@runuai/host 0.8.5 → 0.8.6

package/lib/engines.ts

@@ -0,0 +1,486 @@
+/**
+ * Engine connect/disconnect for the local host UI (ADR-028, ADR-044 P2).
+ *
+ * A single descriptor table for the AI coding engines the host can run
+ * (Claude, Codex, Kimi, Grok, Cursor) plus the connect/disconnect/status logic
+ * the local UI drives. This is the host-side twin of the desktop's
+ * `apps/host-desktop/src/llm.ts`, but it writes the `.env.local` the RUNNING
+ * launchd/npm host reads (UAI_HOME) and sets `process.env` so a connect takes
+ * effect WITHOUT a host restart — the adapters' `available()` and task-up's env
+ * injection both read `process.env`.
+ *
+ * Three auth modes:
+ *   - token-command  (Claude): `claude setup-token` prints a token to stdout;
+ *                    we capture it (an `sk-ant-oat…` value) and persist it as
+ *                    CLAUDE_CODE_OAUTH_TOKEN. A pasted token is accepted too.
+ *   - login-command  (Codex/Kimi/Grok): `<cli> login` runs a browser OAuth and
+ *                    writes a config file; success = that file appearing.
+ *   - api-key        (Cursor): no command — persist a pasted CURSOR_API_KEY.
+ *
+ * Detection mirrors each adapter's `available()`: env/`.env.local` for
+ * claude/cursor, a config file under the owner home for codex/kimi/grok.
+ *
+ * Every side-effecting seam (spawn, the `.env.local` path, the owner home,
+ * process.env) is injectable so the flows are unit-testable without touching
+ * the real filesystem or spawning anything.
+ */
+
+import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+import { env } from "./env";
+
+export type EngineKind = "claude" | "codex" | "kimi" | "grok" | "cursor";
+export type EngineAuthMode = "token-command" | "login-command" | "api-key";
+
+/** One entry of the engine catalog the UI's "Add engine" panel renders. */
+export interface EngineCatalogEntry {
+  kind: EngineKind;
+  label: string;
+  authMode: EngineAuthMode;
+  /** One-line help shown under the engine in the picker. */
+  notes: string | null;
+  /** Where to mint an API key (api-key mode only). */
+  getKeyUrl: string | null;
+}
+
+interface EngineDescriptor {
+  label: string;
+  authMode: EngineAuthMode;
+  notes: string;
+  getKeyUrl?: string;
+}
+
+/** Static descriptor table — the single source of truth for engine metadata. */
+const DESCRIPTORS: Record<EngineKind, EngineDescriptor> = {
+  claude: {
+    label: "Claude",
+    authMode: "token-command",
+    notes:
+      "Opens your browser to authorize Claude, then captures the token automatically.",
+  },
+  codex: {
+    label: "Codex",
+    authMode: "login-command",
+    notes: "Opens your browser to sign in to your OpenAI Codex account.",
+  },
+  kimi: {
+    label: "Kimi Code",
+    authMode: "login-command",
+    notes:
+      "Sign in with your Moonshot Kimi Code subscription. Activates after the next image rebuild.",
+  },
+  grok: {
+    label: "Grok",
+    authMode: "login-command",
+    notes:
+      "Sign in with your xAI Grok subscription. Activates after the next image rebuild.",
+  },
+  cursor: {
+    label: "Cursor",
+    authMode: "api-key",
+    notes: "Paste a Cursor API key. Requires Cursor Pro.",
+    getKeyUrl: "https://cursor.com/dashboard?tab=integrations",
+  },
+};
+
+/** Display order (matches the cloud picker's ordering intent). */
+const ORDER: EngineKind[] = ["claude", "codex", "kimi", "grok", "cursor"];
+
+// ---------------------------------------------------------------------------
+// Injectable seams.
+// ---------------------------------------------------------------------------
+
+/** How a login/token command is spawned. Tests provide a fake. */
+export type EngineSpawn = (command: string, args: string[]) => ChildProcess;
+
+export interface EngineSeams {
+  /** Spawn a CLI, piping stdout/stderr. */
