MAX_SALVAGE_CHARS, claudeCommand, isClaudeExec, looksLikeResumeFailure, readClaudeStream, writeMcpConfig, } from './claude.js';
 import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { ToolEventQueue } from './events.js';
 import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
 import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
 import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, RUN_ERROR_CANCELLED_BY_USER, eventData, heartbeatPathFor, parseRunRequest, } from './contract.js';
@@ -36,6 +39,7 @@ import { execAgent } from './exec.js';
 import { HeartbeatLoop } from './heartbeat.js';
 import { buildPrompt, replyFromStdout } from './prompt.js';
 import { RunStore } from './runstore.js';
+import { RUNTIME_STATUS_FEATURE, RuntimeStatusReporter, claudeQuotaProvider, codexConfiguredModel, codexQuotaProvider, modelFromExec, parseVersion, readCodexObservation, } from './runtime_status.js';
 import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
 import { isWebhookEvent } from '../forward.js';
@@ -133,8 +137,8 @@ const COMPLETION_RETRY_DELAYS_MS = [1_000, 3_000, 9_000, 30_000, 60_000, 120_000
  * sweeper reaps it. A 409 (`already_resolved`) counts as done. A 4xx other
  * than 429 is a decision, not a blip, so it isn't retried.
  */
-async function completeWithRetry(api, path, outcome, log, sleep) {
-    let result = await completeRun(api, path, outcome);
+async function completeWithRetry(api, path, outcome, log, sleep, model) {
+    let result = await completeRun(api, path, outcome, model);
     for (const delay of COMPLETION_RETRY_DELAYS_MS) {
         if (result.ok)
             return result;
@@ -143,7 +147,7 @@ async function completeWithRetry(api, path, outcome, log, sleep) {
             return result;
         log(`    … completion failed (${describeFailure(result)}); retrying in ${delay / 1000}s`);
         await sleep(delay);
-        result = await completeRun(api, path, outcome);
+        result = await completeRun(api, path, outcome, model);
     }
     return result;
 }
@@ -240,9 +244,29 @@ function buildRuntime(options, log) {
             ? 'codex'
             : 'plain';
     const skipPermissions = options.safeTools !== true;
+    const runtimeName = runtimeNameFor(brain, options.exec);
+    // Replaced by the harness once its status reporter exists.
+    const observe = () => { };
+    const model = () => undefined;
     if (brain === 'plain') {
-        return { workdir, sessions, brain, skipPermissions, prepareMcp: () => ({ mcpWired: false }) };
+        return {
+            workdir,
+            sessions,
+            brain,
+            skipPermissions,
+            prepareMcp: () => ({ mcpWired: false }),
+            runtimeName,
+            observe,
+            model,
+        };
     }
+    const account = new HarnessAccount({
+        runtime: brain === 'claude' ? 'claude_code' : 'codex',
+        env: options.env,
+        initialLabel: options.credentials.account,
+        binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
+        run: options.accountCommandRunner,
+    });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
     const announce = (lines) => {
@@ -280,7 +304,7 @@ function buildRuntime(options, log) {
                 };
             }
         }
-        : codexMcpEntryProvider(options, log, workdir);
+        : codexMcpEntryProvider(options, log, workdir, () => account.spawnEnv());
     const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
     const where = workdir ? ` (workspace: ${workdir})` : '';
     log(brain === 'claude'
@@ -296,7 +320,52 @@ function buildRuntime(options, log) {
             'access, on instructions from your workspace. Use --safe-tools to gate them.'
         : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
             'approval will not run (nobody is at a terminal to approve it).');
-    return { workdir, sessions, brain, prepareMcp, skipPermissions };
+    // The account is resolved before anything is prepared or spawned, and its
+    // environment rides every spawn of this run. A missing account fails the
+    // run closed, the same way an unprovable MCP boundary does.
+    const prepareWithAccount = () => {
+        const resolved = account.resolveForSpawn();
+        if (!resolved.ok)
+            return { mcpWired: false, error: resolved.error };
+        const prepared = prepareMcp();
+        return { ...prepared, execEnv: { ...account.spawnEnv(), ...prepared.execEnv } };
+    };
+    log(`${timestamp()} ⚙ account: ${account.label()}`);
+    return {
+        workdir,
+        sessions,
+        brain,
+        prepareMcp: prepareWithAccount,
+        skipPermissions,
+        runtimeName,
+        observe,
+        model,
+        account,
+    };
+}
+/**
+ * The `runtime` a status frame names. A plain command is `custom` unless it is
+ * recognisably goose — the one other agent CLI people pair today.
