@saadnvd1/agent-os 0.3.810 → 0.3.817

package/lib/attachments/prepare.ts

@@ -0,0 +1,100 @@
+import { execFile } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { promisify } from "util";
+import { redactHar } from "./har";
+import {
+  extOf,
+  isHeic,
+  type AttachmentKind,
+  type AttachmentType,
+} from "./policy";
+
+const run = promisify(execFile);
+
+export type Prepared =
+  | {
+      ok: true;
+      data: Buffer;
+      name: string;
+      mediaType: string;
+      kind: AttachmentKind;
+      // Saved beside the file and given to the agent with its path.
+      summary?: string;
+    }
+  | { ok: false; status: 400; error: string };
+
+export type Converter = (cmd: string, args: string[]) => Promise<unknown>;
+
+const realConverter: Converter = (cmd, args) =>
+  run(cmd, args, { timeout: 30_000 });
+
+// sips ships with macOS; ImageMagick and libheif cover Linux.
+const TOOLS = (src: string, out: string): [string, string[]][] => [
+  ["sips", ["-s", "format", "jpeg", src, "--out", out]],
+  ["magick", [src, out]],
+  ["heif-convert", [src, out]],
+];
+
+/** A JPEG of an iPhone photo, or null when this machine has no converter. */
+export async function heicToJpeg(
+  data: Buffer,
+  convert: Converter = realConverter
+): Promise<Buffer | null> {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-heic-"));
+  try {
+    const src = path.join(dir, "in.heic");
+    const out = path.join(dir, "out.jpg");
+    fs.writeFileSync(src, data);
+    for (const [cmd, args] of TOOLS(src, out)) {
+      try {
+        await convert(cmd, args);
+        if (fs.existsSync(out)) return fs.readFileSync(out);
+      } catch {
+        // Not installed or failed: the next tool.
+      }
+    }
+    return null;
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** What is stored for a checked upload: secrets removed, photos converted. */
+export async function prepareUpload(
+  type: AttachmentType,
+  name: string,
+  data: Buffer,
+  convert?: Converter
+): Promise<Prepared> {
+  const keep: Prepared = {
+    ok: true,
+    data,
+    name,
+    mediaType: type.mediaType,
+    kind: type.kind,
+  };
+  if (type.ext === "har") {
+    const har = redactHar(data.toString("utf8"));
+    if (!har)
+      return {
+        ok: false,
+        status: 400,
+        error: `${name} doesn't look like a real HAR file.`,
+      };
+    return { ...keep, data: Buffer.from(har.json), summary: har.summary };
+  }
+  if (isHeic(name)) {
+    const jpeg = await heicToJpeg(data, convert);
+    if (!jpeg) return keep;
+    const stem = name.slice(0, name.length - extOf(name).length - 1);
+    return {
+      ...keep,
+      data: jpeg,
+      name: `${stem}.jpg`,
+      mediaType: "image/jpeg",
+    };
+  }
+  return keep;
+}

package/lib/attachments/store.ts

@@ -28,6 +28,10 @@ export function safeName(name: string, taken: Set<string>, n: number): string {
   return out;
 }
 
+// A short description kept beside a big file (a HAR's hosts and failures),
+// which the agent is given with the path.
+export const summaryPath = (file: string) => `${file}.summary.txt`;
+
 export function scopeDir(scope: string): string {
   return path.join(attachmentsRoot(), segment(scope) || "new");
 }
@@ -36,7 +40,8 @@ export function saveAttachment(
   scope: string,
   name: string,
   data: Buffer,
-  mediaType: string
+  mediaType: string,
+  summary?: string
 ): ChatFile {
   const dir = scopeDir(scope);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -44,6 +49,7 @@ export function saveAttachment(
   const file = safeName(name, taken, taken.size + 1);
   const full = path.join(dir, file);
   fs.writeFileSync(full, data, { mode: 0o600 });
+  if (summary) fs.writeFileSync(summaryPath(full), summary, { mode: 0o600 });
   return { path: full, name: file, size: data.length, mediaType };
 }
 

