@schlenkr/ragents 0.1.17 → 0.1.18

package/README.md

@@ -41,7 +41,11 @@ npm install -g @schlenkr/ragents
   ```
 
 - `workspace-client <server-url> [folder ...]` - register this machine and its folders as a
-  workspace for a server, so a run on that server works in these folders.
+  workspace for a server, so a run on that server works in these folders. Includes the same
+  ripgrep and Windows Bash as the VS Code extension. `RAGENTS_USER` and `RAGENTS_PASSWORD` in
+  the environment enable session renewal; `RAGENTS_TOKEN` supplies an existing or personal token.
+  Terminal or parent closure stops it and its children. Use `--detached` explicitly for nohup
+  or a service manager; SIGINT/SIGTERM still stop it.
 
   ```sh
   ragents workspace-client https://ragents.example.com ~/projects/demo

package/apps/web/dist/help/guide-distributed.html

@@ -130,7 +130,7 @@
       <a class="nav-github" href="https://github.com/SchlenkR/RAgents" aria-label="GitHub"><svg class="gh-icon" viewBox="0 0 24 24" aria-hidden="true"><path fill="currentColor" d="M12 2a10 10 0 0 0-3.2 19.5c.5.1.7-.2.7-.5v-1.7c-2.8.6-3.4-1.3-3.4-1.3-.5-1.2-1.1-1.5-1.1-1.5-.9-.6.1-.6.1-.6 1 .1 1.5 1 1.5 1 .9 1.6 2.4 1.1 3 .9.1-.7.4-1.1.6-1.4-2.2-.3-4.6-1.1-4.6-5 0-1.1.4-2 1-2.7-.1-.3-.4-1.3.1-2.7 0 0 .8-.3 2.8 1a9.6 9.6 0 0 1 5 0c1.9-1.3 2.8-1 2.8-1 .5 1.4.2 2.4.1 2.7.6.7 1 1.6 1 2.7 0 3.9-2.4 4.7-4.6 5 .4.3.7.9.7 1.9V21c0 .3.2.6.7.5A10 10 0 0 0 12 2Z"/></svg><span class="gh-label">GitHub</span></a>
     </nav>
     <button class="nav-menu" type="button" aria-expanded="false" aria-controls="main-navigation"><span data-menu-label>Menu</span><svg viewBox="0 0 24 24" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg></button>
-  </header><main class="shell" id="main"><div class="guide-layout"><aside class="guide-sidebar"><nav class="guide-chapters" aria-label="Guide navigation"><a href="guide.html">Overview</a><div class="guide-nav-group"><p>Understand</p><a href="guide-ideas.html">Core ideas</a><a href="guide-runtime.html">Actors and messages</a></div><div class="guide-nav-group"><p>Use</p><a href="guide-getting-started.html">Get started</a><a href="guide-clients.html">Web and VS Code</a><a href="guide-distributed.html" aria-current="page">Distributed work</a></div><div class="guide-nav-group"><p>Build</p><a href="guide-functions.html">Work with TypeScript</a><a href="guide-programs.html">Build mini-apps</a><a href="guide-plugins.html">Plugins and skills</a></div><div class="guide-nav-group"><p>Access</p><a href="guide-access.html">Assign permissions</a></div></nav></aside><details class="guide-mobile-nav"><summary>Guide: Distributed work</summary><nav class="guide-chapters" aria-label="Guide navigation"><a href="guide.html">Overview</a><div class="guide-nav-group"><p>Understand</p><a href="guide-ideas.html">Core ideas</a><a href="guide-runtime.html">Actors and messages</a></div><div class="guide-nav-group"><p>Use</p><a href="guide-getting-started.html">Get started</a><a href="guide-clients.html">Web and VS Code</a><a href="guide-distributed.html" aria-current="page">Distributed work</a></div><div class="guide-nav-group"><p>Build</p><a href="guide-functions.html">Work with TypeScript</a><a href="guide-programs.html">Build mini-apps</a><a href="guide-plugins.html">Plugins and skills</a></div><div class="guide-nav-group"><p>Access</p><a href="guide-access.html">Assign permissions</a></div></nav></details><article class="guide-body"><header class="guide-title"><p class="eyebrow"><a href="guide.html">Guide</a></p><h1>Distributed work</h1><p>Run the host locally or remotely, keep tools beside the project, and move runs between servers.</p></header><details class="guide-page-nav"><summary>On this page</summary><nav aria-label="On this page"><a href="#work-without-a-checkout">Work without a checkout</a><a href="#connect-to-a-server">Connect to a server</a><a href="#transfer-a-run">Transfer a run</a><a href="#work-on-windows">Work on Windows</a></nav></details><h2 id="work-without-a-checkout">Work without a checkout</h2>
+  </header><main class="shell" id="main"><div class="guide-layout"><aside class="guide-sidebar"><nav class="guide-chapters" aria-label="Guide navigation"><a href="guide.html">Overview</a><div class="guide-nav-group"><p>Understand</p><a href="guide-ideas.html">Core ideas</a><a href="guide-runtime.html">Actors and messages</a></div><div class="guide-nav-group"><p>Use</p><a href="guide-getting-started.html">Get started</a><a href="guide-clients.html">Web and VS Code</a><a href="guide-distributed.html" aria-current="page">Distributed work</a></div><div class="guide-nav-group"><p>Build</p><a href="guide-functions.html">Work with TypeScript</a><a href="guide-programs.html">Build mini-apps</a><a href="guide-plugins.html">Plugins and skills</a></div><div class="guide-nav-group"><p>Access</p><a href="guide-access.html">Assign permissions</a></div></nav></aside><details class="guide-mobile-nav"><summary>Guide: Distributed work</summary><nav class="guide-chapters" aria-label="Guide navigation"><a href="guide.html">Overview</a><div class="guide-nav-group"><p>Understand</p><a href="guide-ideas.html">Core ideas</a><a href="guide-runtime.html">Actors and messages</a></div><div class="guide-nav-group"><p>Use</p><a href="guide-getting-started.html">Get started</a><a href="guide-clients.html">Web and VS Code</a><a href="guide-distributed.html" aria-current="page">Distributed work</a></div><div class="guide-nav-group"><p>Build</p><a href="guide-functions.html">Work with TypeScript</a><a href="guide-programs.html">Build mini-apps</a><a href="guide-plugins.html">Plugins and skills</a></div><div class="guide-nav-group"><p>Access</p><a href="guide-access.html">Assign permissions</a></div></nav></details><article class="guide-body"><header class="guide-title"><p class="eyebrow"><a href="guide.html">Guide</a></p><h1>Distributed work</h1><p>Run the host locally or remotely, keep tools beside the project, and move runs between servers.</p></header><details class="guide-page-nav"><summary>On this page</summary><nav aria-label="On this page"><a href="#work-without-a-checkout">Work without a checkout</a><a href="#connect-to-a-server">Connect to a server</a><a href="#run-a-cli-workstation">Run a CLI workstation</a><a href="#transfer-a-run">Transfer a run</a><a href="#work-on-windows">Work on Windows</a></nav></details><h2 id="work-without-a-checkout">Work without a checkout</h2>
 <p>Using RAgents does not require a repository. <code>pnpm build:package</code> creates the npm package
 <code>@schlenkr/ragents</code> from this checkout in <code>dist/ragents</code>; with <code>--pack</code>, it also creates
 <code>dist/schlenkr-ragents-&lt;version&gt;.tgz</code>. The package contains the server, engine, executor, all
@@ -246,6 +246,22 @@ records only forwarded calls with user, alias, target, status, and token count.<
 starts with the new web interface as long as the host API stays the same. Otherwise the start
 refuses the fetched bundles, and <code>connect</code> names the version to install.</li>
 </ul>
+<h2 id="run-a-cli-workstation">Run a CLI workstation</h2>
+<p><code>ragents workspace-client &lt;server-url&gt; [folders ...]</code> registers this machine with the same tools
+and executor as the VS Code extension. No folder means the current directory; <code>--id</code> and <code>--label</code>
+set its stable identity and display name. The npm installation includes ripgrep on every supported
+platform and the curated Bash on Windows. Plugin tools are provisioned before registration.</p>
+<p>Set <code>RAGENTS_TOKEN</code> for a personal or existing session token. For automatic sign-in and renewal,
+configure <code>RAGENTS_USER</code> and <code>RAGENTS_PASSWORD</code> in the process environment. Neither is a command-line
+option. Invalid or absent credentials when sign-in is required produce a visible failure and a
+nonzero exit. A temporary connection loss reconnects and registers the workstation again.</p>
+<p>Closing the terminal or SSH session, closing stdin, or ending the owning process unregisters the
+workstation and stops its children. SIGINT, SIGTERM, and SIGHUP also stop it. For an intentional
+background service, pass <code>--detached</code> and let a service manager own it, or run:</p>
+<pre><code class="language-sh">nohup ragents workspace-client https://ragents.example.com /home/user/project --detached &gt;workspace.log 2&gt;&amp;1 &lt;/dev/null &amp;
+</code></pre>
+<p>The flag ignores terminal closure, parent loss, and SIGHUP; it does not daemonize. SIGINT and
+SIGTERM still unregister and shut down. Use the service manager&#39;s stop command to end a service.</p>
 <h2 id="transfer-a-run">Transfer a run</h2>
 <p>A run can move from one server to another and continue there, for example from a notebook to an
 always-on machine or from a central server to a developer for local inspection.</p>
@@ -299,13 +315,11 @@ otherwise it tells the model to exclude dependency and build folders from <code>
 contains no git, so your login works as usual: Git Credential Manager, <code>~/.gitconfig</code> and
 <code>~/.ssh</code>. On your own machine the bash inherits your whole environment, except the variables of
 VS Code itself and <code>BASH_ENV</code>/<code>ENV</code>.</li>
-<li><strong>Without the extension</strong> (<code>ragents start</code> or <code>ragents workspace-client</code> from the npm package)
-set <code>RAGENTS_BASH</code> to the <code>bash.exe</code> of such a bundle, for example
-<code>&lt;extension folder&gt;\dist\bash\win32-x64\usr\bin\bash.exe</code>. Without it every <code>bash</code> call fails
-and names what is missing. <code>RAGENTS_RG</code> names an <code>rg</code> in the same way, for example
-<code>&lt;extension folder&gt;\dist\rg\win32-x64\rg.exe</code>, on every platform; without it, an <code>rg</code> on
-<code>PATH</code> is used if there is one. A <code>RAGENTS_RG</code> that points to a missing file stops the server
-start or the workstation&#39;s registration.</li>
+<li><strong>CLI workstation</strong> (<code>ragents workspace-client</code>) carries the same Bash and ripgrep as the
+extension. npm installs only the optional tools package for this machine; keep optional
+dependencies enabled. A checkout uses the extension build from <code>pnpm bundle:rg</code> and
+<code>pnpm bundle:bash</code>. A standalone server (<code>ragents start</code>) still takes <code>RAGENTS_BASH</code> and
+<code>RAGENTS_RG</code> from its environment; these variables do not override workstation bundles.</li>
 <li><strong>Node.js</strong> is enough with <code>@schlenkr/ragents</code>. A checkout additionally needs <strong>pnpm</strong>, and
 <code>pnpm install</code>, <code>pnpm build:agent</code>, and <code>scripts/start.sh</code> need a bash of your own, such as
 Git Bash.</li>