+ */
+function runtimeNameFor(brain, exec) {
+    if (brain === 'claude')
+        return 'claude_code';
+    if (brain === 'codex')
+        return 'codex';
+    const base = (exec.trim().split(/\s+/)[0] ?? '').split('/').pop() ?? '';
+    return base === 'goose' ? 'goose' : 'custom';
+}
+/**
+ * Idle capacity source for the detected brain: the agent CLI itself, asked
+ * through its own protocol so its own login answers. `plain` has none.
+ */
+function defaultQuotaProvider(brain, exec, env) {
+    if (brain === 'claude')
+        return claudeQuotaProvider({ binary: exec.trim().split(/\s+/)[0] ?? 'claude', env });
+    if (brain === 'codex') {
+        return codexQuotaProvider({ binary: codexBinary(exec), clientVersion: CLI_VERSION, env });
+    }
+    return undefined;
 }
 /**
  * Prepare a fresh Codex MCP override immediately before each invocation.
@@ -305,12 +374,12 @@ function buildRuntime(options, log) {
  * extras file is the operator's live grant list. Fresh reads make both a new
  * configured server and a revoked extra visible to the very next run.
  */
-export function codexMcpEntryProvider(options, log, workdir) {
+export function codexMcpEntryProvider(options, log, workdir, accountEnv) {
     let announced = '';
     return () => {
         const extras = loadExtraMcpServers({ env: options.env });
         const lines = extras.warnings.map((warning) => `${timestamp()} ! ${warning}`);
-        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir);
+        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir, accountEnv?.());
         const said = lines.join('\n');
         if (said !== announced) {
             for (const line of lines)
@@ -325,12 +394,15 @@ export function codexMcpEntryProvider(options, log, workdir) {
  * verified switches that keep the operator's own servers out. Preparation is
  * fail-closed: an unprovable boundary never reaches an unsandboxed agent.
  */
-function codexMcpEntries(options, extraServers, log, workdir) {
+function codexMcpEntries(options, extraServers, log, workdir, accountEnv) {
     const fail = (detail) => {
         log(`${timestamp()} ! ${detail}`);
         return { mcpWired: false, error: detail };
     };
-    const probe = options.probeImpl ?? defaultProbe;
+    // Every probe asks the same CODEX_HOME the run will use — the MCP servers to
+    // isolate live in that account's config.toml, not the default one.
+    const baseProbe = options.probeImpl ?? defaultProbe;
+    const probe = (command, cwd) => accountEnv && Object.keys(accountEnv).length > 0 ? baseProbe(command, cwd, accountEnv) : baseProbe(command, cwd);
     if (codexShellSyntax(options.exec)) {
         return fail('--exec uses shell quoting, expansion, glob, comment, escape, or control syntax that the Codex ' +
             'isolation verifier cannot tokenize safely; use a plain argv-shaped Codex command');
@@ -456,10 +528,11 @@ function codexMcpEntries(options, extraServers, log, workdir) {
  * `cwd` must match the eventual run exactly, because Codex loads trusted
  * project `.codex/config.toml` layers from there.
  */
-function defaultProbe(command, cwd) {
+function defaultProbe(command, cwd, env) {
     const result = spawnSync(command, {
         shell: true,
         cwd,
+        ...(env ? { env: { ...process.env, ...env } } : {}),
         encoding: 'utf8',
         // Generous for a config read, short enough that a wedged binary delays
         // a run rather than wedging the daemon.
@@ -495,7 +568,12 @@ function partialStdout(tail) {
  * tell a failed turn from a successful one. A plain command's behaviour here is
  * byte-for-byte what it was before this function existed.
  */
-async function runTurn(run, prompt, options, runtime, mcp, control, log) {
+async function runTurn(run, prompt, options, runtime, mcp, control, log, 
+/**
+ * Where the streaming brain's tool-call events go, if anywhere. Only the
+ * Claude Code reader produces any; absent, they are simply never collected.