package/lib/config/client-config-types.ts

@@ -36,12 +36,14 @@ export interface ClientConfig {
 export interface AttachmentConfig {
   max: number;
   maxBytes: number;
+  maxTextBytes: number;
   maxImageBytes: number;
   pdfInlineBytes: number;
   types: {
     ext: string;
     mediaType: string;
     kind: "image" | "pdf" | "sheet" | "doc" | "text";
+    note?: string;
   }[];
 }
 

package/lib/connect/serve.ts

@@ -46,7 +46,9 @@ import {
   reapTunnel,
   superviseTunnel,
   type ReapDeps,
+  atStage,
   type Spawn,
+  type Stage,
   type TunnelState,
 } from "./supervise";
 
@@ -61,6 +63,10 @@ export interface ConnectStatus {
   enrolled?: boolean;
   hostname?: string;
   reason?: string;
+  /** Where the last failure came from: getting the connector, or the service. */
+  stage?: Stage;
+  /** While not up: when it went down or started trying (ms since epoch). */
+  downSince?: number;
 }
 
 const g = globalThis as unknown as { __agentosConnect?: () => ConnectStatus };
@@ -160,6 +166,8 @@ interface Running {
   supervisor: ReturnType<typeof superviseTunnel> | null;
   heartbeat: ReturnType<typeof startHeartbeat>;
   release: () => void;
+  /** When this run started, for how long it has been trying. */
+  since: number;
 }
 
 export function startConnect(
@@ -183,11 +191,18 @@ export function startConnect(
   g.__agentosConnect = () => {
     if (!running) return base;
     const s: TunnelState = running.supervisor?.state() ?? "connecting";
+    const state = bindError ? "error" : s === "stopped" ? "off" : s;
     return {
       ...base,
       hostname: hostname || base.hostname,
-      state: bindError ? "error" : s === "stopped" ? "off" : s,
+      state,
       reason: bindError ?? running.supervisor?.reason(),
+      stage: bindError ? undefined : running.supervisor?.stage(),
+      // Up has no down clock: the probe through the tunnel keeps its own.
+      downSince:
+        state === "up"
+          ? undefined
+          : (running.supervisor?.downSince() ?? running.since),
     };
   };
 
@@ -281,9 +296,12 @@ export function startConnect(
         spawn: deps.spawn,
         delays: deps.delays,
         prepare: async () => {
-          const bin = await ensure(dir);
+          const bin = await atStage("connector", ensure(dir));
           // Fresh every start; the token lives only in this call and the child's env.
-          const tunnel = await ask(config, machineKey, tunnelPort);
+          const tunnel = await atStage(
+            "service",
+            ask(config, machineKey, tunnelPort)
+          );
           if (tunnel.hostname !== hostname) {
             hostname = tunnel.hostname;
             saveConnect({ ...config, hostname }, dir);
@@ -350,6 +368,7 @@ export function startConnect(
       supervisor: null,
       heartbeat,
       release: lock.release,
+      since: Date.now(),
     };
     server.listen(tunnelPort, "127.0.0.1");
   };

package/lib/connect/supervise.ts

@@ -24,6 +24,17 @@ import type { Readable, Writable } from "stream";
 import { ApiError, clean } from "./control-api";
 
 export type TunnelState = "connecting" | "up" | "denied" | "error" | "stopped";
+/** Where a failure came from: getting the connector, or the Connect service. */
+export type Stage = "connector" | "service";
+
+/** Tags an error with the stage it came from, for the supervisor to keep. */
+export function atStage<T>(stage: Stage, work: Promise<T>): Promise<T> {
+  return work.catch((err) => {
+    throw Object.assign(err instanceof Error ? err : new Error(String(err)), {
+      stage,
+    });
+  });
+}
 
 export interface Prepared {
   bin: string;
@@ -178,6 +189,13 @@ export function superviseTunnel(opts: SuperviseOptions) {
 