package/apps/web/dist/help/guide-distributed.md

@@ -143,6 +143,29 @@ expose only the alias.
   starts with the new web interface as long as the host API stays the same. Otherwise the start
   refuses the fetched bundles, and `connect` names the version to install.
 
+## Run a CLI workstation
+
+`ragents workspace-client <server-url> [folders ...]` registers this machine with the same tools
+and executor as the VS Code extension. No folder means the current directory; `--id` and `--label`
+set its stable identity and display name. The npm installation includes ripgrep on every supported
+platform and the curated Bash on Windows. Plugin tools are provisioned before registration.
+
+Set `RAGENTS_TOKEN` for a personal or existing session token. For automatic sign-in and renewal,
+configure `RAGENTS_USER` and `RAGENTS_PASSWORD` in the process environment. Neither is a command-line
+option. Invalid or absent credentials when sign-in is required produce a visible failure and a
+nonzero exit. A temporary connection loss reconnects and registers the workstation again.
+
+Closing the terminal or SSH session, closing stdin, or ending the owning process unregisters the
+workstation and stops its children. SIGINT, SIGTERM, and SIGHUP also stop it. For an intentional
+background service, pass `--detached` and let a service manager own it, or run:
+
+```sh
+nohup ragents workspace-client https://ragents.example.com /home/user/project --detached >workspace.log 2>&1 </dev/null &
+```
+
+The flag ignores terminal closure, parent loss, and SIGHUP; it does not daemonize. SIGINT and
+SIGTERM still unregister and shut down. Use the service manager's stop command to end a service.
+
 ## Transfer a run
 
 A run can move from one server to another and continue there, for example from a notebook to an
@@ -203,13 +226,11 @@ The local host and workspace also run on Windows. Requirements are:
   contains no git, so your login works as usual: Git Credential Manager, `~/.gitconfig` and
   `~/.ssh`. On your own machine the bash inherits your whole environment, except the variables of
   VS Code itself and `BASH_ENV`/`ENV`.
-- **Without the extension** (`ragents start` or `ragents workspace-client` from the npm package)
-  set `RAGENTS_BASH` to the `bash.exe` of such a bundle, for example
-  `<extension folder>\dist\bash\win32-x64\usr\bin\bash.exe`. Without it every `bash` call fails
-  and names what is missing. `RAGENTS_RG` names an `rg` in the same way, for example
-  `<extension folder>\dist\rg\win32-x64\rg.exe`, on every platform; without it, an `rg` on
-  `PATH` is used if there is one. A `RAGENTS_RG` that points to a missing file stops the server
-  start or the workstation's registration.
+- **CLI workstation** (`ragents workspace-client`) carries the same Bash and ripgrep as the
+  extension. npm installs only the optional tools package for this machine; keep optional
+  dependencies enabled. A checkout uses the extension build from `pnpm bundle:rg` and
+  `pnpm bundle:bash`. A standalone server (`ragents start`) still takes `RAGENTS_BASH` and
+  `RAGENTS_RG` from its environment; these variables do not override workstation bundles.
 - **Node.js** is enough with `@schlenkr/ragents`. A checkout additionally needs **pnpm**, and
   `pnpm install`, `pnpm build:agent`, and `scripts/start.sh` need a bash of your own, such as
   Git Bash.