+ */
+toolEvents) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -553,6 +631,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const activity = reader.activity();
         if (activity)
             control.report(activity);
+        // The heartbeat line above is unchanged for older servers; the events are
+        // the richer channel a newer server renders beneath it.
+        toolEvents?.push(reader.drainToolEvents());
     };
     /**
      * Undo an eagerly recorded Claude session after an ordinary failed turn.
@@ -574,7 +655,7 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const reader = runtime.brain === 'claude' ? readClaudeStream() : undefined;
         stream = reader;
         tail = '';
-        return execAgent({
+        const running = execAgent({
             command,
             prompt,
             timeoutMs: capped ? Math.max(1, remainingMs()) : 0,
@@ -594,6 +675,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
                     }
                     : undefined,
         });
+        // Whatever the stream announced — model, version, capacity — is true of
+        // this machine whether or not the turn succeeded.
+        return reader ? running.finally(() => runtime.observe(reader.observed())) : running;
     };
     // Wall clock for the whole turn, retry included — what the operator waited,
     // rather than what the last attempt took.
@@ -704,6 +788,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
     };
     if (codex) {
         const output = parseCodexOutput(result.stdout);
+        // Codex's `--json` stream carries neither model nor limits; its rollout
+        // file for this thread does.
+        runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env, ...runtime.account?.spawnEnv() }));
         reportDenials(output.denials);
         if (!output.ok) {
             return {
@@ -721,6 +808,10 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
     // crash banner, a `claude` that ignored `--output-format` — is a failure, and
     // the whole-output parser is what says so in words.
     const parsed = (stream ?? readClaudeStream()).finish(result.stdout);
+    // `finish` handles a trailing event with no newline after it; a tool event
+    // in that tail is real and must not be lost to the drain timing.
+    if (stream)
+        toolEvents?.push(stream.drainToolEvents());
     reportDenials(parsed.denials);
     if (!parsed.ok) {
         forgetRecordedSession();
@@ -766,7 +857,21 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         timeoutMs: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
         idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS,
     });
-    const result = await runTurn(run, prompt, options, runtime, mcp, control, log);
+    // Tool-call narration for the thread. A dry run makes no writes, so it gets
+    // no path and every event is dropped; so does a server that advertised none.
+    const toolEvents = new ToolEventQueue({
+        api,
+        path: options.dryRun ? undefined : run.events_path,
+        log,
+        label,
+    });
+    const result = await runTurn(run, prompt, options, runtime, mcp, control, log, toolEvents);
+    // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
+    // the run is closed — a completion that beats its own last tool row would
+    // leave a `calling` row on a finished run. Never rejects, and after `stop`
+    // nothing straggling can post against a run the server has closed.
+    await toolEvents.flush();
+    toolEvents.stop();
     const seconds = (result.durationMs / 1000).toFixed(1);
     // Stopped from outside. Checked before the failure branch below, because a
     // stopped run *is* a failed command — reporting it as one would put "timed
@@ -787,7 +892,7 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         }
         // The exact marker string, alone: the server words the thread notice from
         // it, and anything wrapped around it reads as a crash instead of a stop.
-        const closed = await completeWithRetry(api, run.completion_path, { ok: false, error: RUN_ERROR_CANCELLED_BY_USER }, log, sleep);
+        const closed = await completeWithRetry(api, run.completion_path, { ok: false, error: RUN_ERROR_CANCELLED_BY_USER }, log, sleep, runtime.model());
         if (!closed.ok) {
             log(`    ! could not report the cancellation (${describeFailure(closed)})` +
                 `${closed.status !== 0 && closed.error ? ` ${closed.error}` : ''}`);
@@ -805,7 +910,7 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
             log(`    [dry-run] would report the run as failed`);
             return 'skipped';
         }
-        const completed = await completeWithRetry(api, run.completion_path, { ok: false, error: detail ? `${reason}: ${detail}` : reason }, log, sleep);
+        const completed = await completeWithRetry(api, run.completion_path, { ok: false, error: detail ? `${reason}: ${detail}` : reason }, log, sleep, runtime.model());
         if (!completed.ok) {
             log(`    ! could not report failure (${describeFailure(completed)})` +
                 `${completed.status !== 0 && completed.error ? ` ${completed.error}` : ''}`);
@@ -833,7 +938,7 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         log(`${timestamp()} ✓ ${label} finished in ${seconds}s (${why})`);
         for (const line of reply.split('\n'))
             log(`    │ ${line}`);
-        const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep);
+        const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
         if (!completed.ok) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
@@ -856,7 +961,7 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         // used to be expressed by simply not recording until the reply landed.