+  spawn: EngineSpawn;
+  /** Absolute path to the `.env.local` the running host reads (UAI_HOME). */
+  envLocalPath: () => string;
+  /** The owner's real home — where codex/kimi/grok write their config dirs. */
+  ownerHome: () => string;
+  /** The live process env (adapters + task-up read creds from here). */
+  procEnv: NodeJS.ProcessEnv;
+}
+
+function defaultSeams(): EngineSeams {
+  return {
+    spawn: (command, args) =>
+      nodeSpawn(command, args, { stdio: ["ignore", "pipe", "pipe"] }),
+    envLocalPath: () => join(env.uaiHome, ".env.local"),
+    ownerHome: () => process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    procEnv: process.env,
+  };
+}
+
+function withDefaults(seams: Partial<EngineSeams>): EngineSeams {
+  return { ...defaultSeams(), ...seams };
+}
+
+// ---------------------------------------------------------------------------
+// Public catalog / status.
+// ---------------------------------------------------------------------------
+
+/** The static engine catalog (kind, label, authMode, notes, getKeyUrl). */
+export function engineCatalog(): EngineCatalogEntry[] {
+  return ORDER.map((kind) => {
+    const d = DESCRIPTORS[kind];
+    return {
+      kind,
+      label: d.label,
+      authMode: d.authMode,
+      notes: d.notes,
+      getKeyUrl: d.getKeyUrl ?? null,
+    };
+  });
+}
+
+/** kind → connected, for every engine. */
+export function engineStatuses(
+  seams: Partial<EngineSeams> = {},
+): Record<EngineKind, boolean> {
+  const s = withDefaults(seams);
+  return {
+    claude: detect("claude", s),
+    codex: detect("codex", s),
+    kimi: detect("kimi", s),
+    grok: detect("grok", s),
+    cursor: detect("cursor", s),
+  };
+}
+
+/** Whether a single engine is connected on this host right now. */
+export function detectEngine(
+  kind: EngineKind,
+  seams: Partial<EngineSeams> = {},
+): boolean {
+  return detect(kind, withDefaults(seams));
+}
+
+export function isEngineKind(value: unknown): value is EngineKind {
+  return (
+    value === "claude" ||
+    value === "codex" ||
+    value === "kimi" ||
+    value === "grok" ||
+    value === "cursor"
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Connect / disconnect.
+// ---------------------------------------------------------------------------
+
+export interface ConnectOptions {
+  /** api-key mode: the pasted key (Cursor). */
+  apiKey?: string;
+  /** token-command manual fallback: a pasted token (Claude). */
+  pastedToken?: string;
+}
+
+export interface ConnectResult {
+  ok: boolean;
+  message: string;
+}
+
+/**
+ * Connect an engine. api-key/paste resolve synchronously; login/token spawn a
+ * CLI and stream its output to `onLog` (the browser OAuth happens meanwhile).
+ */
+export async function connectEngine(
+  kind: EngineKind,
+  opts: ConnectOptions,
+  onLog: (line: string) => void,
+  seams: Partial<EngineSeams> = {},
+): Promise<ConnectResult> {
+  const s = withDefaults(seams);
+  const d = DESCRIPTORS[kind];
+
+  if (d.authMode === "api-key") {
+    const key = (opts.apiKey ?? "").trim();
+    if (!key) return { ok: false, message: `Paste your ${d.label} API key.` };
+    if (/\s/.test(key) || key.length < 8) {
+      return {
+        ok: false,
+        message: "That doesn't look like an API key. Paste just the value.",
+      };
+    }
+    upsertEnvLocal("CURSOR_API_KEY", key, s);
+    return { ok: true, message: `${d.label} connected.` };
+  }
+
+  if (d.authMode === "token-command") {
+    // Manual paste fallback — accept a token without spawning the CLI.
+    if (opts.pastedToken !== undefined) {
+      const token = opts.pastedToken.trim();
+      if (!token) return { ok: false, message: "Paste a token." };
+      if (/\s/.test(token) || token.length < 20) {
+        return {
+          ok: false,