package/apps/web/src/server-client.ts

@@ -0,0 +1,165 @@
+import type { AccessSnapshot } from "../../../packages/ragents/src/access";
+import { accessSnapshotFrom } from "./access-session";
+import { RpcClient } from "./rpc/client";
+
+export class ServerError extends Error {
+  constructor(message: string, readonly status: number, readonly code?: string) {
+    super(message);
+    this.name = "ServerError";
+  }
+}
+
+export class UnreachableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "UnreachableError";
+  }
+}
+
+const sessionTokenFrom = (setCookie: readonly string[]): string => {
+  for (const cookie of setCookie) {
+    const pair = cookie.split(";")[0] ?? "";
+    const token = pair.slice(pair.indexOf("=") + 1).trim();
+    if (/^[A-Za-z0-9_-]{43}$/.test(token)) return token;
+  }
+  throw new ServerError("The server did not deliver a session token.", 500);
+};
+
+const errorFrom = async (response: Response): Promise<ServerError> => {
+  let message = `The server responded with ${response.status}.`;
+  let code: string | undefined;
+  try {
+    const body = await response.json() as { error?: unknown; message?: unknown; code?: unknown };
+    if (typeof body.error === "string" && body.error) message = body.error;
+    else if (typeof body.message === "string" && body.message) message = body.message;
+    if (typeof body.code === "string") code = body.code;
+  } catch {}
+  return new ServerError(message, response.status, code);
+};
+
+/** A workstation's access: sign-in and delivery over HTTP, everything else as JSON-RPC; the session token goes as bearer. */
+export interface SignInOptions {
+  readonly credentials: () => Promise<{ id: string; password: string } | undefined>;
+  readonly onToken?: (token: string) => Promise<void>;
+  readonly log?: (line: string) => void;
+}
+
+export class ServerClient {
+  #authenticating: Promise<boolean> | undefined;
+  #signInFailure: string | undefined;
+  readonly origin: string;
+  readonly rpc: RpcClient;
+
+  constructor(readonly baseUrl: string, private token: string | undefined, private readonly request: typeof fetch = fetch, private readonly signIn?: SignInOptions) {
+    this.origin = new URL(baseUrl).origin;
+    this.rpc = new RpcClient({
+      baseUrl: this.origin,
+      fetch: (input, init) => this.#authorized(input, init),
+    });
+  }
+
+  signInFailure(): string | undefined {
+    return this.#signInFailure;
+  }
+
+  async #authorized(input: Parameters<typeof fetch>[0], init?: RequestInit): Promise<Response> {
+    const token = this.token;
+    const send = () => this.request(input, { ...init, headers: this.headers(init?.headers as Record<string, string> | undefined ?? {}) });
+    const response = await send();
+    if (response.status !== 401 || !this.signIn || init?.signal?.aborted) return response;
+    const rejection = await response.clone().json().catch(() => undefined) as { code?: unknown } | undefined;
+    if (rejection?.code !== "login-required") {
+      this.#signInFailure = "Access token required: this server does not accept automatic user/password sign-in. Supply a valid access token.";
+      return response;
+    }
+    if (token === this.token) {
+      this.#authenticating ??= this.#authenticate().finally(() => { this.#authenticating = undefined; });
+      if (!await this.#authenticating) return response;
+    }
+    if (init?.signal?.aborted) return response;
+    await response.body?.cancel();
+    const retried = await send();
+    if (retried.status === 401) this.#signInFailure = "Sign-in required: the server rejected the renewed session.";
+    return retried;
+  }
+
+  async #authenticate(): Promise<boolean> {
+    try {
+      const credentials = await this.signIn!.credentials();
+      if (!credentials) {
+        this.#signInFailure = "Sign-in required: no credentials are configured for session renewal.";
+        return false;
+      }
+      this.signIn!.log?.(`== Signing in to ${this.origin} with configured credentials`);
+      const { token } = await this.login(credentials.id, credentials.password);
+      await this.signIn!.onToken?.(token);
+      this.useToken(token);
+      this.#signInFailure = undefined;
+      return true;
+    } catch {
+      this.#signInFailure = "Sign-in required: automatic sign-in failed. Check the configured credentials and server availability.";
+      return false;
+    }
+  }
+
+  get hasToken(): boolean {
+    return this.token !== undefined;
+  }
+
+  get accessToken(): string | undefined {
+    return this.token;
+  }
+
+  /** The client reads the token on every request, so the messaging layer stays in place. */
+  useToken(token: string | undefined): void {
+    this.token = token;
+  }
+
+  url(path: string): string {
+    return new URL(path, `${this.origin}/`).toString();
+  }
+
+  headers(extra: Record<string, string> = {}): Record<string, string> {
+    return this.token === undefined ? extra : { ...extra, authorization: `Bearer ${this.token}` };
+  }
+
+  async fetch(path: string, init: RequestInit = {}): Promise<Response> {
+    try {
+      return await this.#authorized(this.url(path), init);
+    } catch (cause) {
+      throw new UnreachableError(`${this.origin} is unreachable: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+  }
+
+  async json<T>(path: string, init: RequestInit = {}, validate: (value: unknown) => T = (value) => value as T): Promise<T> {
+    const response = await this.fetch(path, init);
+    if (!response.ok) throw await errorFrom(response);
+    return validate(await response.json());
+  }
+
+  async access(): Promise<AccessSnapshot> {
+    const snapshot = await this.json("/api/access", { cache: "no-store" }, accessSnapshotFrom);
+    if (!snapshot.enabled || snapshot.user || !this.signIn) return snapshot;
+    this.#authenticating ??= this.#authenticate().finally(() => { this.#authenticating = undefined; });
+    return await this.#authenticating ? this.json("/api/access", { cache: "no-store" }, accessSnapshotFrom) : snapshot;
+  }
+
+  async login(id: string, password: string): Promise<{ snapshot: AccessSnapshot; token: string }> {
+    const response = await this.request(this.url("/api/access/login"), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id, password }),
+      signal: AbortSignal.timeout(10_000),
+      redirect: "error",
+    });
+    if (!response.ok) throw await errorFrom(response);
+    const snapshot = accessSnapshotFrom(await response.json());
+    if (!snapshot.user) throw new ServerError("The server did not confirm the sign-in.", 500);
+    return { snapshot, token: sessionTokenFrom(response.headers.getSetCookie()) };
+  }
+
+  async logout(): Promise<void> {
+    const response = await this.fetch("/api/access/logout", { method: "POST" });
+    if (!response.ok && response.status !== 401) throw await errorFrom(response);
+  }
+}

package/bundles/ragents.workspace/ragents-bundle.json

@@ -137,7 +137,7 @@
     }
   },
   "revision": "db9370b7b3449c44be49986b074806351b857c430963aa878e209d2d5c9ba4f8",
-  "sourceRevision": "012d6527173d20efeeaa5102b884d7cd9bbf781cf4fa6446164529ec252fcc2e",
+  "sourceRevision": "25a05a48b591f8f4b575b06d495f7f191037d7419b79a98ad321328c455f4e0d",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schlenkr/ragents",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "RAgents host: server, engine, plugins and tools without a source checkout",
   "keywords": [
     "agents",
@@ -70,7 +70,15 @@
     "vscode-jsonrpc": "9.0.2",
     "yaml": "2.9.0"
   },
+  "optionalDependencies": {
+    "@schlenkr/ragents-tools-win32-x64": "0.1.18",
+    "@schlenkr/ragents-tools-win32-arm64": "0.1.18",
+    "@schlenkr/ragents-tools-darwin-x64": "0.1.18",
+    "@schlenkr/ragents-tools-darwin-arm64": "0.1.18",
+    "@schlenkr/ragents-tools-linux-x64": "0.1.18",
+    "@schlenkr/ragents-tools-linux-arm64": "0.1.18"
+  },
   "ragents": {
-    "hostVersion": "29cbfb6c019aa6a9ceb540363ca37ef2f9d03cb1"
+    "hostVersion": "6f896323c8bdb2622d4dc9459a901949bf5fae33"
   }
 }

package/packages/workspace-executor/src/bundled-tools.ts

@@ -0,0 +1,49 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+
+export const WORKSPACE_TOOL_TARGETS = ["win32-x64", "win32-arm64", "darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64"] as const;
+export type WorkspaceToolTarget = typeof WORKSPACE_TOOL_TARGETS[number];
+
+export const workspaceToolsPackageName = (target: string): string => `@schlenkr/ragents-tools-${target}`;
+
+export interface BundledToolsOptions {
+  readonly root: string;
+  readonly distribution: "extension" | "package";
+  readonly platform?: NodeJS.Platform;
+  readonly arch?: string;
+  readonly paths?: typeof path;
+  readonly exists?: (file: string) => boolean;
+  readonly resolvePackage?: (specifier: string) => string;
+}
+
+export interface BundledTools {
+  readonly bash: string | undefined;
+  readonly rg: string | undefined;
+}
+
+export const resolveBundledTools = (options: BundledToolsOptions): BundledTools => {
+  const platform = options.platform ?? process.platform;
+  const target = `${platform}-${options.arch ?? process.arch}`;
+  const paths = options.paths ?? path;
+  const exists = options.exists ?? existsSync;
+  const packageRoot = (): string => {
+    if (!WORKSPACE_TOOL_TARGETS.includes(target as WorkspaceToolTarget)) throw new Error(`Unsupported workstation platform: ${target}`);
+    const name = workspaceToolsPackageName(target);
+    try {
+      const resolve = options.resolvePackage ?? createRequire(paths.join(options.root, "package.json")).resolve;
+      return paths.dirname(resolve(`${name}/package.json`));
+    } catch {
+      throw new Error(`The bundled workstation tools ${name} are missing. Reinstall @schlenkr/ragents with optional dependencies enabled.`);
+    }
+  };
+  const root = options.distribution === "package" ? packageRoot() : options.root;
+  const bash = platform === "win32" ? paths.join(root, "dist", "bash", target, "usr", "bin", "bash.exe") : undefined;
+  const rg = paths.join(root, "dist", "rg", target, platform === "win32" ? "rg.exe" : "rg");
+  if (options.distribution === "package") {
+    for (const file of [rg, bash]) {
+      if (file !== undefined && !exists(file)) throw new Error(`Bundled workstation tool is missing: ${file}. Reinstall @schlenkr/ragents with optional dependencies enabled.`);
+    }
+  }
+  return { bash, rg: exists(rg) ? rg : undefined };
+};

package/packages/workspace-executor/src/owner-lifetime.d.mts

@@ -0,0 +1,18 @@
+import type { EventEmitter } from "node:events";
+import type { Readable } from "node:stream";
+
+export interface OwnerLifetimeOptions {
+  readonly detached?: boolean;
+  readonly parents?: readonly number[];
+  readonly onStop: (reason: string) => void;
+  readonly stdin?: Pick<Readable, "on" | "off" | "resume" | "pause" | "destroyed" | "readableEnded"> | null;
+  readonly signals?: EventEmitter;
+  readonly alive?: (pid: number) => boolean;
+  readonly intervalMs?: number;
+}
+
+export function processAlive(pid: number): boolean;
+export function watchOwnerLifetime(options: OwnerLifetimeOptions): () => void;
+export function processChildren(pid?: number): number[];
+export function terminateProcessTree(pid: number): void;
+export function exitWorkspaceProcess(code: number): never;