         if (result.sessionRecorded)
             runtime.sessions.forget(sessionKeyFor(run));
-        const reported = await completeWithRetry(api, run.completion_path, { ok: false, error: `posting the reply failed: ${failure}` }, log, sleep);
+        const reported = await completeWithRetry(api, run.completion_path, { ok: false, error: `posting the reply failed: ${failure}` }, log, sleep, runtime.model());
         return reported.ok ? 'failed' : 'unreported';
     }
     // Advance continuity only after the answer is durable on its reply surface.
@@ -865,7 +970,7 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
     if (result.sessionId) {
         runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
     }
-    const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep);
+    const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {
         // The reply is already in the conversation, so this is a bookkeeping
         // failure, not a lost answer — say so precisely. Returning false lets the
@@ -891,6 +996,9 @@ export async function runAgentHarness(options) {
     const url = options.url ?? streamUrlFor(options.credentials, DEFAULT_WS_URL);
     const metrics = newMetrics();
     const runtime = buildRuntime(options, log);
+    // Keys this computer's accounts server-side; the label above is display
+    // only. Only a runtime that reports accounts needs one.
+    const machineIdValue = runtime.account ? machineId({ ...process.env, ...options.env }) : undefined;
     // A credential file written by 0.1.0 stores a socket URL on a host that only
     // ever answers 403. Upgrading the CLI would not have fixed those installs on
     // its own — the stored value wins over the constant — so say what happened
@@ -914,6 +1022,67 @@ export async function runAgentHarness(options) {
     /** Accepted, not yet reported — the executing run and everything queued. */
     const accepted = new Map();
     const heartbeats = new HeartbeatLoop({ api, log, intervalMs: options.heartbeatIntervalMs });
+    const status = new RuntimeStatusReporter({
+        runtime: runtime.runtimeName,
+        provider: options.quotaProvider === undefined
+            ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
+            : (options.quotaProvider ?? undefined),
+        accounts: runtime.account
+            ? () => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing))
+            : undefined,
+        // A run in flight reports fresh numbers when it ends; don't probe beside it.
+        isBusy: () => [...accepted.values()].some((entry) => entry.executing),
+        log,
+    });
+    runtime.observe = (observation) => status.observe(observation);
+    runtime.model = () => (runtime.brain === 'plain' ? undefined : status.model());
+    let statusPrimed = false;
+    /**
+     * First-connect facts that need no run: the CLI's version and any model the
+     * exec string or Codex config pins. Done lazily — only once a server has
+     * asked for status — so nothing is probed for a server that can't use it.
+     */
+    const primeStatus = () => {
+        if (statusPrimed || runtime.brain === 'plain')
+            return;
+        statusPrimed = true;
+        const binary = runtime.brain === 'codex'
+            ? codexBinary(options.exec)
+            : (options.exec.trim().split(/\s+/)[0] ?? 'claude');
+        const probe = options.probeImpl ?? defaultProbe;
+        let version;
+        try {
+            version = parseVersion(probe(`${binary} --version`, runtime.workdir).stdout);
+        }
+        catch {
+            version = undefined;
+        }
+        status.observe({
+            runtime_version: version,
+            model: modelFromExec(options.exec) ??
+                (runtime.brain === 'codex'
+                    ? codexConfiguredModel({ ...process.env, ...options.env, ...runtime.account?.spawnEnv() })
+                    : undefined),
+        });
+    };
+    /**
+     * An operator picked another account in ProhostAI. Applied from the next
+     * run: the run in flight (if any) finishes on the account it started on.
