@thenewlabs/entangle-serve 2.1.0

package/dist/agent.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityInfo } from './capability.js';
+interface AgentOptions {
+    serverUrl: string;
+    outputMode?: string;
+    password?: string;
+    pinnedCapability?: CapabilityInfo;
+}
+export declare function startAgent(options: AgentOptions): Promise<void>;
+export {};
+//# sourceMappingURL=agent.d.ts.map

package/dist/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAExE,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,cAAc,CAAC;CACnC;AAcD,wBAAsB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CrE"}

package/dist/agent.js

@@ -0,0 +1,167 @@
+import WebSocket from 'ws';
+import { randomBytes } from 'crypto';
+import { getConfig, OutputHandler, parseOutputMode } from '@thenewlabs/entangle-utils';
+import { hashPassword } from '@thenewlabs/entangle-crypto';
+import { handleInvokerConnection } from './session.js';
+import { createCapability } from './capability.js';
+export async function startAgent(options) {
+    const output = new OutputHandler({ mode: parseOutputMode(options.outputMode || process.env.OUTPUT_MODE || 'text') });
+    const config = getConfig();
+    const state = {
+        capabilities: new Map(),
+        serverUrl: options.serverUrl,
+        output,
+        ...(options.outputMode && { outputMode: options.outputMode }),
+        ...(options.password && { password: options.password }),
+    };
+    output.info('Starting agent');
+    // Hash password if provided (Argon2id with a random salt).
+    if (state.password) {
+        state.passwordHash = await hashPassword(state.password);
+        output.info('Password protection enabled');
+    }
+    // Exactly one capability is served: a pinned one supplied by the caller, or a
+    // fresh ephemeral one minted in memory (never written to disk).
+    let cap;
+    if (options.pinnedCapability) {
+        cap = options.pinnedCapability;
+        state.pinned = true;
+    }
+    else {
+        cap = await createCapability({
+            singleRun: false,
+            ...(state.outputMode && { outputMode: state.outputMode }),
+        });
+    }
+    state.capabilities.set(cap.capId, cap);
+    await connectToServer(state, options.serverUrl);
+    setInterval(() => {
+        sendHeartbeat(state);
+    }, config.agentHeartbeatMs || 15000);
+    process.on('SIGINT', () => {
+        state.output.info('Shutting down');
+        state.ws?.close();
+        process.exit(0);
+    });
+}
+async function connectToServer(state, serverUrl) {
+    const wsUrl = serverUrl.replace(/^http/, 'ws') + '/agent/register';
+    state.output.info(`Connecting to server: ${wsUrl}`);
+    const ws = new WebSocket(wsUrl);
+    state.ws = ws;
+    ws.on('open', () => {
+        state.output.info('Connected to server');
+        const hello = {
+            type: 'CLIENT_HELLO',
+            machineId: getMachineId(),
+            // Shared secret gating agent registration (RELAY_AGENT_TOKEN). Undefined
+            // when the relay does not require one.
+            token: getConfig().agentToken,
+        };
+        ws.send(JSON.stringify(hello));
+    });
+    // Store active relay sessions
+    const relaySessions = new Map();
+    ws.on('message', async (data) => {
+        try {
+            const msg = JSON.parse(data.toString());
+            if (msg.type === 'ASSIGN') {
+                state.agentId = msg.agentId;
+                state.output.info(`Agent registered: ${msg.agentId}`);
+                // Display the single served capability (pinned or ephemeral).
+                displayCapability(state);
+                // Announce all capabilities
+                for (const capId of state.capabilities.keys()) {
+                    announceCapability(state, capId);
+                }
+            }
+            else if (msg.type === 'INVOKER_CONNECT') {
+                const { capId, socketId } = msg;
+                const cap = state.capabilities.get(capId);
+                if (!cap) {
+                    state.output.warn(`Unknown capability: ${capId}`);
+                    return;
+                }
+                state.output.info(`Invoker connected: socketId=${socketId}, capId=${capId}`);
+                // Register synchronously (no await) so the session exists before this
+                // invoker's AUTH1 arrives on the next relay message.
+                const session = handleInvokerConnection(state.ws, socketId, cap, state.passwordHash);
+                relaySessions.set(socketId, session);
+            }
+            else if (msg.type === 'RELAY_MSG') {
+                // Handle forwarded frame from invoker
+                const session = relaySessions.get(msg.socketId);
+                if (session && session.handleFrame) {
+                    const frameData = Buffer.from(msg.frame, 'base64');
+                    session.handleFrame(frameData);
+                }
+            }
+            else if (msg.type === 'INVOKER_DISCONNECT') {
+                // Clean up relay session
+                const session = relaySessions.get(msg.socketId);
+                if (session && session.cleanup) {
+                    session.cleanup();
+                }
+                relaySessions.delete(msg.socketId);
+            }
