@smilintux/skcapstone 0.9.0 → 0.12.5

package/scripts/watch-anthropic-token.sh

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+# Watch Claude Code credentials file and sync token to OpenClaw immediately on change.
+#
+# Replaces the 2-hour timer approach which missed token refreshes.
+# Claude Code auto-refreshes its OAuth token and writes to .credentials.json.
+# This script detects the write and syncs within seconds.
+#
+# Requires: inotifywait (from inotify-tools package)
+# Install: sudo apt install inotify-tools
+#
+# Run as systemd user service (not timer).
+
+set -euo pipefail
+
+CREDS="$HOME/.claude/.credentials.json"
+OPENCLAW_JSON="$HOME/.openclaw/openclaw.json"
+OPENCLAW_ENV="$HOME/.openclaw/.env"
+OVERRIDE_CONF="$HOME/.config/systemd/user/openclaw-gateway.service.d/override.conf"
+LOG_TAG="anthropic-token-watch"
+
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [$LOG_TAG] $*"; }
+
+sync_token() {
+    if [ ! -f "$CREDS" ]; then
+        log "ERROR: Claude credentials not found at $CREDS"
+        return 1
+    fi
+
+    # Read current token from Claude Code
+    local new_token
+    new_token=$(python3 -c "import json; print(json.load(open('$CREDS'))['claudeAiOauth']['accessToken'])" 2>/dev/null) || {
+        log "ERROR: Failed to read token from credentials"
+        return 1
+    }
+
+    local expires_in
+    expires_in=$(python3 -c "import json,time; print(f'{(json.load(open(\"$CREDS\"))[\"claudeAiOauth\"][\"expiresAt\"]/1000 - time.time())/3600:.1f}h')" 2>/dev/null || echo "unknown")
+
+    # Read current token from credentials file (track changes by comparing with last known)
+    local state_file="$HOME/.skcapstone/agents/lumina/logs/anthropic-token.last"
+    local current_token
+    current_token=$(cat "$state_file" 2>/dev/null || echo "")
+
+    if [ "$new_token" = "$current_token" ]; then
+        log "Token unchanged (expires in $expires_in)"
+        return 0
+    fi
+
+    log "Token changed! Syncing... (new token expires in $expires_in)"
+
+    # 1. Save new token to state file
+    echo "$new_token" > "$state_file"
+    log "State file updated"
+
+    # NOTE: anthropic provider removed from openclaw.json — all Claude models
+    # now route through claude-code proxy (port 18782). No openclaw.json update needed.
+
+    # 2. Update .env (kept for any scripts that source it)
+    if grep -q "^ANTHROPIC_API_KEY=" "$OPENCLAW_ENV" 2>/dev/null; then
+        sed -i "s|^ANTHROPIC_API_KEY=.*|ANTHROPIC_API_KEY=$new_token|" "$OPENCLAW_ENV"
+    else
+        echo "ANTHROPIC_API_KEY=$new_token" >> "$OPENCLAW_ENV"
+    fi
+    log "Updated .env"
+
+    # 3. Update systemd override (ANTHROPIC_API_KEY kept for claude-code-api server)
+    if [ -f "$OVERRIDE_CONF" ]; then
+        local nvidia_key
+        nvidia_key=$(grep "NVIDIA_API_KEY=" "$OVERRIDE_CONF" 2>/dev/null | sed 's/.*NVIDIA_API_KEY=//' || true)
+        cat > "$OVERRIDE_CONF" << EOF
+[Unit]
+StartLimitIntervalSec=60
+StartLimitBurst=10
+
+[Service]
+RestartSec=10
+Environment=NVIDIA_API_KEY=${nvidia_key}
+Environment=ANTHROPIC_API_KEY=${new_token}
+EOF
+        log "Updated systemd override"
+    fi
+
+    # 4. Reload and restart gateway
+    systemctl --user daemon-reload 2>/dev/null || true
+    systemctl --user restart openclaw-gateway 2>/dev/null && log "Gateway restarted" || log "WARN: Gateway restart failed (may not be running as systemd service)"
+
+    # 5. Sync credentials to GPU box (.100) for skvoice service
+    scp -q "$CREDS" cbrd21@192.168.0.100:~/.claude/.credentials.json 2>/dev/null && log "Synced credentials to .100" || log "WARN: Failed to sync credentials to .100"
+
+    log "Sync complete. Token expires in $expires_in"
+}
+
+# Proactive token refresh — refresh before expiry even if no Claude Code session is running
+refresh_token_proactively() {
+    if [ ! -f "$CREDS" ]; then return 0; fi
+
+    local remaining_ms
+    remaining_ms=$(python3 -c "
+import json, time
+creds = json.load(open('$CREDS'))
+exp = creds.get('claudeAiOauth',{}).get('expiresAt', 0)
+print(int(exp - time.time() * 1000))
+" 2>/dev/null || echo "999999999")
+