+     */
+    const applyAccountPick = (key, via, requestedAt) => {
+        if (!runtime.account)
+            return false;
+        const outcome = runtime.account.apply(key, requestedAt);
+        if (!outcome.applied) {
+            log(`${timestamp()} ! account change from ProhostAI ignored (${via}): ${outcome.reason}`);
+            return false;
+        }
+        if (outcome.changed) {
+            log(`${timestamp()} ⚙ account: ${outcome.record.label} (picked in ProhostAI) — used from the next run`);
+            status.accountsChanged();
+        }
+        return true;
+    };
     let queue = Promise.resolve();
     let fatal;
     let attempt = 0;
@@ -1001,6 +1170,7 @@ export async function runAgentHarness(options) {
     // any cancellation the heartbeat loop started and deliberately did not wait
     // for, so the harness never exits with a run half-closed.
     await queue;
+    status.detach();
     // Stopped first, so no further tick can start work after the wait below has
     // taken its snapshot of `background`.
     heartbeats.stop();
@@ -1069,6 +1239,7 @@ export async function runAgentHarness(options) {
                     type: 'auth',
                     api_key: options.credentials.api_key,
                     machine,
+                    ...(machineIdValue ? { machine_id: machineIdValue } : {}),
                     client_version: CLI_VERSION,
                     ...(options.credentials.subscription_id
                         ? { subscription_id: options.credentials.subscription_id }
@@ -1102,6 +1273,23 @@ export async function runAgentHarness(options) {
                     // read mention code instead of the run dispatcher.
                     log(`${timestamp()} ● connected as "${name}" — waiting for ` +
                         `${EVENT_AGENT_RUN_REQUESTED} (exec: ${options.exec})`);
+                    // Only a server that says it understands the frame gets one; an
+                    // older server may treat an unknown frame type as a protocol error.
+                    // A pick made while this agent was offline: the server repeats it on
+                    // every connect until a status frame reports the agent on it.
+                    // Its `requested_at` is the newest pick's stamp — a floor for any
+                    // live pick still in flight from before this connect.
+                    const pending = f.agent_config;
+                    if (pending && typeof pending === 'object') {
+                        if (pending.account_key !== undefined) {
+                            applyAccountPick(pending.account_key, 'on connect', pending.requested_at);
+                        }
+                        runtime.account?.noteRequestedAt(pending.requested_at);
+                    }
+                    if (Array.isArray(f.features) && f.features.includes(RUNTIME_STATUS_FEATURE)) {
+                        primeStatus();
+                        status.attach((frame) => ws.send(JSON.stringify(frame)));
+                    }
                     return;
                 }
                 if (f.type === 'auth_error') {
@@ -1132,6 +1320,21 @@ export async function runAgentHarness(options) {
                         /* best-effort */
                     }
                 };
+                if (frame.event === EVENT_AGENT_CONFIG_UPDATED) {
+                    // It changes which subscription this machine spends, so it is held to
+                    // the same signature rule as a run.
+                    if (!verifySignature(options.credentials.webhook_secret, frame.payload, frame.signature) &&
+                        !options.allowUnverified) {
+                        metrics.signatureRejections += 1;
+                        log(`${timestamp()} ✗ rejected ${EVENT_AGENT_CONFIG_UPDATED} — signature did not verify`);
+                        ack(ACK_REJECTED);
+                        return;
+                    }
+                    const data = eventData(frame.payload);
+                    const applied = applyAccountPick(data.account_key, 'live', data.requested_at);
+                    ack(applied ? ACK_ACCEPTED : ACK_IGNORED);
+                    return;
+                }
                 if (frame.event !== EVENT_AGENT_RUN_REQUESTED) {
                     if (frame.event === EVENT_MENTION_CREATED || frame.event === EVENT_MESSAGE_TEAM_CHAT) {
                         // "runs are triggered by mentions" was wrong twice over: the gate
@@ -1244,6 +1447,10 @@ export async function runAgentHarness(options) {
                     // whole of `handleRun`, including the ten minutes of completion
                     // retries at the end of it.
                     release(run.run_id);
+                    // An account picked mid-run was held back from the status frame
+                    // until this run (on the old account) was done; report it now.
+                    if (runtime.account?.changedSinceSpawn())
+                        status.accountsChanged();
                     // Both terminal outcomes reached the completion endpoint; only then
                     // is the run settled and safe to skip on redelivery.
                     if (outcome === 'succeeded')
@@ -1265,6 +1472,7 @@ export async function runAgentHarness(options) {
             });
             ws.on('close', () => {
                 liveness.stop();
+                status.detach();
                 if (options.signal)
                     options.signal.removeEventListener('abort', close);
                 resolve(authed);