+        }
+        catch (error) {
+            // If it's not JSON, it might be a legacy binary frame - ignore it
+            if (data instanceof Buffer) {
+                return;
+            }
+            state.output.error('Failed to handle message', error instanceof Error ? error.message : String(error));
+        }
+    });
+    ws.on('error', (error) => {
+        state.output.error('WebSocket error', error instanceof Error ? error.message : String(error));
+    });
+    ws.on('close', () => {
+        state.output.info('Disconnected from server');
+        setTimeout(() => connectToServer(state, serverUrl), 5000);
+    });
+}
+function displayCapability(state) {
+    const config = getConfig();
+    const relayUrl = config.relayUrl || state.serverUrl || config.publicOrigin || 'https://suncoder.dev';
+    // There is exactly one capability. Print its full URL block including the
+    // secret S: this capability is ephemeral (or explicitly pinned by the
+    // operator) and the secret is intentionally shown here so it can be copied
+    // and handed to an invoker — without it the capability is unusable.
+    const cap = state.capabilities.values().next().value;
+    if (!cap)
+        return;
+    const link = `${relayUrl}/cap/${cap.capId}#S=${cap.S}`;
+    state.output.info('');
+    state.output.info('=====================================');
+    state.output.info(state.pinned ? 'Using pinned capability' : 'Ephemeral capability created (not stored)');
+    state.output.info(`capId: ${cap.capId}`);
+    state.output.info(`S: ${cap.S}`);
+    state.output.info('');
+    state.output.info(`Web URL: ${link}`);
+    state.output.info('=====================================');
+    state.output.info('');
+}
+function announceCapability(state, capId) {
+    if (!state.ws)
+        return;
+    const announce = {
+        type: 'ANNOUNCE_CAP',
+        capId,
+    };
+    state.ws.send(JSON.stringify(announce));
+    state.output.info(`Capability announced: ${capId}`);
+}
+function sendHeartbeat(state) {
+    if (!state.ws || state.ws.readyState !== WebSocket.OPEN)
+        return;
+    const heartbeat = {
+        type: 'HEARTBEAT',
+        timestamp: Date.now(),
+    };
+    state.ws.send(JSON.stringify(heartbeat));
+}
+function getMachineId() {
+    return randomBytes(16).toString('hex');
+}
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAuB,MAAM,iBAAiB,CAAC;AAqBxE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB;IACpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAe;QACxB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACxD,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE9B,2DAA2D;IAC3D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,GAAmB,CAAC;IACxB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAC/B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,MAAM,gBAAgB,CAAC;YAC3B,SAAS,EAAE,KAAK;YAChB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvC,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhD,WAAW,CAAC,GAAG,EAAE;QACf,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;IAErC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACnC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,iBAAiB,CAAC;IAEnE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAEd,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACjB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG;YACZ,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,YAAY,EAAE;YACzB,yEAAyE;YACzE,uCAAuC;YACvC,KAAK,EAAE,SAAS,EAAE,CAAC,UAAU;SAC9B,CAAC;QAEF,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAe,CAAC;IAE7C,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAExC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAEtD,8DAA8D;gBAC9D,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAEzB,4BAA4B;gBAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC9C,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;gBAChC,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAE1C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,WAAW,KAAK,EAAE,CAAC,CAAC;gBAE7E,sEAAsE;gBACtE,qDAAqD;gBACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;gBACtF,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACpC,sCAAsC;gBACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACnC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBACnD,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,yBAAyB;gBACzB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,CAAC;gBACD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACvB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC9C,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAErG,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAmC,CAAC;IACnF,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,MAAM,IAAI,GAAG,GAAG,QAAQ,QAAQ,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAEvD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;IAC1G,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACtC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,KAAa;IAC1D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO;IAEtB,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,cAAc;QACpB,KAAK;KACN,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;QAAE,OAAO;IAEhE,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/capability.d.ts