package/packages/workspace-executor/src/owner-lifetime.mjs

@@ -0,0 +1,102 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync, readdirSync } from "node:fs";
+
+export const processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+
+export const watchOwnerLifetime = ({ detached = false, parents = [process.ppid], onStop, stdin = process.stdin, signals = process, alive = processAlive, intervalMs = 1000 }) => {
+  const releases = [];
+  const signalReleases = [];
+  let stopped = false;
+  const dispose = () => {
+    for (const release of releases.splice(0)) release();
+  };
+  const stop = (reason) => {
+    if (stopped) return;
+    stopped = true;
+    dispose();
+    onStop(reason);
+  };
+  const listen = (emitter, event, handler, keepDuringStop = false) => {
+    emitter.on(event, handler);
+    (keepDuringStop ? signalReleases : releases).push(() => emitter.off(event, handler));
+  };
+  listen(signals, "SIGINT", () => stop("SIGINT"), true);
+  listen(signals, "SIGTERM", () => stop("SIGTERM"), true);
+  listen(signals, "SIGHUP", () => { if (!detached) stop("SIGHUP"); }, true);
+  if (!detached) {
+    if (parents.some((pid) => !Number.isSafeInteger(pid) || pid <= 0)) throw new Error("The workspace owner PID must be a positive integer.");
+    const check = () => {
+      if (parents.some((pid) => !alive(pid))) stop("parent exited");
+    };
+    const timer = setInterval(check, intervalMs);
+    timer.unref();
+    releases.push(() => clearInterval(timer));
+    listen(signals, "disconnect", () => stop("owner disconnected"));
+    if (stdin) {
+      listen(stdin, "end", () => stop("stdin closed"));
+      listen(stdin, "close", () => stop("stdin closed"));
+      listen(stdin, "error", () => stop("stdin failed"));
+      stdin.resume();
+      releases.push(() => stdin.pause());
+      if (stdin.destroyed || stdin.readableEnded) queueMicrotask(() => stop("stdin closed"));
+    }
+    queueMicrotask(check);
+  }
+  return () => {
+    stopped = true;
+    dispose();
+    for (const release of signalReleases.splice(0)) release();
+  };
+};
+
+export const processChildren = (pid = process.pid) => {
+  if (process.platform === "win32") {
+    const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command",
+      `Get-CimInstance Win32_Process -Filter 'ParentProcessId = ${pid}' | ForEach-Object { $_.ProcessId }`], { encoding: "utf8", windowsHide: true, timeout: 5000 });
+    if (result.status !== 0) throw new Error("Cannot inspect workspace child processes for shutdown.");
+    return result.stdout.trim().split(/\s+/).map(Number).filter((child) => child > 0);
+  }
+  const rows = process.platform === "linux" ? readdirSync("/proc").filter((entry) => /^\d+$/.test(entry)).flatMap((entry) => {
+    try {
+      const stat = readFileSync(`/proc/${entry}/stat`, "utf8");
+      return [[Number(entry), Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1])]];
+    } catch (error) {
+      if (["ENOENT", "ESRCH", "EACCES"].includes(error.code)) return [];
+      throw error;
+    }
+  }) : (() => {
+    const table = spawnSync("ps", ["-axo", "pid=,ppid="], { encoding: "utf8" });
+    if (table.status !== 0) throw new Error("Cannot inspect workspace child processes for shutdown.");
+    return table.stdout.trim().split("\n").map((line) => line.trim().split(/\s+/).map(Number));
+  })();
+  const descendants = (parent) => rows.filter((row) => row[1] === parent).flatMap((row) => [...descendants(row[0]), row[0]]);
+  return descendants(pid);
+};
+
+export const terminateProcessTree = (pid) => {
+  if (process.platform === "win32") {
+    const killed = spawnSync("taskkill", ["/T", "/F", "/PID", String(pid)], { stdio: "ignore", windowsHide: true, timeout: 5000 });
+    if (killed.status !== 0 && processAlive(pid)) throw new Error(`Could not stop workspace child process ${pid}.`);
+    return;
+  }
+  for (const child of [...processChildren(pid), pid]) {
+    try { process.kill(child, "SIGKILL"); } catch (error) { if (error.code !== "ESRCH") throw error; }
+  }
+};
+
+export const exitWorkspaceProcess = (code) => {
+  for (const pid of processChildren()) {
+    if (process.platform === "win32") terminateProcessTree(pid);
+    else {
+      try { process.kill(pid, "SIGKILL"); } catch (error) { if (error.code !== "ESRCH") throw error; }
+    }
+  }
+  process.exit(code);
+};

package/plugins/ragents.workspace/client/transport.ts

@@ -1,13 +1,11 @@
-import { RpcClient } from "../../../apps/web/src/rpc/client";
-import type { WorkspaceClientTransport } from "./workspace-client";
+import { ServerClient } from "../../../apps/web/src/server-client";
 
-/** A workstation access without a user interface: the message layer with a bearer token. */
-export const workspaceClientTransport = (baseUrl: string, token: string | undefined): WorkspaceClientTransport => ({
-  rpc: new RpcClient({
-    baseUrl: new URL(baseUrl).origin,
-    fetch: (input, init) => {
-      const headers = init?.headers as Record<string, string> | undefined ?? {};
-      return fetch(input, { ...init, headers: token === undefined ? headers : { ...headers, authorization: `Bearer ${token}` } });
+export const workspaceClientTransport = (baseUrl: string, token: string | undefined, environment: NodeJS.ProcessEnv = process.env): ServerClient =>
+  new ServerClient(baseUrl, token, fetch, {
+    log: (line) => console.error(line),
+    credentials: async () => {
+      const id = environment.RAGENTS_USER;
+      const password = environment.RAGENTS_PASSWORD;
+      return id && password ? { id, password } : undefined;
     },
-  }),
-});
+  });

package/plugins/ragents.workspace/client/workspace-client.ts

@@ -65,6 +65,7 @@ export interface WorkspaceClientOptions {
 /** What the workstation needs for the server: the message layer. */
 export interface WorkspaceClientTransport {
   readonly rpc: RpcClient;
+  readonly signInFailure?: () => string | undefined;
 }
 
 type ExecuteInput = OperationInput<typeof workspaceClientContracts.execute>;
@@ -255,6 +256,11 @@ export class WorkspaceClient {
     releases.push(
       rpc.handle(workspaceClientContracts.execute, (input, context) => this.#execute(attachment, input, context)),
       rpc.onConnected(() => void this.#announce()),
+      rpc.onStatus((status) => {
+        if (status.kind === "unauthorized" && attachment === this.#attachment) {
+          this.#set({ kind: "failed", message: this.transport.signInFailure?.() ?? "The server requires a sign-in.", mismatch: false });
+        }
+      }),
     );
     this.#attachment = attachment;
     return attachment;
@@ -288,13 +294,14 @@ export class WorkspaceClient {
   #connected(): Promise<void> {
     const rpc = this.transport.rpc;
     if (rpc.status.kind === "connected") return Promise.resolve();
+    if (rpc.status.kind === "unauthorized") return Promise.reject(new Error(this.transport.signInFailure?.() ?? "The server requires a sign-in."));
     return new Promise((settle, fail) => {
       const release = rpc.onStatus((status) => {
         if (status.kind === "connecting") return;
         release();
         if (status.kind === "connected") settle();
         else if (status.kind === "retrying") fail(new Error(status.message));
-        else if (status.kind === "unauthorized") fail(new Error("The server requires a sign-in."));
+        else if (status.kind === "unauthorized") fail(new Error(this.transport.signInFailure?.() ?? "The server requires a sign-in."));
         else fail(new Error("The server's event stream is closed."));
       });
     });

package/scripts/package/ragents.mjs

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { terminateProcessTree, watchOwnerLifetime } from "../../packages/workspace-executor/src/owner-lifetime.mjs";
 import { ensureHostLinks } from "./host-links.mjs";
 