+    # Refresh if less than 3 hours remaining (10800000 ms) — gives time for retries before expiry
+    if [ "$remaining_ms" -gt 10800000 ]; then
+        local remaining_h=$(( remaining_ms / 3600000 ))
+        log "Token still valid (${remaining_h}h remaining), no refresh needed"
+        return 0
+    fi
+
+    log "Token expiring/expired (${remaining_ms}ms remaining) — proactively refreshing..."
+
+    # Strategy: use `claude auth status` to trigger Claude Code's built-in
+    # token refresh. This is far more reliable than calling the OAuth endpoint
+    # ourselves (which gets 429 rate-limited every time).
+    # Claude Code manages its own PKCE state, session cookies, etc. — just let it.
+    local MAX_RETRIES=3
+    local attempt=0
+    local refreshed=false
+
+    while [ "$attempt" -lt "$MAX_RETRIES" ]; do
+        attempt=$((attempt + 1))
+        log "Refresh attempt $attempt/$MAX_RETRIES via 'claude auth status'..."
+
+        # claude auth status checks credentials and refreshes if needed
+        # --output json ensures clean non-interactive output
+        local output
+        output=$(claude auth status --output json 2>&1) || true
+
+        # Check if the token was actually refreshed (file mtime changed)
+        local new_remaining_ms
+        new_remaining_ms=$(python3 -c "
+import json, time
+creds = json.load(open('$CREDS'))
+exp = creds.get('claudeAiOauth',{}).get('expiresAt', 0)
+print(int(exp - time.time() * 1000))
+" 2>/dev/null || echo "0")
+
+        if [ "$new_remaining_ms" -gt 10800000 ]; then
+            local new_h=$(( new_remaining_ms / 3600000 ))
+            log "Token refreshed successfully (${new_h}h remaining)"
+            refreshed=true
+            break
+        fi
+
+        log "Token still expired after attempt $attempt, waiting 30s..."
+        sleep 30
+    done
+
+    if [ "$refreshed" = "false" ]; then
+        log "ERROR: All $MAX_RETRIES refresh attempts via claude auth failed"
+        log "Token may require manual 'claude auth login' to re-authenticate"
+    fi
+
+    local rc=$?
+    if [ "$rc" -eq 0 ]; then
+        log "Proactive refresh succeeded"
+        # sync_token will fire from the inotifywait detecting the file write,
+        # but also call it directly in case inotifywait misses the self-write
+        sync_token
+    else
+        log "ERROR: Proactive refresh failed (rc=$rc)"
+    fi
+    return 0  # Never let refresh failure kill the watcher loop
+}
+
+# Compute inotifywait timeout based on token remaining life.
+# When token is healthy: check every 30m. Near expiry (<2h): check every 5m.
+# Already expired: check every 2m (retry window for 429 backoff).
+get_watch_timeout() {
+    local remaining_ms
+    remaining_ms=$(python3 -c "
+import json, time
+creds = json.load(open('$CREDS'))
+exp = creds.get('claudeAiOauth',{}).get('expiresAt', 0)
+print(int(exp - time.time() * 1000))
+" 2>/dev/null || echo "0")
+
+    if [ "$remaining_ms" -le 0 ]; then
+        echo 120    # Expired: retry every 2 minutes
+    elif [ "$remaining_ms" -le 10800000 ]; then
+        echo 180    # <3h remaining: check every 3 minutes
+    else
+        echo 1800   # Healthy: check every 30 minutes
+    fi
+}
+
+# Initial sync on startup — also refresh proactively if token is expired/expiring
+log "Starting token watcher..."
+sync_token || true
+refresh_token_proactively || true
+
+# Watch for changes to credentials file + proactive refresh timer
+log "Watching $CREDS for changes (with adaptive refresh interval)..."
+while true; do
+    timeout=$(get_watch_timeout)
+    # inotifywait returns: 0=event, 1=error, 2=timeout
+    # CRITICAL: use `|| true` to prevent set -e from killing the script on timeout
+    inotifywait -q -t "$timeout" -e modify -e close_write -e moved_to \
+        "$(dirname "$CREDS")" --include "$(basename "$CREDS")" 2>/dev/null || true
+
+    # Always check for proactive refresh on every loop iteration
+    # This handles both timeout and file-change cases
+    refresh_token_proactively || true
+
+    # If file was modified externally (Claude Code session), also sync
+    if [ -f "$CREDS" ]; then
+        sleep 1
+        sync_token || true
+    fi
+done