+          message: "That doesn't look like a token. Paste just the value.",
+        };
+      }
+      upsertEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", token, s);
+      return { ok: true, message: `${d.label} connected.` };
+    }
+    return runTokenCommand(kind, d.label, onLog, s);
+  }
+
+  return runLoginCommand(kind, d.label, onLog, s);
+}
+
+/** Disconnect an engine: forget its credential (env line and/or config file). */
+export function disconnectEngine(
+  kind: EngineKind,
+  seams: Partial<EngineSeams> = {},
+): void {
+  const s = withDefaults(seams);
+  if (kind === "cursor") {
+    removeEnvLocal("CURSOR_API_KEY", s);
+    return;
+  }
+  if (kind === "claude") {
+    removeEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", s);
+    removeEnvLocal("ANTHROPIC_API_KEY", s);
+    removeEnvLocal("ANTHROPIC_AUTH_TOKEN", s);
+    return;
+  }
+  // login-command engines: remove the config file the adapter detects.
+  try {
+    rmSync(configPath(kind, s), { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+/**
+ * Extract a Claude OAuth token from `claude setup-token` stdout. The CLI prints
+ * the token (an `sk-ant-oat…` value) on its own line near the end; scan from the
+ * bottom for it, falling back to a lone long token-charset line.
+ */
+export function extractClaudeToken(stdout: string): string | null {
+  const lines = stdout
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const m = /(sk-ant-[A-Za-z0-9_-]{16,})/.exec(lines[i] ?? "");
+    if (m?.[1]) return m[1];
+  }
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = lines[i] ?? "";
+    if (/^[A-Za-z0-9_-]{40,}$/.test(line)) return line;
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Internals.
+// ---------------------------------------------------------------------------
+
+function detect(kind: EngineKind, s: EngineSeams): boolean {
+  switch (kind) {
+    case "claude":
+      return (
+        envOrFileHas("CLAUDE_CODE_OAUTH_TOKEN", s) ||
+        envOrFileHas("ANTHROPIC_API_KEY", s) ||
+        envOrFileHas("ANTHROPIC_AUTH_TOKEN", s)
+      );
+    case "cursor":
+      return envOrFileHas("CURSOR_API_KEY", s);
+    case "codex":
+    case "kimi":
+    case "grok":
+      return existsSync(configPath(kind, s));
+  }
+}
+
+/** True when `key` is set in process.env or present in `.env.local`. */
+function envOrFileHas(key: string, s: EngineSeams): boolean {
+  if (s.procEnv[key]) return true;
+  try {
+    const body = readFileSync(s.envLocalPath(), "utf8");
+    return new RegExp(`^${key}=.+`, "m").test(body);
+  } catch {
+    return false;
+  }
+}
+
+/** Config file whose presence gates a login-command engine. */
+function configPath(kind: EngineKind, s: EngineSeams): string {
+  const home = s.ownerHome();
+  if (kind === "codex") return join(home, ".codex", "auth.json");
+  if (kind === "kimi") {
+    return join(home, ".kimi-code", "credentials", "kimi-code.json");
+  }
+  return join(home, ".grok", "auth.json");
+}
+
+/** Resolve the login/token CLI binary — absolute for kimi/grok, else on PATH. */
+function resolveBin(kind: EngineKind, s: EngineSeams): string {
+  if (kind === "kimi") {
+    const local = join(s.ownerHome(), ".kimi-code", "bin", "kimi");
+    return existsSync(local) ? local : "kimi";
+  }
+  if (kind === "grok") {
+    const local = join(s.ownerHome(), ".grok", "bin", "grok");
+    return existsSync(local) ? local : "grok";
+  }
+  // claude / codex are on PATH.
+  return kind;
+}
+
+function runTokenCommand(
+  kind: EngineKind,
+  label: string,
+  onLog: (line: string) => void,
+  s: EngineSeams,
+): Promise<ConnectResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (r: ConnectResult): void => {
+      if (!settled) {
+        settled = true;
+        resolve(r);
+      }
+    };
+    let child: ChildProcess;
+    try {
+      child = s.spawn(resolveBin(kind, s), ["setup-token"]);
+    } catch (err) {
+      done({ ok: false, message: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    let stdout = "";
+    child.stdout?.on("data", (b: Buffer) => {
+      const text = b.toString("utf8");
+      stdout += text;
+      relay(text, onLog);
+    });
+    child.stderr?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.on("error", (err: NodeJS.ErrnoException) =>
+      done({
+        ok: false,
+        message:
+          err.code === "ENOENT"
+            ? `${label} CLI not found on PATH — install Claude Code first.`
+            : err.message,
+      }),
+    );
+    child.on("exit", () => {
+      const token = extractClaudeToken(stdout);
+      if (!token) {
+        done({
+          ok: false,
+          message:
+            "Couldn't read a token from the CLI output. Try again, or paste the token manually.",
+        });
+        return;
+      }
+      upsertEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", token, s);
+      done({ ok: true, message: `${label} connected.` });
+    });
+  });
+}
+
+function runLoginCommand(
+  kind: EngineKind,
+  label: string,
+  onLog: (line: string) => void,
+  s: EngineSeams,
+): Promise<ConnectResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (r: ConnectResult): void => {
+      if (!settled) {
+        settled = true;
+        resolve(r);
+      }
+    };
+    let child: ChildProcess;
+    try {
+      child = s.spawn(resolveBin(kind, s), ["login"]);
+    } catch (err) {
+      done({ ok: false, message: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    child.stdout?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.stderr?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.on("error", (err: NodeJS.ErrnoException) =>
+      done({
+        ok: false,
+        message:
+          err.code === "ENOENT"
+            ? `${label} CLI not found — install it first.`
+            : err.message,
+      }),
+    );
+    child.on("exit", () => {
+      done(
+        detect(kind, s)
+          ? { ok: true, message: `${label} connected.` }
+          : { ok: false, message: `${label} login didn't complete.` },
+      );
+    });
+  });
+}
+
+function relay(text: string, onLog: (line: string) => void): void {
+  for (const l of text.split(/\r?\n/)) {
+    if (l.trim()) onLog(l.trim());
+  }
+}
+
+/** Upsert KEY=value into the host's `.env.local` (0600) AND process.env. */
+function upsertEnvLocal(key: string, value: string, s: EngineSeams): void {
+  const file = s.envLocalPath();
+  mkdirSync(dirname(file), { recursive: true });
+  let body = "";
+  try {
+    body = readFileSync(file, "utf8");
+  } catch {
+    /* new file */
+  }
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^${key}=.*$`, "m");
+  body = re.test(body)
+    ? body.replace(re, line)
+    : body + (body && !body.endsWith("\n") ? "\n" : "") + line + "\n";
+  writeFileSync(file, body, { mode: 0o600 });
+  try {
+    chmodSync(file, 0o600);
+  } catch {
+    /* best effort */
+  }
+  // Immediate effect: the running host reads creds from process.env (adapters'
+  // available() + task-up env injection), not by reloading .env.local — so set
+  // it here or a connect wouldn't take effect until a restart.
+  s.procEnv[key] = value;
+}
+
+/** Remove a KEY line from `.env.local` and process.env (no-op if absent). */
+function removeEnvLocal(key: string, s: EngineSeams): void {
+  const file = s.envLocalPath();
+  try {
+    const body = readFileSync(file, "utf8");
+    const next = body
+      .split(/\r?\n/)
+      .filter((l) => !new RegExp(`^${key}=`).test(l))
+      .join("\n");
+    writeFileSync(file, next, { mode: 0o600 });
+  } catch {
+    /* no file */
+  }
+  delete s.procEnv[key];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/src/main.ts