   let state: TunnelState = "connecting";
   let reason: string | undefined;
+  let stage: Stage | undefined;
+  // When it last left "up", or started trying: how long it has been down.
+  let downSince = Date.now();
+  const set = (next: TunnelState) => {
+    if (state === "up" && next !== "up") downSince = Date.now();
+    state = next;
+  };
   let stopped = false;
   let child: Child | null = null;
   let timer: NodeJS.Timeout | null = null;
@@ -203,13 +221,13 @@ export function superviseTunnel(opts: SuperviseOptions) {
   // Nothing here may reject: an unhandled rejection takes AgentOS down.
   const tick = () =>
     void attempt().catch(() => {
-      state = "error";
+      set("error");
       retry(delays.max);
     });
 
   const attempt = async () => {
     if (stopped) return;
-    state = "connecting";
+    set("connecting");
     try {
       const prepared = await opts.prepare();
       if (stopped) return;
@@ -218,13 +236,15 @@ export function superviseTunnel(opts: SuperviseOptions) {
       if (stopped) return;
       const status = err instanceof ApiError ? err.status : 0;
       reason = clean((err as Error)?.message ?? String(err));
+      stage =
+        (err as { stage?: Stage })?.stage ?? (status ? "service" : undefined);
       log(`connect: ${reason}`);
       if (status === 401 || status === 403) {
         // Revoked or disabled: it won't fix itself in seconds.
-        state = "denied";
+        set("denied");
         retry(delays.denied);
       } else {
-        state = "error";
+        set("error");
         retry(delay);
         delay = Math.min(delay * 2, delays.setupMax);
       }
@@ -265,8 +285,9 @@ export function superviseTunnel(opts: SuperviseOptions) {
         }
       );
     } catch (err) {
-      state = "error";
+      set("error");
       reason = `cloudflared could not start: ${redact((err as Error).message)}`;
+      stage = "connector";
       log(`connect: ${reason}`);
       retry(delay);
       delay = Math.min(delay * 2, delays.max);
@@ -298,8 +319,9 @@ export function superviseTunnel(opts: SuperviseOptions) {
       if (message.startsWith("Registered tunnel connection")) {
         connections.add(conn);
         if (state !== "up") log("connect: tunnel up");
-        state = "up";
+        set("up");
         reason = undefined;
+        stage = undefined;
         delay = delays.min;
       } else if (
         message.startsWith("Unregistered tunnel connection") ||
@@ -307,7 +329,7 @@ export function superviseTunnel(opts: SuperviseOptions) {
           entry.connIndex !== undefined)
       ) {
         connections.delete(conn);
-        if (state === "up" && connections.size === 0) state = "connecting";
+        if (state === "up" && connections.size === 0) set("connecting");
       }
       if (["warn", "error", "fatal"].includes(entry.level ?? "")) {
         const text = entry.error ? `${message}: ${entry.error}` : message;
@@ -332,7 +354,7 @@ export function superviseTunnel(opts: SuperviseOptions) {
           fs.rmSync(pidFile, { force: true });
       } catch {}
       if (stopped) return;
-      state = "connecting";
+      set("connecting");
       reason = why;
       log(`connect: ${why}; starting it again`);
       retry(delay);
@@ -361,10 +383,12 @@ export function superviseTunnel(opts: SuperviseOptions) {
   return {
     state: () => state,
     reason: () => reason,
+    stage: () => stage,
+    downSince: () => (state === "up" ? undefined : downSince),
     stop() {
       if (stopped) return;
       stopped = true;
-      state = "stopped";
+      set("stopped");
       process.removeListener("exit", killNow);
       for (const s of SIGNALS) process.removeListener(s, onSignal);
       if (timer) clearTimeout(timer);

package/lib/db/queries.ts

@@ -14,11 +14,21 @@ function getStmt(db: Database.Database, sql: string): Database.Statement {
   return stmt;
 }
 