@@ -0,0 +1,21 @@
+import { type Policy } from '@thenewlabs/entangle-protocol';
+export interface CapabilityInfo {
+    capId: string;
+    S: string;
+    policy: Policy;
+}
+export declare function createCapability(options: {
+    singleRun?: boolean;
+    outputMode?: string;
+}): Promise<CapabilityInfo>;
+/**
+ * Parse a capability URL into a CapabilityInfo. Accepts either a full URL of
+ * the form `https://host[:port]/cap/<capId>#S=<secret>` or the compact form
+ * `<capId>#S=<secret>`. For a full URL, `relayOrigin` is set to the URL origin
+ * so the caller can point the agent at the same relay that minted the
+ * capability.
+ */
+export declare function parseCapabilityUrl(input: string): Promise<CapabilityInfo & {
+    relayOrigin?: string;
+}>;
+//# sourceMappingURL=capability.d.ts.map

package/dist/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgB1B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwDpD"}

package/dist/capability.js

@@ -0,0 +1,75 @@
+import { generateCapId, generateSecret, initCrypto, extractSaltFromCapId } from '@thenewlabs/entangle-crypto';
+export async function createCapability(options) {
+    await initCrypto();
+    const { capId } = generateCapId();
+    const S = generateSecret();
+    const policy = {
+        singleRun: options.singleRun ?? false,
+        maxStreams: 1, // Default to single stream for backward compatibility
+    };
+    return {
+        capId,
+        S,
+        policy,
+    };
+}
+/**
+ * Parse a capability URL into a CapabilityInfo. Accepts either a full URL of
+ * the form `https://host[:port]/cap/<capId>#S=<secret>` or the compact form
+ * `<capId>#S=<secret>`. For a full URL, `relayOrigin` is set to the URL origin
+ * so the caller can point the agent at the same relay that minted the
+ * capability.
+ */
+export async function parseCapabilityUrl(input) {
+    await initCrypto();
+    let capId;
+    let fragment;
+    let relayOrigin;
+    const hashIndex = input.indexOf('#');
+    const beforeHash = hashIndex >= 0 ? input.slice(0, hashIndex) : input;
+    fragment = hashIndex >= 0 ? input.slice(hashIndex + 1) : undefined;
+    if (/^https?:\/\//i.test(beforeHash)) {
+        // Full URL form.
+        try {
+            const url = new URL(input);
+            relayOrigin = url.origin;
+            const match = url.pathname.match(/\/cap\/([^/]+)$/);
+            if (match) {
+                capId = decodeURIComponent(match[1]);
+            }
+        }
+        catch {
+            // Fall through to the "expected ..." error below.
+        }
+    }
+    else {
+        // Compact form: everything before the '#' is the capId.
+        if (beforeHash) {
+            capId = beforeHash;
+        }
+    }
+    let secret;
+    if (fragment) {
+        const params = new URLSearchParams(fragment);
+        secret = params.get('S') ?? undefined;
+    }
+    if (!capId || !secret) {
+        throw new Error('Invalid capability URL: expected .../cap/<capId>#S=<secret>');
+    }
+    try {
+        extractSaltFromCapId(capId);
+    }
+    catch {
+        throw new Error('Invalid capability URL: malformed capId');
+    }
+    if (typeof secret !== 'string' || secret.length < 8) {
+        throw new Error('Invalid capability URL: missing or malformed secret');
+    }
+    return {
+        capId,
+        S: secret,
+        policy: { singleRun: false, maxStreams: 1 },
+        ...(relayOrigin !== undefined && { relayOrigin }),
+    };
+}
+//# sourceMappingURL=capability.js.map

package/dist/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAS9G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAGtC;IACC,MAAM,UAAU,EAAE,CAAC;IAEnB,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,CAAC;IAClC,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAW;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;QACrC,UAAU,EAAE,CAAC,EAAE,sDAAsD;KACtE,CAAC;IAEF,OAAO;QACL,KAAK;QACL,CAAC;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa;IAEb,MAAM,UAAU,EAAE,CAAC;IAEnB,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAA4B,CAAC;IACjC,IAAI,WAA+B,CAAC;IAEpC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,QAAQ,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,iBAAiB;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC;YACzB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,wDAAwD;QACxD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,GAAG,UAAU,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC;QACH,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK;QACL,CAAC,EAAE,MAAM;QACT,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;QAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { getConfig, getVersionInfo, OutputHandler, parseOutputMode } from '@thenewlabs/entangle-utils';
+import { startAgent } from './agent.js';
+import { createCapability, parseCapabilityUrl } from './capability.js';
+const program = new Command();
+program
+    .name('entangle-serve')
+    .description('Entangle secure agent for exposing CLI tools')
+    .version(getVersionInfo())
+    .option('--output-mode <mode>', 'Output mode: text or stream-json', 'text');
+program
+    .command('start')
+    .description('Start the agent and register with server')
+    .option('--server <url>', 'Server URL')
+    .option('--password <password>', 'Optional password for agent authentication')
+    .option('--capability <url>', 'Serve a specific capability URL (https://relay/cap/<capId>#S=<secret>) instead of minting a fresh ephemeral one; its host is also used as the relay server')
+    .action(async (options) => {
+    try {
+        // Propagate output mode to all loggers in this process
+        process.env.OUTPUT_MODE = program.opts().outputMode;
+        const outputMode = parseOutputMode(program.opts().outputMode);
+        const output = new OutputHandler({ mode: outputMode });
+        output.version('Entangle Agent', getVersionInfo());
+        const config = getConfig();
+        const capUrl = options.capability || process.env.ENTANGLE_CAPABILITY;
+        const pinned = capUrl ? await parseCapabilityUrl(capUrl) : undefined;
+        // Explicit --server wins, else the capability URL's origin, else config/default.
+        const serverUrl = options.server || (pinned && pinned.relayOrigin) || config.relayUrl || 'http://localhost:8080';
+        await startAgent({
+            serverUrl,
+            outputMode: program.opts().outputMode,
+            password: options.password || process.env.AGENT_PASSWORD,
+            ...(pinned && { pinnedCapability: pinned }),
+        });
+    }
+    catch (error) {
+        const outputMode = parseOutputMode(program.opts().outputMode);
+        const output = new OutputHandler({ mode: outputMode });
+        output.error('Failed to start agent', error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+program
+    .command('create-cap')
+    .description('Create a new capability')
+    .option('--single-run', 'Allow only one run per session (default: multiple runs allowed)')
+    .action(async (options) => {
+    try {
+        process.env.OUTPUT_MODE = program.opts().outputMode;
+        const outputMode = parseOutputMode(program.opts().outputMode);
+        const output = new OutputHandler({ mode: outputMode });
+        const cap = await createCapability({
+            singleRun: options.singleRun,
+            outputMode: program.opts().outputMode,
+        });
+        output.info('\nCapability created:');
+        output.info(`capId: ${cap.capId}`);
+        output.info(`S: ${cap.S}`);
+        const config = getConfig();
+        const relayUrl = config.relayUrl || config.publicOrigin || 'https://suncoder.dev';
+        const link = `${relayUrl}/cap/${cap.capId}#S=${cap.S}`;
+        output.info(`\nWeb URL: ${link}`);
+    }
+    catch (error) {
+        const outputMode = parseOutputMode(program.opts().outputMode);
+        const output = new OutputHandler({ mode: outputMode });
+        output.error('Failed to create capability', error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,gBAAgB,CAAC;KACtB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,OAAO,CAAC,cAAc,EAAE,CAAC;KACzB,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC;KACtC,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;KAC7E,MAAM,CAAC,oBAAoB,EAAE,4JAA4J,CAAC;KAC1L,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,uDAAuD;QACvD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC;QACpD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,iFAAiF;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,uBAAuB,CAAC;QAEjH,MAAM,UAAU,CAAC;YACf,SAAS;YACT,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YACxD,GAAG,CAAC,MAAM,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,cAAc,EAAE,iEAAiE,CAAC;KACzF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC;QACpD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;QAClF,MAAM,IAAI,GAAG,GAAG,QAAQ,QAAQ,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/multi-session.d.ts

@@ -0,0 +1,27 @@
+import WebSocket from 'ws';
+import { FrameType } from '@thenewlabs/entangle-protocol';
+import { deriveKeys } from '@thenewlabs/entangle-crypto';
+import { BidirectionalCounters, StreamCounters } from '@thenewlabs/entangle-utils';
+import { StreamManager } from './stream-manager.js';
+import type { CapabilityInfo } from './capability.js';
+export interface MultiSession {
+    socketId: string;
+    ws: WebSocket;
+    cap: CapabilityInfo;
+    keys?: Awaited<ReturnType<typeof deriveKeys>>;
+    counters: BidirectionalCounters;
+    streamCounters: StreamCounters;
+    authenticated: boolean;
+    requiresPassword?: boolean;
+    passwordVerified?: boolean;
+    nonceB?: string;
+    nonceC?: string;
+    streamManager?: StreamManager;
+    terminated?: boolean;
+}
+export declare function handleMultiStreamFrame(session: MultiSession, frame: {
+    type: FrameType;
+    payload: Uint8Array;
+}): Promise<void>;
+export declare function cleanupMultiSession(session: MultiSession): void;
+//# sourceMappingURL=multi-session.d.ts.map

package/dist/multi-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-session.d.ts","sourceRoot":"","sources":["../src/multi-session.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EACL,SAAS,EAWV,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,UAAU,EAKX,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,qBAAqB,EACrB,cAAc,EACf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,SAAS,CAAC;IACd,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IAC9C,QAAQ,EAAE,qBAAqB,CAAC;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IAEvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA+QD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GAC9C,OAAO,CAAC,IAAI,CAAC,CAsIf;AAGD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAI/D"}