@@ -180,6 +180,9 @@ async function startLocalUi(): Promise<void> {
       hostId,
       logPath: serviceLogPath(),
       taskMemory: dockerMemoryBytes,
+      // Engine connect/disconnect in the local UI re-advertises capabilities so
+      // the cloud's task picker reflects a newly-configured engine promptly.
+      readvertise: sendCapabilities,
     });
     console.log(`[host-agent] local UI on http://127.0.0.1:${handle.port}`);
   } catch (err) {

package/src/ui/server.ts

@@ -27,8 +27,18 @@ import { schema, type Db } from "../../lib/db";
 import { parsePreviewPortRuntimes } from "../../lib/preview-ports";
 import { getCloudState } from "../../lib/cloud-state";
 import { dockerCli } from "../../lib/docker-exec";
+import {
+  connectEngine,
+  disconnectEngine,
+  engineCatalog,
+  engineStatuses,
+  isEngineKind,
+} from "../../lib/engines";
+import { ensureStandardImage } from "../../lib/standard-image";
 import {
   CloudResponse,
+  EngineOpResponse,
+  EnginesResponse,
   EventsResponse,
   StatusResponse,
   TasksResponse,
@@ -55,6 +65,12 @@ export interface UiServerOptions {
   logPath: string;
   /** Best-effort container memory by compose project; null on failure. */
   taskMemory?: (composeProject: string) => Promise<number | null>;
+  /**
+   * Re-advertise host capabilities to the cloud (ADR-021). Wired from main.ts
+   * (`sendCapabilities`) so an engine connect/disconnect updates the cloud's
+   * task picker promptly. Optional (tests omit it).
+   */
+  readvertise?: () => void;
 }
 
 export interface UiServerHandle {
@@ -121,8 +137,20 @@ async function handle(
   opts: UiServerOptions,
 ): Promise<void> {
   const path = (req.url ?? "/").split("?")[0] ?? "/";
+  const method = req.method ?? "GET";
   try {
-    if (req.method !== "GET") {
+    // POST — engine connect/disconnect (the only writes; localhost-bound, so
+    // the loopback binding is the perimeter, ADR-028).
+    if (method === "POST") {
+      switch (path) {
+        case "/api/engines/connect":
+          return await handleEngineConnect(req, res, opts);
+        case "/api/engines/disconnect":
+          return await handleEngineDisconnect(req, res, opts);
+      }
+      return sendError(res, 404, `no such endpoint: ${path}`);
+    }
+    if (method !== "GET") {
       return sendError(res, 405, "method not allowed");
     }
     switch (path) {
@@ -144,6 +172,8 @@ async function handle(
         return sendJson(res, EventsResponse, eventsBody(opts));
       case "/api/users":
         return sendJson(res, UsersResponse, usersBody(opts));
+      case "/api/engines":
+        return sendJson(res, EnginesResponse, enginesBody());
     }
     if (path.startsWith("/api/")) {
       return sendError(res, 404, `no such endpoint: ${path}`);
@@ -154,6 +184,105 @@ async function handle(
   }
 }
 