-// Every session column but the two large text ones, which only the single
-// session paths read; a list gets has_brief for whether a brief exists.
+// Every session column but the large text ones, which only the single
+// session paths read; a list gets has_brief and has_prompt for whether a
+// brief or task prompt exists. orch_token is internal and never listed.
+// task_prompt stays as its first 80 characters: phone app builds already
+// installed tell a task from a chat by !!task_prompt on the list.
 // Read from session_rows (lib/db/session-parts).
+const LEFT_OUT_OF_LISTS = new Set([
+  "task_brief",
+  "system_prompt",
+  "task_prompt",
+  "chat_context",
+  "orch_token",
+]);
 const LIST_COLUMNS = SESSION_ROW_COLUMNS.filter(
-  (n) => n !== "task_brief" && n !== "system_prompt"
+  (n) => !LEFT_OUT_OF_LISTS.has(n)
 );
 export function sessionListColumns(_db: Database.Database, alias = ""): string {
   const prefix = alias ? `${alias}.` : "";
@@ -26,7 +36,7 @@ export function sessionListColumns(_db: Database.Database, alias = ""): string {
   // The recipe run or feature piece a session is, as JSON, for its row's chip.
   const recipe = `(SELECT json_object('id', r.id, 'name', r.name, 'seq', rr.seq, 'status', rr.status) FROM recipe_runs rr JOIN recipes r ON r.id = rr.recipe_id WHERE rr.session_id = ${alias || "session_rows"}.id)`;
   const piece = `(SELECT json_object('feature', f.id, 'name', f.name, 'position', fp.position, 'total', (SELECT COUNT(*) FROM feature_pieces WHERE feature_id = f.id AND status != 'dropped')) FROM feature_pieces fp JOIN features f ON f.id = fp.feature_id WHERE fp.session_id = ${alias || "session_rows"}.id)`;
-  return `${list}, (${prefix}task_brief IS NOT NULL AND ${prefix}task_brief != '') AS has_brief, ${recipe} AS recipe_run, ${piece} AS feature_piece`;
+  return `${list}, (${prefix}task_brief IS NOT NULL AND ${prefix}task_brief != '') AS has_brief, (${prefix}task_prompt IS NOT NULL AND ${prefix}task_prompt != '') AS has_prompt, substr(${prefix}task_prompt, 1, 80) AS task_prompt, ${recipe} AS recipe_run, ${piece} AS feature_piece`;
 }
 
 export const queries = {
@@ -60,6 +70,23 @@ export const queries = {
          ORDER BY updated_at DESC`
     ),
 
+  // The sidebar again with the Done shelf cut to its most recent finished
+  // tasks (limit), for the list a browser refetches on every write.
+  getSidebarSessionsCapped: (db: Database.Database, limit: number) =>
+    getStmt(
+      db,
+      `SELECT ${sessionListColumns(db)} FROM session_rows
+         WHERE archived_at IS NULL
+           AND (task_status IS NULL
+                OR task_status NOT IN ('dropped', 'moved'))
+           AND (task_status IS NOT 'merged' OR id IN (
+                SELECT id FROM session_rows
+                  WHERE archived_at IS NULL AND task_status = 'merged'
+                  ORDER BY COALESCE(NULLIF(settled_at, ''), NULLIF(merged_at, ''), updated_at) DESC
+                  LIMIT ${Math.max(0, Math.floor(limit))}))
+         ORDER BY updated_at DESC`
+    ),
+
   // The tmux names AgentOS owns, for telling discovered sessions apart.
   getManagedTmuxNames: (db: Database.Database) =>
     getStmt(

package/lib/db/types.ts

@@ -38,7 +38,7 @@ export interface Session {
   auto_approve: boolean;
   host_id: string;
   // Async tasks: a session started from a prompt that ends in a PR
-  task_prompt: string | null;
+  task_prompt?: string | null;
   // done: finished without a merge (no PR, or its PR closed).
   // moving: handing it to another machine (moved_to); moved: handed over.
   task_status:
@@ -53,6 +53,8 @@ export interface Session {
   task_brief?: string | null;
   // Lists carry this instead of the brief itself (0/1).
   has_brief?: number;
+  // Likewise for the task prompt (0/1): lists leave the text out.
+  has_prompt?: number;
   // JSON, in lists: the recipe run this session is ({id, name, seq}), and the
   // feature piece it builds ({feature, name, position, total}).
   recipe_run?: string | null;

package/lib/guides.ts

@@ -0,0 +1,6 @@
+/** Where the user guides (docs/guides/*.md) are read on the web. */
+export const GUIDES =
+  "https://github.com/saadnvd1/agent-os/blob/main/docs/guides";
+
+export const guideUrl = (g: { file: string; anchor?: string }) =>
+  `${GUIDES}/${g.file}.md${g.anchor ? `#${g.anchor}` : ""}`;