package/scripts/windows/install-tasks.ps1

@@ -62,7 +62,7 @@ if (-not $SkenvPath) {
 
 $PythonExe      = Join-Path $SkenvPath 'Scripts\python.exe'
 $SKCapstoneExe  = Join-Path $SkenvPath 'Scripts\skcapstone.exe'
-$SKCommExe      = Join-Path $SkenvPath 'Scripts\skcomm.exe'
+$SKCommsExe      = Join-Path $SkenvPath 'Scripts\skcomms.exe'
 
 if (-not (Test-Path $PythonExe)) {
     Write-Host "ERROR: Python not found at $PythonExe" -ForegroundColor Red
@@ -261,10 +261,10 @@ if (Remove-ExistingTask 'SKCapstone-SyncWatcher') {
 }
 
 # ---------------------------------------------------------------------------
-# Task 4: Health Monitor / Heartbeat (equivalent to skcomm-heartbeat.timer
-#         and skcomm-queue-drain.timer combined)
+# Task 4: Health Monitor / Heartbeat (equivalent to skcomms-heartbeat.timer
+#         and skcomms-queue-drain.timer combined)
 #   Trigger: Every 60 seconds after logon
-#   Action:  skcomm heartbeat && skcomm queue drain
+#   Action:  skcomms heartbeat && skcomms queue drain
 # ---------------------------------------------------------------------------
 Write-Host '[4/5] Health Monitor Heartbeat (every 60s)...' -ForegroundColor Green
 
@@ -279,9 +279,9 @@ if (Remove-ExistingTask 'SKCapstone-Heartbeat') {
     $content = @"
 @echo off
 echo [%date% %time%] === heartbeat started === >> "$logFile"
-"$SKCommExe" heartbeat >> "$logFile" 2>&1
+"$SKCommsExe" heartbeat >> "$logFile" 2>&1
 echo [%date% %time%] heartbeat exit: %ERRORLEVEL% >> "$logFile"
-"$SKCommExe" queue drain >> "$logFile" 2>&1
+"$SKCommsExe" queue drain >> "$logFile" 2>&1
 echo [%date% %time%] queue-drain exit: %ERRORLEVEL% >> "$logFile"
 echo [%date% %time%] === heartbeat finished === >> "$logFile"
 "@
@@ -310,7 +310,7 @@ echo [%date% %time%] === heartbeat finished === >> "$logFile"
         -Trigger $trigger `
         -Settings $settings `
         -Principal $principal `
-        -Description 'Heartbeat + queue drain — equivalent to skcomm-heartbeat.timer + skcomm-queue-drain.timer' | Out-Null
+        -Description 'Heartbeat + queue drain — equivalent to skcomms-heartbeat.timer + skcomms-queue-drain.timer' | Out-Null
 
     Write-Host '  Registered: Every 60 seconds after logon'
     $registered++

package/scripts/windows/skcapstone-task.xml

@@ -15,7 +15,7 @@
   the Command/Arguments and Triggers sections for other tasks:
     - MemoryCompress:  Command=skcapstone.exe memory compress, Trigger=Weekly
     - SyncWatcher:     Command=python.exe -m skcapstone.cli sync poll, Trigger=Repetition/2min
-    - Heartbeat:       Command=skcomm.exe heartbeat, Trigger=Repetition/1min
+    - Heartbeat:       Command=skcomms.exe heartbeat, Trigger=Repetition/1min
     - Housekeeping:    See install-tasks.ps1 for the batch wrapper approach
 -->
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">

package/src/skcapstone/__init__.py

@@ -11,9 +11,16 @@ import os
 import platform
 from pathlib import Path
 
-__version__ = "0.4.4"
+__version__ = "0.6.8"
 __author__ = "smilinTux"
 
+# Canonical default agent for the entire SK* suite. This is THE single source
+# of truth for the fallback agent name — used by Python paths directly and
+# propagated to the shell picker + child processes via `skcapstone shell-init`
+# (which emits `export SK_DEFAULT_AGENT=<this>`). Override with the
+# SK_DEFAULT_AGENT environment variable.
+DEFAULT_AGENT = (os.environ.get("SK_DEFAULT_AGENT") or "lumina").strip() or "lumina"
+
 
 def _default_home() -> str:
     """Platform-aware default home for skcapstone."""
@@ -25,11 +32,41 @@ def _default_home() -> str:
     return os.path.expanduser("~/.skcapstone")
 