 const AGENT_CLI = "scripts/agent/agent-cli.ts";
@@ -55,14 +56,39 @@ const main = () => {
   }
   ensureHostLinks(root);
   const passed = script === AGENT_CLI ? [command, ...rest] : rest;
+  const workspace = command === "workspace-client";
+  const detached = rest.includes("--detached");
   const child = spawn(process.execPath, ["--import", "tsx", path.join(root, script), ...passed], {
     cwd: path.join(root, "apps/server"),
-    env: { ...process.env, RAGENTS_CWD: process.cwd() },
-    stdio: "inherit",
+    env: { ...process.env, RAGENTS_CWD: process.cwd(), ...(workspace ? { RAGENTS_WORKSPACE_OWNER_PID: String(process.ppid) } : {}) },
+    stdio: workspace ? ["ignore", "inherit", "inherit", "ipc"] : "inherit",
+    detached: workspace && process.platform !== "win32",
   });
+  if (workspace) {
+    let stopReason;
+    let deadline;
+    const requestStop = () => {
+      if (child.connected && stopReason) child.send({ type: "workspace-stop", reason: stopReason }, () => undefined);
+    };
+    const release = watchOwnerLifetime({ detached, onStop: (reason) => {
+      stopReason = reason;
+      requestStop();
+      deadline = setTimeout(() => { if (child.pid) terminateProcessTree(child.pid); }, 20_000);
+    } });
+    child.on("message", (message) => { if (message?.type === "workspace-ready") requestStop(); });
+    child.once("exit", () => {
+      release();
+      clearTimeout(deadline);
+      if (process.platform !== "win32" && child.pid) {
+        try { process.kill(-child.pid, "SIGKILL"); } catch {}
+      }
+    });
+  }
   const forward = (signal) => () => child.kill(signal);
-  process.on("SIGINT", forward("SIGINT"));
-  process.on("SIGTERM", forward("SIGTERM"));
+  if (!workspace) {
+    process.on("SIGINT", forward("SIGINT"));
+    process.on("SIGTERM", forward("SIGTERM"));
+  }
   child.once("error", (error) => {
     console.error(`ragents ${command} could not be started: ${error.message}`);
     process.exit(1);

package/scripts/workspace-client/run-workspace-client.ts

@@ -3,25 +3,28 @@ import { statSync } from "node:fs";
 import { hostname } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveBundledTools } from "../../packages/workspace-executor/src/bundled-tools.ts";
+import { exitWorkspaceProcess, watchOwnerLifetime } from "../../packages/workspace-executor/src/owner-lifetime.mjs";
+import { isCheckout } from "../../apps/server/src/host-web.ts";
 import { hostRoot } from "../../apps/server/src/host-version.ts";
 import { callerDirectory } from "../../apps/server/src/profile-target.ts";
 import { provisionWorkspace } from "../../apps/server/src/profile/provisioning.ts";
 import { workspaceClientTransport } from "../../plugins/ragents.workspace/client/transport.ts";
 import { WorkspaceClient, workstationRunsDirectory } from "../../plugins/ragents.workspace/client/workspace-client.ts";
 
-const usage = (): string => `Usage: [RAGENTS_TOKEN=<token>] pnpm workspace-client <server-url> [folder ...] [--id <id>] [--label <name>]
-Registers the folders as a workspace with the server and executes its tasks with the executor
-of this machine - the same as the VS Code extension does, just without VS Code. Without folders
-the current directory applies. Every tool call appears as one line on stdout.
-What the server's plugins contribute to the executor, such as language servers, the workspace loads
-at registration from this host's bundles; startup fetches their tools onto this machine
-(the same as pnpm provision --workspace). On Windows
-RAGENTS_BASH names the bash.exe that RAgents brings along (from the Windows build of the VS Code
-extension); without it the bash tool fails. RAGENTS_RG names an rg whose folder the bash has at the
-front of its PATH, such as the one from the extension; if not given, one in the PATH applies. The
-script runs until it is ended with Ctrl-C.`;
+const usage = (): string => `Usage: ragents workspace-client <server-url> [folder ...] [--id <id>] [--label <name>] [--detached]
+Registers the folders as a workspace and executes tasks with the same tools as VS Code.
+Without folders the current directory applies. Tools are provisioned before registration.
+The npm package includes ripgrep and, on Windows, Bash. In a checkout run pnpm bundle:rg
+(and pnpm bundle:bash on Windows) first.
+Set RAGENTS_TOKEN for an existing session or RAGENTS_USER and RAGENTS_PASSWORD for automatic
+sign-in and renewal. Credentials belong only in the environment.
+By default closing stdin, the terminal, or the owning process ends the client and its children.
+--detached explicitly opts out of terminal and parent ownership for nohup or a service manager;
+SIGINT and SIGTERM still stop it. It does not daemonize the process.`;
 
 export interface WorkspaceClientArguments {
+  readonly detached: boolean;
   readonly serverUrl: string;
   readonly folders: readonly string[];
   readonly id: string | undefined;
@@ -30,11 +33,13 @@ export interface WorkspaceClientArguments {
 
 export const parseArguments = (argv: readonly string[]): WorkspaceClientArguments => {
   const folders: string[] = [];
+  let detached = false;
   let serverUrl: string | undefined;
   let id: string | undefined;
   let label: string | undefined;
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index]!;
+    if (argument === "--detached") { detached = true; continue; }
     if (argument === "--id" || argument === "--label") {
       const value = argv[index + 1];
       if (!value || value.startsWith("-")) throw new Error(`${argument} needs a value.\n${usage()}`);
@@ -49,7 +54,7 @@ export const parseArguments = (argv: readonly string[]): WorkspaceClientArgument
   }
   if (!serverUrl) throw new Error(`The server address is missing.\n${usage()}`);
   if (id !== undefined && !/^[A-Za-z0-9_-]{8,64}$/.test(id)) throw new Error("--id needs 8 to 64 characters from A-Z, a-z, 0-9, _ and -.");
-  return { serverUrl, folders, id, label };
+  return { serverUrl, folders, id, label, detached };
 };
 
 /** A stable id per machine and folder set, so the server recognizes the same workspace again. */
@@ -67,6 +72,27 @@ export const resolvedFolders = (folders: readonly string[], caller = callerDirec
 
 const main = async (): Promise<void> => {
   const parsed = parseArguments(process.argv.slice(2));
+  let stopping: Promise<void> | undefined;
+  const stop = (code: number, reason: string): Promise<void> => stopping ??= (async () => {
+    console.log(`== Stopping workspace: ${reason}`);
+    const force = setTimeout(() => exitWorkspaceProcess(code || 1), 15_000);
+    try {
+      await client.unregister();
+      transport.rpc.close();
+    } finally {
+      clearTimeout(force);
+      exitWorkspaceProcess(code);
+    }
+  })();
+  const releaseOwner = watchOwnerLifetime({
+    detached: parsed.detached,
+    parents: [process.ppid, ...process.env.RAGENTS_WORKSPACE_OWNER_PID ? [Number(process.env.RAGENTS_WORKSPACE_OWNER_PID)] : []],
+    stdin: process.send ? null : process.stdin,
+    onStop: (reason) => { void stop(0, reason); },
+  });
+  process.on("message", (message: unknown) => {
+    if (typeof message === "object" && message !== null && (message as { type?: string }).type === "workspace-stop") void stop(0, "owner stopped");
+  });
   const folders = resolvedFolders(parsed.folders);
   const host = hostname();
   const identity = {
@@ -78,46 +104,37 @@ const main = async (): Promise<void> => {
     runsDirectory: workstationRunsDirectory(),
   };
   const transport = workspaceClientTransport(parsed.serverUrl, process.env.RAGENTS_TOKEN);
+  const root = hostRoot();
+  const tools = resolveBundledTools({ root: isCheckout(root) ? path.join(root, "apps/vscode") : root, distribution: isCheckout(root) ? "extension" : "package" });
   const client = new WorkspaceClient(transport, identity, {
     hostRoot,
-    bash: process.env.RAGENTS_BASH || undefined,
-    rg: process.env.RAGENTS_RG || undefined,
+    ...tools,
     onExecuted: ({ runId, operation, durationMs, error }) =>
       console.log(`== ${runId.slice(0, 8)} ${operation} ${durationMs} ms ${error ?? "ok"}`),
   });
   console.log(`== Workspace ${identity.label} (${identity.id})`);
   for (const folder of folders) console.log(`== Folder ${folder}`);
+  process.send?.({ type: "workspace-ready" });
   console.log("== Provisioning tools");
   await provisionWorkspace((line) => console.log(line));
   console.log(`== Server ${parsed.serverUrl}`);
-  client.onChange(() => {
-    const status = client.status;
+  const workspace = client;
+  workspace.onChange(() => {
+    const status = workspace.status;
     console.log(status.kind === "failed" ? `== Registration failed: ${status.message}` : `== State ${status.kind}`);
+    if (status.kind === "failed" && !stopping && (status.mismatch || transport.rpc.status.kind === "unauthorized")) void stop(1, "registration or sign-in failed");
   });
-  await client.register();
-  if (client.status.kind !== "registered") {
-    process.exitCode = 1;
-    transport.rpc.close();
-    return;
-  }
+  await workspace.register();
+  if (stopping) return;
+  if (workspace.status.kind !== "registered") return stop(1, "registration failed");
   console.log("== Registered; Ctrl-C ends the workspace");
-  await new Promise<void>((finish) => {
-    const stop = () => {
-      process.off("SIGINT", stop);
-      process.off("SIGTERM", stop);
-      finish();
-    };
-    process.on("SIGINT", stop);
-    process.on("SIGTERM", stop);
-  });
-  await client.unregister();
-  transport.rpc.close();
+  process.once("exit", releaseOwner);
 };
 
