@rien7/agent-center-host 0.0.0-stage → 0.1.1

package/dist/cli.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+/**
+ * agent-host CLI.
+ *
+ *   agent-host login [--server URL] [--name NAME]
+ *   agent-host run [--name NAME] [--server URL] [--agent AGENT_NAME] [--runtime ID]
+ *   agent-host doctor [--runtime ID]
+ *
+ * Credentials: ~/.agent-center/host.json (AGENT_CENTER_HOST_CONFIG overrides the path),
+ * or a static token in AGENT_CENTER_TOKEN (e.g. a service principal with agent:host from
+ * `bun run cli principal:create`). Never give the host token to an agent's tools.
+ * Settings (runtime, model, workdir, agents and their tokens): config.ts. The agents'
+ * own tokens are issued by Center to the host (agent-tokens.ts) unless host.json has one.
+ */
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { agentTokensPath } from "./agent-tokens.js";
+import { defaultAgent, loadHostConfig } from "./config.js";
+import { HttpCoreClient } from "./core-client.js";
+import { configPath, loadCredentials, saveCredentials, TokenSource, } from "./credentials.js";
+import { EchoDriver } from "./driver.js";
+import { AgentHost } from "./host.js";
+import { deviceLogin, normalizeServer } from "./login.js";
+import { OarDriver } from "./oar-driver.js";
+const usage = `Usage:
+  agent-host login [--server URL] [--name NAME]
+      Device login: shows a pairing code to approve in the Agent Center app
+      (scope agent:host), then stores the token in ${configPath()} (0600).
+  agent-host run [--name NAME] [--server URL] [--runtime ID] [--agent AGENT_NAME]
+      Register as host NAME (default: host.json name, else the machine name), listen
+      for turns and answer them. The runtime comes from host.json (default claude;
+      pi, … or echo). The agents are host.json's agents[] (default one, 助手); each
+      gets its own restricted Center token from Center (kept in
+      ${agentTokensPath()}) unless host.json gives one.
+      With --runtime echo and no agents, AGENT_NAME is created (default 回声).
+  agent-host doctor [--runtime ID]
+      Check the login, Center, the runtime (installed? logged in?) and the workdir.
+
+Environment: AGENT_CENTER_TOKEN (static token instead of the login file),
+             AGENT_CENTER_SERVER (default server), AGENT_CENTER_HOST_CONFIG (file path),
+             AGENT_HOST_RUNTIME, AGENT_HOST_MODEL, AGENT_HOST_WORKDIR (override host.json),
+             OAR_PI_AGENT_DIR (pi's models.json / auth.json).`;
+const { positionals, values } = parseArgs({
+    allowPositionals: true,
+    options: {
+        server: { type: "string" },
+        name: { type: "string" },
+        agent: { type: "string" },
+        runtime: { type: "string" },
+        help: { type: "boolean", short: "h" },
+    },
+});
+const fail = (message) => {
+    console.error(message);
+    process.exit(1);
+};
+async function login() {
+    const saved = await loadCredentials().catch(() => null);
+    const server = normalizeServer(values.server ??
+        process.env.AGENT_CENTER_SERVER ??
+        saved?.server ??
+        "http://127.0.0.1:8800");
+    const credentials = await deviceLogin({
+        server,
+        clientName: `agent-host ${values.name ?? hostname()}`,
+        clientId: saved?.server === server ? saved.clientId : undefined,
+        prompt: ({ userCode, verificationUri }) => console.log(`Approve the login request in the Agent Center app with pairing code ${userCode}\n(${verificationUri}). Waiting…`),
+    });
+    await saveCredentials(credentials);
+    console.log(`Logged in to ${server}; token saved to ${configPath()}`);
+}
+async function run() {
+    const config = await loadHostConfig();
+    if (values.runtime)
+        config.runtime = values.runtime;
+    const name = values.name ?? config.name ?? hostname();
+    const env = process.env.AGENT_CENTER_TOKEN;
+    let credentials;
+    if (env)
+        credentials = {
+            server: normalizeServer(values.server ??
+                process.env.AGENT_CENTER_SERVER ??