+// --- engines ----------------------------------------------------------------
+
+function enginesBody(): EnginesResponse {
+  return { catalog: engineCatalog(), statuses: engineStatuses() };
+}
+
+/**
+ * POST /api/engines/connect `{kind, apiKey?, pastedToken?}`.
+ *
+ * Streams the connect as newline-delimited JSON (`application/x-ndjson`): each
+ * live CLI log line is `{"line":"…"}`, and a final `{"done":true,"ok":…,
+ * "message":"…"}` carries the result. api-key/paste connects emit no log lines
+ * and just the final frame. On success we re-advertise and kick a (best-effort)
+ * standard-image rebuild so a newly-configured engine's CLI gets installed.
+ */
+async function handleEngineConnect(
+  req: IncomingMessage,
+  res: ServerResponse,
+  opts: UiServerOptions,
+): Promise<void> {
+  const body = await readJsonBody(req);
+  const kind = body?.kind;
+  if (!isEngineKind(kind)) {
+    return sendError(res, 400, "unknown or missing engine kind");
+  }
+  const apiKey = typeof body?.apiKey === "string" ? body.apiKey : undefined;
+  const pastedToken =
+    typeof body?.pastedToken === "string" ? body.pastedToken : undefined;
+
+  res.writeHead(200, {
+    "content-type": "application/x-ndjson; charset=utf-8",
+    "cache-control": "no-store",
+  });
+  const emit = (obj: unknown): void => {
+    res.write(`${JSON.stringify(obj)}\n`);
+  };
+
+  let result: { ok: boolean; message: string };
+  try {
+    result = await connectEngine(
+      kind,
+      { apiKey, pastedToken },
+      (line) => emit({ line }),
+    );
+  } catch (err) {
+    result = {
+      ok: false,
+      message: err instanceof Error ? err.message : "connect failed",
+    };
+  }
+  if (result.ok) {
+    // Re-advertise so the cloud picker offers the engine; rebuild the image so
+    // an optional engine's CLI (kimi/grok/cursor) is installed. Best-effort.
+    opts.readvertise?.();
+    void ensureStandardImage();
+  }
+  emit({ done: true, ok: result.ok, message: result.message });
+  res.end();
+}
+
+/** POST /api/engines/disconnect `{kind}` → forget the credential + re-advertise. */
+async function handleEngineDisconnect(
+  req: IncomingMessage,
+  res: ServerResponse,
+  opts: UiServerOptions,
+): Promise<void> {
+  const body = await readJsonBody(req);
+  const kind = body?.kind;
+  if (!isEngineKind(kind)) {
+    return sendError(res, 400, "unknown or missing engine kind");
+  }
+  disconnectEngine(kind);
+  opts.readvertise?.();
+  return sendJson(res, EngineOpResponse, { ok: true });
+}
+
+/** Read a request body and parse it as a JSON object; null on empty/invalid. */
+async function readJsonBody(
+  req: IncomingMessage,
+): Promise<Record<string, unknown> | null> {
+  const chunks: Buffer[] = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = chunk as Buffer;
+    size += buf.length;
+    if (size > 64 * 1024) throw new Error("request body too large");
+    chunks.push(buf);
+  }
+  if (chunks.length === 0) return null;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 // --- handlers ---------------------------------------------------------------
 
 async function tasksBody(opts: UiServerOptions): Promise<TasksResponse> {

package/src/ui/types.ts

@@ -74,5 +74,28 @@ export type UserRow = z.infer<typeof UserRow>;
 export const UsersResponse = z.object({ users: z.array(UserRow) });
 export type UsersResponse = z.infer<typeof UsersResponse>;
 
+// GET /api/engines — the engine catalog + which are connected on this host.
+export const EngineCatalogEntry = z.object({
+  kind: z.enum(["claude", "codex", "kimi", "grok", "cursor"]),
+  label: z.string(),
+  authMode: z.enum(["token-command", "login-command", "api-key"]),
+  notes: z.string().nullable(),
+  getKeyUrl: z.string().nullable(),
+});
+export type EngineCatalogEntry = z.infer<typeof EngineCatalogEntry>;
+
+export const EnginesResponse = z.object({
+  catalog: z.array(EngineCatalogEntry),
+  statuses: z.record(z.boolean()), // kind → connected
+});
+export type EnginesResponse = z.infer<typeof EnginesResponse>;
+
+// POST /api/engines/disconnect — the disconnect result.
+export const EngineOpResponse = z.object({
+  ok: z.boolean(),
+  message: z.string().optional(),
+});
+export type EngineOpResponse = z.infer<typeof EngineOpResponse>;
+
 export const ErrorResponse = z.object({ error: z.string() });
 export type ErrorResponse = z.infer<typeof ErrorResponse>;