 const moduleUrl: string | undefined = import.meta.url;
 if (moduleUrl && process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(moduleUrl)) {
   main().catch((error: unknown) => {
     console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    exitWorkspaceProcess(1);
   });
 }

package/scripts/package/build-package.ts

@@ -1,319 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { copyFile, mkdir, readdir, rm, writeFile } from "node:fs/promises";
-import { builtinModules } from "node:module";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { readHostVersion, readPackageVersion } from "../../apps/server/src/host-version.ts";
-import { hostWebDirectory, hostWebProblem, isCheckout } from "../../apps/server/src/host-web.ts";
-import { runtimeLibraries } from "../../apps/server/src/plugin-support/actor-programs/runtime-libraries.ts";
-import { assertBundleRevision, readBundleManifest, sourceRevisionOf } from "../../apps/server/src/profile/bundle-manifest.ts";
-import { builtInPluginFolders } from "../plugin/build-builtin-plugins.ts";
-
-export const PACKAGE_NAME = "@schlenkr/ragents";
-/** The folder under dist/; the package name has a scope, the folder name stays plain. */
-export const PACKAGE_FOLDER = "ragents";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
-
-const SKIPPED_FOLDERS = new Set(["node_modules", "dist", ".git"]);
-const SKIPPED_FILES = new Set([".DS_Store"]);
-
-/** The subcommands' tests run in the checkout; in the package only their test material would be visible. */
-const SKIPPED_IN_PACKAGE = /^scripts\/.*\.test\.tsx?$/;
-
-const packagePath = (packageRoot: string, file: string): string => path.relative(packageRoot, file).split(path.sep).join("/");
-
-/** The repository's neutral profiles; ragents start runs them from the package as from the checkout. */
-export const PACKAGED_PROFILES = ["core", "developer", "showcase"] as const;
-
-export const PACKAGE_LICENSE = "PolyForm-Shield-1.0.0";
-export const PACKAGE_AUTHOR = "Ronald Schlenker";
-export const REPOSITORY_URL = "https://github.com/SchlenkR/RAgents";
-export const PACKAGE_KEYWORDS = ["agents", "llm", "actors", "typescript", "csharp", "fsharp", "vscode"] as const;
-
-/** License and listing README are at the root of the package, their sources elsewhere in the repository. */
-export const PACKAGE_ROOT_FILES: readonly (readonly [string, string])[] = [
-  ["LICENSE", "LICENSE"],
-  ["scripts/package/README.md", "README.md"],
-];
-
-const ROOT_FILE_SOURCES = new Set(PACKAGE_ROOT_FILES.map(([source]) => source));
-
-const skippedInPackage = (relative: string): boolean => SKIPPED_IN_PACKAGE.test(relative) || ROOT_FILE_SOURCES.has(relative);
-
-/** What the host loads at runtime: server, engine, the built web, the built-in bundles, plugin sources for contracts and the build tool, profiles and the scripts behind the subcommands; plus the types from declarationFolders. */
-export const packageContents = (root = repositoryRoot): readonly string[] => [
-  "apps/server/package.json",
-  "apps/server/tsconfig.json",
-  "apps/server/tsconfig.plugin.json",
-  "apps/server/src",
-  "apps/web/package.json",
-  "apps/web/tsconfig.json",
-  "apps/web/tsconfig.plugin.json",
-  "apps/web/src",
-  "apps/web/dist",
-  ...readdirSync(path.join(root, "packages"), { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .flatMap((entry) => [`packages/${entry.name}/package.json`, `packages/${entry.name}/src`]),
-  "bundles",
-  "plugins",
-  ...PACKAGED_PROFILES.map((profile) => `ragents.config.${profile}.ts`),
-  "scripts/agent",
-  "scripts/package",
-  "scripts/plugin",
-  "scripts/provision",
-  "scripts/remote",
-  "scripts/workspace-client",
-];
-
-/** The forked agent runtime runs from its sources, its types exist only built; the build tool checks third-party plugins against them. */
-export const declarationFolders = (root = repositoryRoot): readonly string[] =>
-  readdirSync(path.join(root, "packages"), { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .filter((entry) => {
-      const manifest = path.join(root, "packages", entry.name, "package.json");
-      const types = statSync(manifest, { throwIfNoEntry: false })?.isFile() ? (JSON.parse(readFileSync(manifest, "utf8")) as { types?: unknown }).types : undefined;
-      return typeof types === "string" && types.startsWith("./dist/");
-    })
-    .map((entry) => `packages/${entry.name}/dist`);
-
-/** What the host executes, bundles into a mini-app or reads when building a plugin. */
-const SCANNED = ["apps/server/src", "apps/web", "packages", "plugins", "scripts"];
-const PACKAGE_NAME_PATTERN = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
-const SCAN_SKIPPED = new Set(["node_modules", "dist"]);
-const SCANNED_EXTENSIONS = new Set([".ts", ".tsx", ".mts", ".mjs", ".js", ".css"]);
-const IMPORT_PATTERN = /\b(?:from|import|require(?:\.resolve)?)\s*\(?\s*["']([^"'\n]+)["']/g;
-/** An executor contribution resolves packages from the host at runtime; the package must carry them too. */
-const HOST_PACKAGE_PATTERN = /\bhostPackageFile\([^,()]*,\s*["']([^"'\n]+)["']/g;
-
-const files = async (folder: string, skippedFolders: ReadonlySet<string> = SKIPPED_FOLDERS): Promise<readonly string[]> => {
-  const found: string[] = [];
-  for (const entry of (await readdir(folder, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
-    if (entry.isDirectory()) {
-      if (!skippedFolders.has(entry.name)) found.push(...await files(path.join(folder, entry.name), skippedFolders));
-    } else if (entry.isFile() && !SKIPPED_FILES.has(entry.name)) {
-      found.push(path.join(folder, entry.name));
-    }
-  }
-  return found;
-};
-
-const copyTo = async (source: string, target: string, packageRoot: string, skippedFolders?: ReadonlySet<string>): Promise<readonly string[]> => {
-  if (statSync(source).isFile()) {
-    if (skippedInPackage(packagePath(packageRoot, target))) return [];
-    await mkdir(path.dirname(target), { recursive: true });
-    await copyFile(source, target);
-    return [target];
-  }
-  const copied: string[] = [];
-  for (const file of await files(source, skippedFolders)) {
-    const destination = path.join(target, path.relative(source, file));
-    if (skippedInPackage(packagePath(packageRoot, destination))) continue;
-    await mkdir(path.dirname(destination), { recursive: true });
-    await copyFile(file, destination);
-    copied.push(destination);
-  }
-  return copied;
-};
-
-const scanRoots = (root: string): readonly string[] => SCANNED.map((entry) => path.join(root, entry));
-
-const scannedFiles = (folder: string): readonly string[] => {
-  if (!statSync(folder, { throwIfNoEntry: false })?.isDirectory()) return [];
-  return readdirSync(folder, { withFileTypes: true }).flatMap((entry) => {
-    const absolute = path.join(folder, entry.name);
-    if (entry.isDirectory()) return SCAN_SKIPPED.has(entry.name) ? [] : scannedFiles(absolute);
-    return entry.isFile() && SCANNED_EXTENSIONS.has(path.extname(entry.name)) ? [absolute] : [];
-  });
-};
-
-const packageNameOf = (specifier: string): string | undefined => {
-  if (/^(\.{1,2}\/|\/|node:|data:|@ragents\/|virtual:)/.test(specifier) || specifier === "vscode") return undefined;
-  const parts = specifier.split("/");
-  const name = specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]!;
-  if (builtinModules.includes(name)) return undefined;
-  return PACKAGE_NAME_PATTERN.test(name) ? name : undefined;
-};
-
-const declaredWebDependencies = (packageDirectory: string): readonly string[] => {
-  const file = path.join(packageDirectory, "apps/web/package.json");
-  const declared = (JSON.parse(readFileSync(file, "utf8")) as { dependencies?: Record<string, string> }).dependencies ?? {};
-  return Object.keys(declared);
-};
-
-/** The packages that the executed part of the package actually imports, plus the libraries linked at runtime
- * and those that the host's web offers to the web halves of third-party plugins. */
-export const requiredPackages = (packageDirectory: string): ReadonlyMap<string, string> => {
-  const sources = new Map<string, string>();
-  for (const name of runtimeLibraries) sources.set(name, "plugins/ragents.actor-programs (linked at runtime)");
-  for (const name of declaredWebDependencies(packageDirectory)) sources.set(name, "apps/web/package.json (for the web halves of the plugins)");
-  for (const folder of scanRoots(packageDirectory)) {
-    for (const file of scannedFiles(folder)) {