 
+def _detect_active_agent(root: str | None = None) -> str | None:
+    """Best-effort active agent discovery.
+
+    Resolution order:
+    1. Explicit SKAGENT / SKCAPSTONE_AGENT environment variable
+    2. SK_DEFAULT_AGENT (defaults to "lumina") if that agent dir exists
+    3. First non-template directory under ~/.skcapstone/agents (alphabetical)
+
+    Returns:
+        The active agent name if one can be resolved, else None.
+    """
+    env_agent = (os.environ.get("SKAGENT") or os.environ.get("SKCAPSTONE_AGENT", "")).strip()
+    if env_agent:
+        return env_agent
+
+    base = Path(root or os.environ.get("SKCAPSTONE_HOME", _default_home())).expanduser()
+    agents_dir = base / "agents"
+    if not agents_dir.exists():
+        return None
+
+    candidates = sorted(
+        entry.name
+        for entry in agents_dir.iterdir()
+        if entry.is_dir() and not entry.name.endswith("-template")
+    )
+    if not candidates:
+        return None
+    return DEFAULT_AGENT if DEFAULT_AGENT in candidates else candidates[0]
+
+
 # Root of the skcapstone tree (shared infra lives here)
 AGENT_HOME = os.environ.get("SKCAPSTONE_HOME", _default_home())
 
 # Which agent this process is running as (set by daemon/connector)
-SKCAPSTONE_AGENT = os.environ.get("SKCAPSTONE_AGENT", "lumina")
+SKCAPSTONE_AGENT = _detect_active_agent() or ""
 
 # Default daemon port
 DEFAULT_PORT = int(os.environ.get("SKCAPSTONE_PORT", "9383"))
@@ -59,13 +96,18 @@ def agent_home(agent_name: str | None = None) -> Path:
     Returns:
         Path to the agent-specific home directory.
     """
-    name = agent_name or SKCAPSTONE_AGENT
+    name = agent_name or SKCAPSTONE_AGENT or _detect_active_agent()
     root = Path(AGENT_HOME).expanduser()
     if name:
         return root / "agents" / name
     return root
 
 
+def active_agent_name() -> str | None:
+    """Return the currently active agent name, if one can be resolved."""
+    return SKCAPSTONE_AGENT or _detect_active_agent()
+
+
 def shared_home() -> Path:
     """Return the shared root directory (~/.skcapstone/).
 

package/src/skcapstone/_cli_monolith.py

@@ -643,7 +643,7 @@ def doctor(home: str, json_out: bool):
         "agent": "Agent Home",
         "identity": "Identity (CapAuth)",
         "memory": "Memory (SKMemory)",
-        "transport": "Transport (SKComm)",
+        "transport": "Transport (SKComms)",
         "sync": "Sync (Singularity)",
     }
 
@@ -2818,7 +2818,7 @@ def completions_uninstall(shell_name: str):
 
 
 @main.command("test")
-@click.option("--package", "-p", default=None, help="Test a single package (e.g., skcomm, capauth).")
+@click.option("--package", "-p", default=None, help="Test a single package (e.g., skcomms, capauth).")
 @click.option("--fast", is_flag=True, help="Stop on first package failure.")
 @click.option("--verbose", "-v", is_flag=True, help="Verbose pytest output.")
 @click.option("--json-out", is_flag=True, help="Machine-readable JSON report.")
@@ -2826,15 +2826,15 @@ def completions_uninstall(shell_name: str):
 def test_cmd(package: str, fast: bool, verbose: bool, json_out: bool, timeout: int):
     """Run tests across all ecosystem packages.
 
-    Discovers skcapstone, capauth, skcomm, skchat, skmemory, and
-    cloud9-python test suites and runs them with a consolidated summary.
+    Discovers skcapstone, capauth, skcomms, skchat, skmemory, and
+    cloud9 test suites and runs them with a consolidated summary.
     Works from any terminal — no CI server required.
 
     Examples:
 
         skcapstone test
 
-        skcapstone test --package skcomm
+        skcapstone test --package skcomms
 
         skcapstone test --fast --verbose
 
@@ -3037,7 +3037,7 @@ def peer_list(sk_home: str, json_out: bool):
 def peer_remove(name: str, sk_home: str):
     """Remove a peer by name.
 
-    Removes from both skcapstone and skcomm registries.
+    Removes from both skcapstone and skcomms registries.
 