+                "http://127.0.0.1:8800"),
+            accessToken: env,
+        };
+    else {
+        credentials = await loadCredentials();
+        if (!credentials)
+            return fail(`Not logged in: run agent-host login (or set AGENT_CENTER_TOKEN)`);
+        if (values.server && normalizeServer(values.server) !== credentials.server)
+            return fail(`${configPath()} holds a login for ${credentials.server}; run agent-host login --server ${values.server}`);
+    }
+    const tokens = new TokenSource(credentials, {
+        save: env ? undefined : (c) => saveCredentials(c),
+    });
+    const driver = config.runtime === "echo"
+        ? new EchoDriver()
+        : new OarDriver({ config, server: credentials.server });
+    if (driver instanceof OarDriver && !config.agents.length)
+        config.agents = [{ ...defaultAgent }];
+    const host = new AgentHost({
+        client: new HttpCoreClient(tokens),
+        driver,
+        name,
+        agents: config.agents.map((a) => ({
+            ...(a.id ? { id: a.id } : {}),
+            name: a.name,
+            ...(a.role !== undefined ? { role: a.role } : {}),
+            runtime: a.runtime ?? config.runtime,
+            model: a.model ?? config.model ?? null,
+        })),
+        agentName: values.agent,
+    });
+    let stopping = false;
+    const shutdown = () => {
+        if (stopping)
+            process.exit(130);
+        stopping = true;
+        host.log("shutting down");
+        host.stop().then(() => process.exit(0));
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    await host.start();
+}
+/** What `run` needs, checked one by one; exits 1 when something is missing. */
+async function doctor() {
+    const config = await loadHostConfig();
+    if (values.runtime)
+        config.runtime = values.runtime;
+    let ok = true;
+    const line = (good, what, detail = "") => {
+        if (good === false)
+            ok = false;
+        console.log(`${good === null ? "·" : good ? "✓" : "✗"} ${what}${detail ? `: ${detail}` : ""}`);
+    };
+    // Center and the host's login.
+    const env = process.env.AGENT_CENTER_TOKEN;
+    const credentials = env
+        ? {
+            server: normalizeServer(values.server ??
+                process.env.AGENT_CENTER_SERVER ??
+                "http://127.0.0.1:8800"),
+            accessToken: env,
+        }
+        : await loadCredentials().catch(() => null);
+    if (!credentials)
+        line(false, "login", `none in ${configPath()}; run agent-host login`);
+    else {
+        const tokens = new TokenSource(credentials, {
+            save: env ? undefined : (c) => saveCredentials(c),
+        });
+        try {
+            const response = await fetch(`${credentials.server}/v1/ops/core.principal.me`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${await tokens.token()}`,
+                    "content-type": "application/json",
+                },
+                body: "{}",
+            });
+            const body = (await response.json().catch(() => ({})));
+            const scopes = body.data?.principal?.scopes ?? [];
+            if (!response.ok)
+                line(false, "login", `${credentials.server} answered ${response.status}; run agent-host login`);
+            else
+                line(scopes.includes("agent:host"), "login", `${credentials.server} as ${body.data?.principal?.name ?? "?"} (${scopes.join(" ") || "no scopes"}${scopes.includes("agent:host") ? "" : "; needs agent:host"})`);
+        }
+        catch (error) {
+            line(false, "Center", `${credentials.server} unreachable (${error.message})`);
+        }
+    }
+    // The runtime.
+    if (config.runtime === "echo")
+        line(true, "runtime", "echo (no model)");
+    else
+        try {
+            const module = (await import(__rewriteRelativeImportExtension(`@botiverse/oar/runtimes/${config.runtime}`)));
+            const runtime = module[`${config.runtime}Runtime`];
+            if (!runtime)
+                throw new Error(`oar has no runtime ${config.runtime}`);
+            const installation = await runtime.installation?.();
+            if (!installation || installation.kind !== "available")
+                line(false, `runtime ${config.runtime}`, installation?.kind === "unsupported"
+                    ? `unsupported (${installation.reason})`
+                    : `not found${config.runtime === "claude" ? " (install Claude Code: npm i -g @anthropic-ai/claude-code, or set OAR_CLAUDE_BIN)" : ""}`);
+            else {
+                line(true, `runtime ${config.runtime}`, installation.via === "executable"
+                    ? `${installation.command}${installation.version ? ` ${installation.version}` : ""}`
+                    : "bundled");
+                if (runtime.authStatus) {
+                    const status = await runtime.authStatus(installation);
+                    line(status.kind === "logged_in", `${config.runtime} login`, status.kind === "logged_in"
+                        ? [status.account?.email, status.account?.plan, status.source]
+                            .filter(Boolean)
+                            .join(", ")
+                        : `logged out (${status.detail ?? status.source})${config.runtime === "claude" ? "; run claude and /login" : ""}`);
+                }
+                else
+                    line(null, `${config.runtime} login`, "the runtime can't tell");
+            }
+        }
+        catch (error) {
+            line(false, `runtime ${config.runtime}`, error.message);
+        }
+    // The workdir (agents' cwd and memory).