-      const content = readFileSync(file, "utf8");
-      for (const match of [...content.matchAll(IMPORT_PATTERN), ...content.matchAll(HOST_PACKAGE_PATTERN)]) {
-        const name = packageNameOf(match[1]!);
-        if (name && !sources.has(name)) sources.set(name, path.relative(packageDirectory, file));
-      }
-    }
-  }
-  return new Map([...sources].sort(([left], [right]) => left.localeCompare(right, "en")));
-};
-
-const compareVersions = (left: string, right: string): number => {
-  const parts = (value: string) => value.split(/[.+-]/).map((part) => Number.isInteger(Number(part)) ? Number(part) : part);
-  const [first, second] = [parts(left), parts(right)];
-  for (let index = 0; index < Math.max(first.length, second.length); index += 1) {
-    const [one, other] = [first[index] ?? 0, second[index] ?? 0];
-    if (one === other) continue;
-    return typeof one === "number" && typeof other === "number" ? one - other : String(one).localeCompare(String(other), "en");
-  }
-  return 0;
-};
-
-const anchors = (root: string): readonly string[] => [
-  path.join(root, "package.json"),
-  ...["apps", "packages"].flatMap((group) => readdirSync(path.join(root, group), { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => path.join(root, group, entry.name, "package.json"))
-    .filter((file) => statSync(file, { throwIfNoEntry: false })?.isFile() === true)),
-];
-
-/** The versions this checkout has installed for a package; the newest goes into the package. */
-export const installedVersions = (name: string, root = repositoryRoot): readonly string[] => {
-  const found = new Set<string>();
-  for (const anchor of anchors(root)) {
-    for (let directory = path.dirname(anchor); ; directory = path.dirname(directory)) {
-      const file = path.join(directory, "node_modules", ...name.split("/"), "package.json");
-      if (statSync(file, { throwIfNoEntry: false })?.isFile()) {
-        found.add((JSON.parse(readFileSync(file, "utf8")) as { version: string }).version);
-        break;
-      }
-      if (path.dirname(directory) === directory) break;
-    }
-  }
-  const versions = [...found].sort(compareVersions);
-  if (versions.length === 0) throw new Error(`The package ${name} is not installed in this checkout; without a version it cannot go into the package`);
-  return versions;
-};
-
-export interface BuiltPackage {
-  readonly directory: string;
-  readonly manifest: Record<string, unknown>;
-  readonly fileCount: number;
-  readonly byteSize: number;
-  readonly flattened: readonly string[];
-}
-
-/** The package ships the web prebuilt; it must be built and match its sources. */
-const assertHostWeb = (root: string): void => {
-  const problem = hostWebProblem(hostWebDirectory(root), root, isCheckout(root));
-  if (problem) throw new Error(`${problem}; run pnpm build:web first`);
-};
-
-/** Every built-in plugin must exist as a bundle and match its sources, otherwise the package starts no profile. */
-const assertBuiltInBundles = (root: string): void => {
-  for (const folder of builtInPluginFolders(path.join(root, "plugins"))) {
-    const bundle = path.join(root, "bundles", path.basename(folder));
-    if (!statSync(bundle, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`The bundle ${bundle} is missing; run pnpm build:plugins first`);
-    if (readBundleManifest(bundle).sourceRevision !== sourceRevisionOf(folder)) throw new Error(`The bundle ${bundle} no longer matches ${folder}; run pnpm build:plugins first`);
-  }
-};
-
-const copyDeclarations = async (root: string, target: string): Promise<readonly string[]> => {
-  const copied: string[] = [];
-  for (const folder of declarationFolders(root)) {
-    if (!statSync(path.join(root, folder), { throwIfNoEntry: false })?.isDirectory()) throw new Error(`${folder} is missing; run pnpm build:agent first`);
-    for (const file of (await files(path.join(root, folder))).filter((name) => name.endsWith(".d.ts"))) {
-      const destination = path.join(target, path.relative(root, file));
-      await mkdir(path.dirname(destination), { recursive: true });
-      await copyFile(file, destination);
-      copied.push(destination);
-    }
-  }
-  return copied;
-};
-
-export const buildPackage = async (target: string, root = repositoryRoot): Promise<BuiltPackage> => {
-  assertBuiltInBundles(root);
-  assertHostWeb(root);
-  await rm(target, { recursive: true, force: true });
-  await mkdir(target, { recursive: true });
-  let fileCount = 0;
-  let byteSize = 0;
-  for (const entry of packageContents(root)) {
-    // A bundle is fully built and goes into the package completely, including an asset folder named dist.
-    const copied = await copyTo(path.join(root, entry), path.join(target, entry), target, entry === "bundles" ? new Set() : undefined);
-    fileCount += copied.length;
-    for (const file of copied) byteSize += statSync(file).size;
-  }
-  for (const folder of builtInPluginFolders(path.join(root, "plugins"))) {
-    const bundle = path.join(target, "bundles", path.basename(folder));
-    assertBundleRevision(bundle, readBundleManifest(bundle));
-  }
-  for (const file of await copyDeclarations(root, target)) {
-    fileCount += 1;
-    byteSize += statSync(file).size;
-  }
-  for (const [source, packaged] of PACKAGE_ROOT_FILES) {
-    const destination = path.join(target, packaged);
-    await mkdir(path.dirname(destination), { recursive: true });
-    await copyFile(path.join(root, source), destination);
-    fileCount += 1;
-    byteSize += statSync(destination).size;
-  }
-  const flattened: string[] = [];
-  const dependencies: Record<string, string> = {};
-  for (const [name] of requiredPackages(target)) {
-    const versions = installedVersions(name, root);
-    if (versions.length > 1) flattened.push(`${name}: ${versions.join(", ")} -> ${versions.at(-1)!}`);
-    dependencies[name] = versions.at(-1)!;
-  }
-  const manifest = {
-    name: PACKAGE_NAME,
-    version: readPackageVersion(root),
-    description: "RAgents host: server, engine, plugins and tools without a source checkout",
-    keywords: [...PACKAGE_KEYWORDS],
-    homepage: "https://schlenkr.github.io/RAgents/",
-    bugs: { url: `${REPOSITORY_URL}/issues` },
-    license: PACKAGE_LICENSE,
-    author: PACKAGE_AUTHOR,
-    repository: { type: "git", url: `git+${REPOSITORY_URL}.git` },
-    type: "module",
-    bin: { ragents: "scripts/package/ragents.mjs" },
-    engines: { node: ">=22.19.0" },
-    publishConfig: { access: "public" },
-    dependencies,
-    ragents: { hostVersion: readHostVersion(root) },
-  };
-  const manifestFile = path.join(target, "package.json");
-  await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`);
-  fileCount += 1;
-  byteSize += statSync(manifestFile).size;
-  return { directory: target, manifest, fileCount, byteSize, flattened };
-};
-
-const main = async (): Promise<void> => {
-  const pack = process.argv.includes("--pack");
-  const unknown = process.argv.slice(2).filter((argument) => argument !== "--pack");
-  if (unknown.length) throw new Error(`Unknown argument: ${unknown.join(" ")} (allowed: --pack)`);
-  const target = path.join(repositoryRoot, "dist", PACKAGE_FOLDER);
-  const built = await buildPackage(target);
-  console.log(`== Package ${PACKAGE_NAME}@${built.manifest.version as string} in ${built.directory}`);
-  console.log(`== Host version ${(built.manifest.ragents as { hostVersion: string }).hostVersion}`);
-  console.log(`== ${built.fileCount} files, ${(built.byteSize / 1024 / 1024).toFixed(1)} MB, ${Object.keys(built.manifest.dependencies as object).length} dependencies`);
-  for (const [name, version] of Object.entries(built.manifest.dependencies as Record<string, string>)) console.log(`   ${name}@${version}`);
-  for (const entry of built.flattened) console.log(`== Multiple versions flattened: ${entry}`);
-  if (!pack) return;
-  const packed = spawnSync("npm", ["pack", "--pack-destination", path.dirname(built.directory)], { cwd: built.directory, encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
-  if (packed.status !== 0) throw new Error(`npm pack ended with code ${packed.status}`);
-  console.log(`== Archive ${path.join(path.dirname(built.directory), packed.stdout.trim().split("\n").at(-1) ?? "")}`);
-};
-
-const moduleUrl: string | undefined = import.meta.url;
-if (moduleUrl && process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(moduleUrl)) {
-  main().catch((error: unknown) => {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  });
-}