     Examples:
 
@@ -3212,8 +3212,8 @@ def dashboard(home: str, port: int, no_open: bool):
         import webbrowser
         try:
             webbrowser.open(url)
-        except Exception:
-            pass
+        except Exception as exc:
+            logger.warning("Failed to open browser for dashboard: %s", exc)
 
     server = start_dashboard(home_path, port=port)
     try:
@@ -3288,6 +3288,7 @@ def backup_create(home: str, output: str, no_encrypt: bool):
             console.print(f"  [green]Backup saved:[/] {result_path}")
 
     except Exception as exc:
+        logger.warning("_cli_monolith.py: %s", exc)
         console.print(f"  [red]Backup failed:[/] {exc}")
         sys.exit(1)
 
@@ -3325,6 +3326,7 @@ def backup_restore(backup_file: str, home: str, force: bool):
         console.print(f"  [yellow]{exc}[/]")
         sys.exit(1)
     except Exception as exc:
+        logger.warning("_cli_monolith.py: %s", exc)
         console.print(f"  [red]Restore failed:[/] {exc}")
         sys.exit(1)
 
@@ -3396,7 +3398,7 @@ def chat():
 def chat_send(peer: str, message: str, home: str, thread: Optional[str]):
     """Send a message to a peer agent.
 
-    Stores locally and delivers via SKComm if transports
+    Stores locally and delivers via SKComms if transports
     are configured.
 
     Examples:
@@ -3434,7 +3436,7 @@ def chat_inbox(home: str, limit: int, poll: bool):
     """Show recent messages.
 
     Displays messages from local history. Use --poll to check
-    SKComm transports for new messages first.
+    SKComms transports for new messages first.
 
     Examples:
 
@@ -5059,7 +5061,8 @@ def agents_messages(deployment_id: str, agent_name: Optional[str], limit: int, h
                     content[:80] + ("…" if len(content) > 80 else ""),
                 )
                 total_shown += 1
-            except Exception:
+            except Exception as e:
+                logger.warning("_cli_monolith.py: %s", e)
                 continue
 
         if table.row_count:
@@ -5106,7 +5109,8 @@ def agents_messages(deployment_id: str, agent_name: Optional[str], limit: int, h
                         content[:90] + ("…" if len(content) > 90 else ""),
                     )
                     total_shown += 1
-                except Exception:
+                except Exception as e:
+                    logger.warning("_cli_monolith.py: %s", e)
                     continue
 
             if bc_table.row_count:
@@ -5353,8 +5357,8 @@ def agents_spawn(
                 prov_backend = DockerProvider()
             elif prov_type == ProviderType.PROXMOX:
                 prov_backend = ProxmoxProvider()
-        except Exception:
-            pass
+        except Exception as exc:
+            logger.warning("Failed to initialize provider backend for %s: %s", provider, exc)
 
     # Auto-classify for display
     detected_role, detected_model = classify_task(task)
@@ -5814,7 +5818,8 @@ def skills_install(source: str, agent: str | None, home: str, force: bool) -> No
             try:
                 data = _json.loads(identity_path.read_text(encoding="utf-8"))
                 agent = data.get("name", "global")
-            except Exception:
+            except Exception as e:
+                logger.warning("_cli_monolith.py: %s", e)
                 agent = "global"
         else:
             agent = "global"

package/src/skcapstone/activity.py

@@ -33,6 +33,9 @@ from collections import deque
 from datetime import datetime, timezone
 from typing import Any
 
+import logging
+logger = logging.getLogger(__name__)
+
 _MAXLEN = 100
 
 _history: deque[dict] = deque(maxlen=_MAXLEN)
@@ -93,7 +96,8 @@ def _fan_out(event: dict) -> None:
     for q in clients:
         try:
             q.put_nowait(chunk)
-        except Exception:
+        except Exception as e:
+            logger.warning("activity.py: %s", e)
             dead.add(q)
     if dead:
         with _clients_lock:

package/src/skcapstone/agent_card.py

@@ -6,7 +6,7 @@ with you: identity, public key, contact transports, capabilities,
 and trust level.
 
 Cards are JSON files signed with the agent's PGP key. They can be
-shared over SKComm, published to Nostr, posted as QR codes, or
+shared over SKComms, published to Nostr, posted as QR codes, or
 exchanged via any out-of-band channel.
 
 Usage:
@@ -251,7 +251,8 @@ class AgentCard(BaseModel):
 
             verification = pub_key.verify(pgp_message)
             return bool(verification)
-        except Exception:
+        except Exception as e:
+            logger.warning("agent_card.py: %s", e)
             return False
 
     def save(self, filepath: str | Path) -> Path: