@yeaft/webchat-agent 1.0.435 → 1.0.437

package/container-cli.js

@@ -5,7 +5,6 @@ import {
   createContainerAgent,
   inspectContainerAgent,
   logsContainerAgent,
-  readSecretInput,
   removeContainerAgent,
   startContainerAgent,
   stopContainerAgent,
@@ -15,10 +14,12 @@ import {
 function help() {
   console.log(`
 Usage:
-  yeaft-agent container create --server <ws-url> --name <name> (--secret <value> | --secret-file <path>) [--image <image>]
+  yeaft-agent container install --server <ws-url> --name <name> --secret <secret> [--image <image>]
   yeaft-agent container start|stop|status|remove|logs --name <name>
 
 The container is an ordinary yeaft-agent. This command only manages its Docker lifecycle.
+The secret is passed as an argument, like 'yeaft-agent install', and persisted by this
+command to a private 0600 file before the container is created.
 Use --keep-volumes with remove to preserve its Yeaft data and workspace volumes.
 `);
 }
@@ -48,11 +49,13 @@ export async function runContainerCli(args) {
   const { action, options } = parseContainerArgs(args);
   const name = options.name;
   let result;
-  if (action === 'create') {
-    const secret = await readSecretInput(options);
-    const secretFile = options.secretFile
-      ? resolve(options.secretFile)
-      : join(homedir(), '.yeaft', 'container-agents', name, 'agent-secret');
+  if (action === 'install' || action === 'create') {
+    if (options.secretFile) {
+      throw new Error('--secret-file is no longer supported; pass the secret directly with --secret');
+    }
+    const secret = String(options.secret || '').trim();
+    if (!secret) throw new Error('--secret <secret> is required');
+    const secretFile = join(homedir(), '.yeaft', 'container-agents', name, 'agent-secret');
     await writeAgentSecretFile(secretFile, secret);
     result = await createContainerAgent({
       name,

package/container-manager.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 
 export const DEFAULT_AGENT_IMAGE = 'ghcr.io/yeaft/yeaft-web-code-agent-agent:dev';
@@ -182,8 +182,3 @@ export async function logsContainerAgent(name, { follow = false, ...runtime } =
   args.push(containerNameForAgent(name));
   return runDocker(args, { ...runtime, stdout: follow ? 'inherit' : 'pipe' });
 }
-
-export async function readSecretInput({ secret, secretFile }) {
-  if (secretFile) return (await readFile(resolve(secretFile), 'utf8')).trim();
-  return String(secret || '').trim();
-}

package/local-runtime/agent/container-manager.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 
 export const DEFAULT_AGENT_IMAGE = 'ghcr.io/yeaft/yeaft-web-code-agent-agent:dev';
@@ -182,8 +182,3 @@ export async function logsContainerAgent(name, { follow = false, ...runtime } =
   args.push(containerNameForAgent(name));
   return runDocker(args, { ...runtime, stdout: follow ? 'inherit' : 'pipe' });
 }
-
-export async function readSecretInput({ secret, secretFile }) {
-  if (secretFile) return (await readFile(resolve(secretFile), 'utf8')).trim();
-  return String(secret || '').trim();
-}

package/local-runtime/server/handlers/client-browser.js

@@ -234,6 +234,12 @@ export async function handleClientBrowser(client, msg, checkAgentAccess) {
       connectionGeneration: peer.connectionGeneration,
     };
     try {
+      // Commit the Web endpoint's scoped ICE credentials before the Agent can
+      // synchronously answer `browser_peer_prepare`. Otherwise a fast Agent
+      // may produce `browser_peer_prepared` while this field is still unset,
+      // causing the Web RTCPeerConnection to be created with no ICE servers.
+      peer.webIceServers = mintBrowserIceServers({ ...commonScope, endpointRole: 'web' });
+      peer.state = 'preparing';
       await sendToAgent(agent, {
         type: 'browser_peer_prepare',
         agentId,
@@ -247,8 +253,6 @@ export async function handleClientBrowser(client, msg, checkAgentAccess) {
         iceTransportPolicy: CONFIG.browserRuntime.iceTransportPolicy,
         agentIceServers: mintBrowserIceServers({ ...commonScope, endpointRole: 'agent' }),
       });
-      peer.webIceServers = mintBrowserIceServers({ ...commonScope, endpointRole: 'web' });
-      peer.state = 'preparing';
     } catch (error) {
       deleteBrowserPeer(peer.peerId);
       return fail(client, msg, 'browser_peer_prepare_failed', String(error?.message || error).slice(0, 500));

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.435"}
+{"version":"1.0.437"}