+    try {
+        const probe = join(config.workdir, "agents", ".doctor");
+        await mkdir(probe, { recursive: true });
+        await writeFile(join(probe, "probe.md"), "ok\n");
+        await rm(probe, { recursive: true, force: true });
+        line(true, "workdir", config.workdir);
+    }
+    catch (error) {
+        line(false, "workdir", `${config.workdir} (${error.message})`);
+    }
+    const agents = config.agents.length ? config.agents : [defaultAgent];
+    for (const a of agents)
+        line(null, `agent ${a.name}`, `${a.runtime ?? config.runtime}${(a.model ?? config.model) ? ` ${a.model ?? config.model}` : ""}, token ${a.token ? "from host.json" : `issued by Center (${agentTokensPath()})`}`);
+    line(null, "sub-agents", config.subagents ? "on" : "off");
+    process.exit(ok ? 0 : 1);
+}
+if (values.help)
+    console.log(usage);
+else if (positionals[0] === "login")
+    await login();
+else if (positionals[0] === "run")
+    await run();
+else if (positionals[0] === "doctor")
+    await doctor();
+else
+    fail(usage);

package/dist/config.js

@@ -0,0 +1,86 @@
+/**
+ * Host settings, read from the same file as the credentials (`~/.agent-center/host.json`):
+ *
+ * ```json
+ * {
+ *   "server": "https://…", "accessToken": "ac_…",          // the host's own login
+ *   "runtime": "claude",            // default oar runtime: claude (default), pi, … or echo
+ *   "model": "sonnet",              // default model (runtime-specific, e.g. pi "provider/id")
+ *   "workdir": "~/.agent-center/work",
+ *   "timeZone": "Asia/Shanghai",    // for 「今天」 and the time line in prompts
+ *   "idleMinutes": 15,              // close an agent's session after this long without turns
+ *   "contextTools": "inline",       // the context's domain tools: inlined once (default) or "direct" MCP tools
+ *   "piAgentDir": "…",              // pi's agent dir (models.json, auth.json); OAR_PI_AGENT_DIR
+ *   "subagents": true,              // main agents may spawn sub-agents (agent_spawn …)
+ *   "agents": [                     // default: one agent 「助手」
+ *     { "name": "助手", "role": "…", "runtime": "pi", "model": "…",
+ *       "scopes": ["memo:write"],   // write scopes of its auto-issued token (default memo, reminder, calendar)
+ *       "token": "ac_…",            // …or a token made by hand (kind=agent, never agent:host)
+ *       "tokenEnv": "AGENT_TOKEN_ASSISTANT" }   // …or the env var holding it
+ *   ]
+ * }
+ * ```
+ */
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { configPath } from "./credentials.js";
+/** The agent a host runs when host.json names none. */
+export const defaultAgent = { name: "助手" };
+const expand = (path) => path === "~" || path.startsWith("~/")
+    ? join(homedir(), path.slice(1))
+    : resolve(path);
+export const defaultTimeZone = () => Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+export function parseHostConfig(value, env = process.env) {
+    const str = (key) => typeof value[key] === "string" && value[key]
+        ? value[key]
+        : undefined;
+    const agents = Array.isArray(value.agents) ? value.agents : [];
+    return {
+        name: str("name"),
+        runtime: env.AGENT_HOST_RUNTIME ?? str("runtime") ?? "claude",
+        model: env.AGENT_HOST_MODEL ?? str("model"),
+        workdir: expand(env.AGENT_HOST_WORKDIR ?? str("workdir") ?? "~/.agent-center/work"),
+        timeZone: str("timeZone") ?? defaultTimeZone(),
+        idleMinutes: typeof value.idleMinutes === "number" && value.idleMinutes > 0
+            ? value.idleMinutes
+            : 15,
+        contextTools: value.contextTools === "direct" ? "direct" : "inline",
+        subagents: value.subagents !== false,
+        piAgentDir: env.OAR_PI_AGENT_DIR ??
+            (str("piAgentDir") ? expand(str("piAgentDir")) : undefined),
+        agents: agents.map((raw, index) => {
+            const a = raw;
+            if (typeof a?.name !== "string" || !a.name)
+                throw new Error(`agents[${index}] needs a name`);
+            const token = (typeof a.tokenEnv === "string" ? env[a.tokenEnv] : undefined) ??
+                (typeof a.token === "string" ? a.token : undefined);
+            return {
+                ...(typeof a.id === "string" ? { id: a.id } : {}),
+                name: a.name,
+                ...(typeof a.role === "string" || a.role === null
+                    ? { role: a.role }
+                    : {}),
+                ...(typeof a.runtime === "string" ? { runtime: a.runtime } : {}),
+                ...(typeof a.model === "string" ? { model: a.model } : {}),
+                ...(token ? { token } : {}),
+                ...(Array.isArray(a.scopes) ? { scopes: a.scopes.map(String) } : {}),
+                ...(Array.isArray(a.disallowedTools)
+                    ? { disallowedTools: a.disallowedTools.map(String) }
+                    : {}),
+            };
+        }),
+    };
+}
+/** Settings from host.json (missing file: defaults, no agents). */
+export async function loadHostConfig(path = configPath(), env = process.env) {
+    let value = {};
+    try {
+        value = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return parseHostConfig(value, env);
+}

package/dist/core-client.js

@@ -0,0 +1,151 @@
+/** An error response from Center (`{error:{code,message,details}}`). */
+export class CoreError extends Error {
+    status;
+    code;
+    details;
+    constructor(status, code, message, details) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.details = details;
+    }
+}
+export class HttpCoreClient {
+    tokens;
+    fetcher;
+    constructor(tokens, options = {}) {
+        this.tokens = tokens;
+        this.fetcher = options.fetch ?? fetch;
+    }
+    async send(path, init) {
+        for (let attempt = 0;; attempt++) {
+            const response = await this.fetcher(`${this.tokens.server}${path}`, {
+                ...init,
+                headers: {
+                    ...init.headers,
+                    authorization: `Bearer ${await this.tokens.token()}`,
+                },
+            });
+            if (response.status === 401 && attempt === 0) {
+                await response.body?.cancel();
+                if (await this.tokens.rejected())
+                    continue;
+            }
+            return response;
+        }
+    }
+    async op(name, input, idempotencyKey) {
+        const response = await this.send(`/v1/ops/agent.${name}`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...(idempotencyKey ? { "idempotency-key": idempotencyKey } : {}),
+            },
+            body: JSON.stringify(input),
+        });
+        const body = (await response.json().catch(() => ({})));
+        if (!response.ok || body.data === undefined)
+            throw new CoreError(response.status, body.error?.code ?? "http", body.error?.message ?? `agent.${name} failed with ${response.status}`, body.error?.details);
+        return body.data;
+    }
+    register(name) {
+        return this.op("host.register", { name });
+    }
+    upsertAgent(input) {
+        return this.op("agent.upsert", input);
+    }
+    heartbeat() {
+        return this.op("host.heartbeat", {});
+    }
+    issueToken(agentId, scopes = []) {
+        return this.op("agent.issue_token", { agentId, scopes });
+    }
+    openTurn(input) {
+        return this.op("turn.open", input, `open-${input.id}`);
+    }
+    markInactive(input) {
+        return this.op("history.mark_inactive", input);
+    }
+    async claim(input) {
+        return (await this.op("turn.claim", input)).items;
+    }
+    append(turnId, events, seq) {
+        return this.op("event.append", { turnId, events }, `ev-${turnId}-${seq}`);
+    }
+    finish(turnId, state, error) {
+        return this.op("turn.finish", { turnId, state, ...(error ? { error } : {}) });
+    }
+    async memoryList(agentId) {
+        return (await this.op("memory_file.list", {
+            agentId,
+        })).items;
+    }
+    memoryGet(agentId, path) {
+        return this.op("memory_file.get", { agentId, path });
+    }
+    memoryPut(input) {
+        return this.op("memory_file.put", input);
+    }
+    async *events(hostId, signal) {
+        const response = await this.send(`/v1/agent/events?hostId=${encodeURIComponent(hostId)}`, { headers: { accept: "text/event-stream" }, signal });
+        if (!response.ok || !response.body) {
+            const body = (await response.json().catch(() => ({})));
+            throw new CoreError(response.status, body.error?.code ?? "http", body.error?.message ?? `events stream failed with ${response.status}`);
+        }
+        for await (const frame of parseSse(response.body))
+            yield frame.event === "comment"
+                ? { type: "heartbeat" }
+                : JSON.parse(frame.data);
+    }
+}
+/**
+ * Server-Sent Events framing. A chunk of only comments (the server's `: heartbeat`)
+ * yields `{event: "comment"}` so callers can tell the connection is alive; `retry:` and
+ * empty chunks are skipped.
+ */
+export async function* parseSse(body) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                return;
+            buffer += decoder.decode(value, { stream: true }).replace(/\r\n?/g, "\n");
+            let cut = buffer.indexOf("\n\n");
+            while (cut >= 0) {
+                const chunk = buffer.slice(0, cut);
+                buffer = buffer.slice(cut + 2);
+                const frame = { event: "message", data: "" };
+                const data = [];
+                let comment = false;
+                for (const line of chunk.split("\n")) {
+                    if (line.startsWith(":"))
+                        comment = true;
+                    if (!line || line.startsWith(":"))
+                        continue;
+                    const colon = line.indexOf(":");
+                    const field = colon < 0 ? line : line.slice(0, colon);
+                    const value = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+                    if (field === "event")
+                        frame.event = value;
+                    else if (field === "id")
+                        frame.id = value;
+                    else if (field === "data")
+                        data.push(value);
+                }
+                frame.data = data.join("\n");
+                if (data.length)
+                    yield frame;
+                else if (comment)
+                    yield { event: "comment", data: "" };
+                cut = buffer.indexOf("\n\n");
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+        await body.cancel().catch(() => { });
+    }
+}

package/dist/credentials.js

@@ -0,0 +1,117 @@
+/**
+ * Host credentials in `~/.agent-center/host.json` (mode 0600, directory 0700).
+ *
+ * The token is the host's own credential and carries `agent:host` (claim turns, write
+ * replies, keep memory files). Per-agent tokens (`agents[].token` in the same file, see
+ * config.ts: what an agent's tools use to call Center) are separate, narrower credentials
+ * and must never carry `agent:host`: an agent that could act as a host could claim other
+ * agents' turns and write their replies.
+ */
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export function configPath(env = process.env) {
+    return (env.AGENT_CENTER_HOST_CONFIG ??
+        join(homedir(), ".agent-center", "host.json"));
+}
+export async function loadCredentials(path = configPath()) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const value = JSON.parse(text);
+    if (typeof value.server !== "string" || typeof value.accessToken !== "string")
+        throw new Error(`${path} is not a host credential file`);
+    return value;
+}
+/**
+ * Atomic write; the file is created 0600 and never exists with wider permissions. Other
+ * settings in the file (runtime, agents, … see config.ts) are kept.
+ */
+export async function saveCredentials(credentials, path = configPath()) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    let existing = {};
+    try {
+        existing = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch { }
+    const merged = { ...existing, ...credentials };
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(merged, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    await chmod(temporary, 0o600);
+    await rename(temporary, path);
+}
+export const deviceGrantType = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * Hands out a valid bearer token. OAuth credentials are refreshed shortly before they
+ * expire (and once on a 401); rotated tokens are persisted through `save`.
+ */
+export class TokenSource {
+    credentials;
+    refreshing = null;
+    save;
+    fetcher;
+    constructor(credentials, options = {}) {
+        this.credentials = credentials;
+        this.save = options.save ?? (async () => { });
+        this.fetcher = options.fetch ?? fetch;
+    }
+    get server() {
+        return this.credentials.server;
+    }
+    get canRefresh() {
+        return !!(this.credentials.refreshToken && this.credentials.clientId);
+    }
+    async token() {
+        const expires = this.credentials.accessExpiresAt;
+        if (this.canRefresh &&
+            expires !== undefined &&
+            expires - Date.now() < 60_000)
+            await this.refresh();
+        return this.credentials.accessToken;
+    }
+    /** After a 401: refresh if possible. Returns whether a retry may help. */
+    async rejected() {
+        if (!this.canRefresh)
+            return false;
+        await this.refresh();
+        return true;
+    }
+    refresh() {
+        this.refreshing ??= this.doRefresh().finally(() => {
+            this.refreshing = null;
+        });
+        return this.refreshing;
+    }
+    async doRefresh() {
+        const c = this.credentials;
+        const response = await this.fetcher(`${c.server}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: c.clientId ?? "",
+                refresh_token: c.refreshToken ?? "",
+            }).toString(),
+        });
+        const data = (await response.json().catch(() => ({})));
+        if (!response.ok ||
+            typeof data.access_token !== "string" ||
+            typeof data.refresh_token !== "string")
+            throw new Error(`Token refresh failed (${String(data.error ?? response.status)}); run agent-host login again`);
+        this.credentials = {
+            ...c,
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            accessExpiresAt: Date.now() + Number(data.expires_in ?? 3600) * 1000,
+        };
+        await this.save(this.credentials);
+    }
+}