package/scripts/package/publish-package.ts

@@ -1,144 +0,0 @@
-import { spawnSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { compareVersions, readVersion, releaseVersion, versionLine, writeHostPackageVersion, writeVersion } from "../publish-version.ts";
-import { buildPackage, PACKAGE_FOLDER, PACKAGE_NAME } from "./build-package.ts";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
-
-const usage = `Usage: pnpm publish:package [--dry-run]
-Builds the package ${PACKAGE_NAME} and publishes it on npm. The token comes from the
-environment variable npm_key. --dry-run passes the dry run through to npm and publishes nothing.
-The version is in the root package.json; before building, the script raises the last place
-above the last published version, in a dry run only in the output.`;
-
-const REGISTRY_TOKEN_KEY = "npm_config_//registry.npmjs.org/:_authToken";
-
-export interface NpmResult {
-  readonly status: number;
-  readonly stdout: string;
-  readonly stderr: string;
-}
-
-export type NpmRunner = (args: readonly string[], options: { cwd: string; token?: string }) => NpmResult;
-
-/** The token goes only as configuration into the child process's environment, never onto the command line. */
-export const publishEnvironment = (token: string, base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv =>
-  ({ ...base, [REGISTRY_TOKEN_KEY]: token });
-
-/** Everything that comes from npm goes through this mask so that the token does not show up even in an error message. */
-export const redacting = (token: string) => (text: string): string => token ? text.split(token).join("<npm_key>") : text;
-
-/** An error message is one line; npm's output is therefore moved onto one. */
-export const oneLine = (text: string): string => text.split("\n").map((line) => line.trim()).filter(Boolean).join("; ");
-
-const runNpm: NpmRunner = (args, options) => {
-  const result = spawnSync("npm", [...args], {
-    cwd: options.cwd,
-    encoding: "utf8",
-    env: options.token ? publishEnvironment(options.token) : process.env,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  if (result.error) throw new Error(`npm ${args[0]} could not be started: ${result.error.message}`);
-  return { status: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
-};
-
-/** The versions already on npm; a package unknown there is the empty list, not an error. */
-export const publishedVersions = (name: string, npm: NpmRunner): readonly string[] => {
-  const result = npm(["view", name, "versions", "--json"], { cwd: repositoryRoot });
-  if (result.status !== 0) {
-    if (/E404|404 Not Found/.test(`${result.stdout}\n${result.stderr}`)) return [];
-    throw new Error(`npm view ${name} versions ended with code ${result.status}: ${oneLine(result.stderr)}`);
-  }
-  const parsed = JSON.parse(result.stdout.trim() || "[]") as string | readonly string[];
-  return typeof parsed === "string" ? [parsed] : parsed;
-};
-
-/** The highest version on npm; a package unknown there has none. */
-export const latestPublishedVersion = (npm: NpmRunner = runNpm, name = PACKAGE_NAME): string | undefined =>
-  [...publishedVersions(name, npm)].sort(compareVersions).at(-1);
-
-export interface PublishPlan {
-  readonly name: string;
-  readonly version: string;
-  readonly hostVersion: string;
-}
-
-/** What must be right before a publish: the built manifest and a version that does not yet exist on npm. */
-export const publishPlan = (manifest: Record<string, unknown>, published: readonly string[], version: string): PublishPlan => {
-  const { name } = manifest as { name?: unknown };
-  const access = (manifest.publishConfig as { access?: unknown } | undefined)?.access;
-  const hostVersion = (manifest.ragents as { hostVersion?: unknown } | undefined)?.hostVersion;
-  if (name !== PACKAGE_NAME) throw new Error(`The built package is named ${String(name)}, but ${PACKAGE_NAME} is published`);
-  if (access !== "public") throw new Error(`${PACKAGE_NAME} has a scope and needs publishConfig.access "public", not ${JSON.stringify(access)}`);
-  if (!/^\d+\.\d+\.\d+(?:-[0-9a-z.-]+)?$/.test(version)) {
-    throw new Error(`The version ${JSON.stringify(version)} is not a version; it is the version in the root package.json`);
-  }
-  if (typeof hostVersion !== "string" || !/^[0-9a-f]{40}$/.test(hostVersion)) {
-    throw new Error("The package lacks ragents.hostVersion as a full Git commit; it is built only from a checkout");
-  }
-  if (published.includes(version)) {
-    throw new Error(`${PACKAGE_NAME}@${version} is already on npm (there: ${published.join(", ")}); `
-      + "raise version in the root package.json and rebuild");
-  }
-  return { name: PACKAGE_NAME, version, hostVersion };
-};
-
-export interface PublishOptions {
-  readonly directory: string;
-  readonly version: string;
-  readonly token: string;
-  readonly dryRun: boolean;
-  readonly npm: NpmRunner;
-  readonly log: (line: string) => void;
-}
-
-/** npm reports a missing organization as 404; without the hint you look for the error in the package. */
-const scopeAdvice = (output: string): string => /Scope not found/i.test(output)
-  ? ` The organization ${PACKAGE_NAME.split("/")[0]} does not exist on npm or the token may not use it: `
-    + "create it on npmjs.com or grant the token access to the scope."
-  : "";
-
-/** Publishes the built folder; exit 0 of npm publish is the confirmation. */
-export const publishDirectory = (options: PublishOptions): void => {
-  const hide = redacting(options.token);
-  const published = options.npm(["publish", "--access", "public", ...options.dryRun ? ["--dry-run"] : []], { cwd: options.directory, token: options.token });
-  const output = `${published.stdout}${published.stderr}`;
-  for (const line of output.split("\n")) if (line.trim()) options.log(hide(line));
-  if (published.status !== 0) throw new Error(`npm publish ended with code ${published.status}.${scopeAdvice(output)}`);
-  if (options.dryRun) {
-    options.log("== Dry run: nothing published");
-    return;
-  }
-  options.log(`== Published: ${PACKAGE_NAME}@${options.version}`);
-};
-
-const main = async (): Promise<void> => {
-  const dryRun = process.argv.includes("--dry-run");
-  const unknown = process.argv.slice(2).filter((argument) => argument !== "--dry-run");
-  if (unknown.length) throw new Error(`Unknown argument: ${unknown.join(" ")}\n${usage}`);
-  const token = process.env.npm_key;
-  if (!token) throw new Error(`npm_key is missing: the npm token with write access to ${PACKAGE_NAME}.\n${usage}`);
-  const manifestFile = path.join(repositoryRoot, "package.json");
-  const published = publishedVersions(PACKAGE_NAME, runNpm);
-  const extensionManifestFile = path.join(repositoryRoot, "apps", "vscode", "package.json");
-  const next = releaseVersion([readVersion(manifestFile), readVersion(extensionManifestFile)], published);
-  console.log(versionLine(next));
-  if (!dryRun) {
-    writeVersion(manifestFile, next.version);
-    writeVersion(extensionManifestFile, next.version);
-    writeHostPackageVersion(extensionManifestFile, next.version);
-  }
-  const built = await buildPackage(path.join(repositoryRoot, "dist", PACKAGE_FOLDER));
-  const plan = publishPlan(built.manifest, published, next.version);
-  console.log(`== ${plan.name}@${plan.version} from host ${plan.hostVersion.slice(0, 12)}, ${built.fileCount} files, ${(built.byteSize / 1024 / 1024).toFixed(1)} MB`);
-  publishDirectory({ directory: built.directory, version: plan.version, token, dryRun, npm: runNpm, log: (line) => console.log(line) });
-};
-
-const moduleUrl: string | undefined = import.meta.url;
-if (moduleUrl && process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(moduleUrl)) {
-  main().catch((error: unknown) => {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  });
-}