package/lib/hosts/remote-menu.ts

@@ -5,6 +5,7 @@
  * pin, select, done and delete all work: the ones that change the session
  * run on its machine.
  */
+import { hasPrompt } from "@/lib/sessions/has-prompt";
 
 export const REMOTE_UNSUPPORTED = {
   fork: (host: string) => `Runs on ${host}: fork it there`,
@@ -26,12 +27,13 @@ export type RemoteAction = keyof typeof REMOTE_UNSUPPORTED;
 export function remoteBlocks(
   session: {
     host_id: string | null;
-    task_prompt: string | null;
+    task_prompt?: string | null;
+    has_prompt?: number;
     peer_mirror?: number;
   },
   linkedHostName: (hostId: string) => string | undefined
 ): Record<RemoteAction, string> | null {
-  if (!session.peer_mirror || !session.host_id || session.task_prompt)
+  if (!session.peer_mirror || !session.host_id || hasPrompt(session))
     return null;
   const host = linkedHostName(session.host_id);
   if (!host) return null;

package/lib/reach/check-cli.ts

@@ -0,0 +1,117 @@
+/**
+ * agent-os check [--json] [--via connect|tailscale|lan]: asks the server for
+ * its reachability report. When the server can't answer, it looks at who is
+ * on the port before naming a cause: AgentOS stuck, another program, or
+ * nothing at all.
+ */
+
+import { finding } from "./classify";
+import type { ReachFinding, ReachReport, ReachRoute } from "./types";
+
+export interface CheckCliDeps {
+  base: string;
+  fetch: typeof fetch;
+  out: (line: string) => void;
+  /** The program listening on the port, from lsof, or null. */
+  holder: () => Promise<string | null>;
+  /** Whether a launchd/systemd service for AgentOS is installed. */
+  serviceInstalled: () => boolean;
+  now?: () => number;
+  reportMs?: number;
+  probeMs?: number;
+}
+
+const ROUTES = ["connect", "tailscale", "lan"] as const;
+const PROGRAM = /^[A-Za-z0-9._-]{1,32}$/;
+
+/** Exit code: 0 reachable, 1 a warning, 2 not reachable. */
+export const exitCode = (r: ReachReport) =>
+  ({ ok: 0, warn: 1, fail: 2 })[r.status];
+
+async function report(
+  deps: CheckCliDeps,
+  want: ReachRoute[]
+): Promise<ReachReport | null> {
+  const q = new URLSearchParams({ fresh: "" });
+  if (want.length) q.set("want", want.join(","));
+  try {
+    const res = await deps.fetch(`${deps.base}/api/reach?${q}`, {
+      signal: AbortSignal.timeout(deps.reportMs ?? 20_000),
+    });
+    if (!res.ok) return null;
+    return (await res.json()) as ReachReport;
+  } catch {
+    return null;
+  }
+}
+
+/** The server didn't report: who, if anyone, is on its port? */
+export async function whoIsOnThePort(
+  deps: CheckCliDeps
+): Promise<ReachFinding> {
+  let answered = false;
+  let silent = false;
+  try {
+    const res = await deps.fetch(`${deps.base}/api/reach/probe`, {
+      signal: AbortSignal.timeout(deps.probeMs ?? 2_000),
+    });
+    answered = true;
+    const body = (await res.json().catch(() => null)) as {
+      boot?: unknown;
+    } | null;
+    if (res.ok && typeof body?.boot === "string")
+      return finding("service-stuck", "fail");
+  } catch (err) {
+    const e = err as { name?: string; cause?: { code?: string } };
+    if (!answered && e.cause?.code === "ECONNREFUSED")
+      return finding("service-down", "fail", {
+        alt: deps.serviceInstalled() ? undefined : "no-service",
+      });
+    silent = !answered && e.name === "TimeoutError";
+  }
+  const program = await deps.holder().catch(() => null);
+  // A blocked server takes the connection and never answers, probe included.
+  if (silent && program === "node") return finding("service-stuck", "fail");
+  // Something holds the port but isn't AgentOS (or doesn't speak HTTP).
+  return finding("port-taken", "fail", {
+    detail: program && PROGRAM.test(program) ? program : undefined,
+  });
+}
+
+const MARK = { ok: "✓", warn: "!", fail: "✗" } as const;
+
+export function printReport(r: ReachReport, out: (line: string) => void) {
+  for (const f of r.findings) {
+    const head = f.url ? `${f.title}: ${f.url}` : f.title;
+    out(`${MARK[f.status]} ${head}`);
+    if (f.status === "ok") continue;
+    if (f.needs === "nothing") out("    Retrying on its own, nothing to do");
+    else if (f.fix) out(`    → ${f.fix}`);
+    if (f.guide && f.needs === "you") out(`    How to fix: ${f.guide}`);
+  }
+  if (r.status !== "ok" && r.url) out(`\nWorking link: ${r.url}`);
+}
+
+export async function runCheckCli(
+  args: string[],
+  deps: CheckCliDeps
+): Promise<number> {
+  const json = args.includes("--json");
+  const i = args.findIndex((a) => a === "--via" || a.startsWith("--via="));
+  const via = i < 0 ? undefined : (args[i].split("=")[1] ?? args[i + 1]);
+  const want = i < 0 ? [] : ROUTES.filter((r) => r === via);
+  if (i >= 0 && !want.length) {
+    deps.out(`--via takes one of: ${ROUTES.join(", ")}`);
+    return 2;
+  }
+  const r =
+    (await report(deps, want)) ??
+    ({
+      status: "fail",
+      findings: [await whoIsOnThePort(deps)],
+      checkedAt: new Date(deps.now?.() ?? Date.now()).toISOString(),
+    } satisfies ReachReport);
+  if (json) deps.out(JSON.stringify(r, null, 2));
+  else printReport(r, deps.out);
+  return exitCode(r);
+}

package/lib/reach/checkReach.ts

@@ -0,0 +1,62 @@
+/**
+ * gather + classify. The facts are cached: the Connect probe goes out to the
+ * internet, so a burst of callers shares one, and a forced fresh check runs
+ * at most every 5s.
+ */
+
+import { classifyReach } from "./classify";
+import { gatherFacts, type GatherDeps } from "./gatherFacts";
+import type { ReachFacts, ReachReport, ReachRoute } from "./types";
+
+const CACHE_MS = 30_000;
+const FRESH_MIN_MS = 5_000;
+
+let cached: { at: number; facts: ReachFacts } | null = null;
+let inflight: Promise<ReachFacts> | null = null;
+// The tunnel can be up while the probe through it fails: that failure gets
+// its own clock, so it turns into "yours" after a while too.
+let probeBadSince: number | null = null;
+
+function ageProbe(f: ReachFacts): ReachFacts {
+  if (f.connect.state !== "up" || !f.probe || f.probe.kind === "ok") {
+    probeBadSince = null;
+    return f;
+  }
+  probeBadSince ??= f.now;
+  return {
+    ...f,
+    connect: { ...f.connect, downSince: f.connect.downSince ?? probeBadSince },
+  };
+}
+
+async function facts(fresh: boolean, deps?: GatherDeps): Promise<ReachFacts> {
+  if (inflight) return inflight;
+  const age = cached ? Date.now() - cached.at : Infinity;
+  if (cached && age < (fresh ? FRESH_MIN_MS : CACHE_MS)) return cached.facts;
+  inflight = gatherFacts(deps)
+    .then((gathered) => {
+      const f = ageProbe(gathered);
+      cached = { at: Date.now(), facts: f };
+      return f;
+    })
+    .finally(() => {
+      inflight = null;
+    });
+  return inflight;
+}
+
+/** `want`: routes the caller means to use, reported even when not set up. */
+export async function checkReach(
+  fresh = false,
+  want: ReachRoute[] = [],
+  deps?: GatherDeps
+): Promise<ReachReport> {
+  return classifyReach(await facts(fresh, deps), want);
+}
+
+/** For tests. */
+export function resetReachCache() {
+  cached = null;
+  inflight = null;
+  probeBadSince = null;
+}