agent-tempo 1.0.1

package/dist/client/with-spawn.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTempoClientWithSpawn = createTempoClientWithSpawn;
+const core_1 = require("./core");
+/**
+ * Invoke the `agent-tempo` CLI as a child process. The lazy
+ * `child_process` import keeps the dependency out of `core.ts` so
+ * `TempoClientCore` consumers never pay for it. Shared by the two spawn
+ * methods so they have identical process semantics (cwd default,
+ * timeout, shell-quoted args).
+ */
+async function runTempoCli(args, workDir) {
+    const { execFile } = await Promise.resolve().then(() => __importStar(require('child_process')));
+    await new Promise((resolve, reject) => {
+        execFile('agent-tempo', args, {
+            cwd: workDir ?? process.cwd(),
+            timeout: 60_000,
+            shell: true,
+        }, (err, _stdout, stderr) => {
+            if (err)
+                reject(new Error(stderr?.toString().trim() || err.message || `agent-tempo ${args[0]} failed`));
+            else
+                resolve();
+        });
+    });
+}
+/**
+ * Build a `TempoClientWithSpawn` over a configured Temporal `Client`.
+ * Composes {@link createTempoClientCore} and adds the two TTY-bound
+ * spawn methods. Use this for TUI-side consumers; headless callers
+ * should use {@link createTempoClientCore} directly.
+ *
+ * `opts` (e.g. `subscribeDeps`) is forwarded to the Core factory.
+ */
+function createTempoClientWithSpawn(client, opts = {}) {
+    const core = (0, core_1.createTempoClientCore)(client, opts);
+    return {
+        ...core,
+        async createEnsemble(opts) {
+            const args = opts.lineup
+                ? ['up', opts.ensemble, '--lineup', opts.lineup]
+                : ['up', opts.ensemble];
+            await runTempoCli(args, opts.workDir);
+        },
+        async spawnConductor(opts) {
+            // `agent-tempo up <ensemble>` is idempotent at the workflow layer —
+            // re-invoking it on a live ensemble reuses the existing conductor
+            // workflow (deterministic workflow ID). Distinct from
+            // `createEnsemble` so call sites read as "make sure the conductor
+            // terminal is running", not "create a new ensemble".
+            await runTempoCli(['up', opts.ensemble], opts.workDir);
+        },
+    };
+}

package/dist/config.d.ts

@@ -0,0 +1,323 @@
+import { z } from 'zod';
+import { AgentType } from './types';
+/** Environment variable name constants — use these instead of string literals. */
+export declare const ENV: {
+    readonly ENSEMBLE: "AGENT_TEMPO_ENSEMBLE";
+    readonly CONDUCTOR: "AGENT_TEMPO_CONDUCTOR";
+    readonly PLAYER_NAME: "AGENT_TEMPO_PLAYER_NAME";
+    readonly TASK_QUEUE: "AGENT_TEMPO_TASK_QUEUE";
+    readonly BRIDGE_NAME: "COPILOT_BRIDGE_NAME";
+    readonly BRIDGE_MODE: "AGENT_TEMPO_BRIDGE_MODE";
+    readonly BRIDGE_MODEL: "COPILOT_BRIDGE_MODEL";
+    readonly BRIDGE_SESSION_ID: "COPILOT_BRIDGE_SESSION_ID";
+    readonly TEMPORAL_ADDRESS: "TEMPORAL_ADDRESS";
+    readonly TEMPORAL_NAMESPACE: "TEMPORAL_NAMESPACE";
+    readonly TEMPORAL_API_KEY: "TEMPORAL_API_KEY";
+    readonly TEMPORAL_TLS_CERT_PATH: "TEMPORAL_TLS_CERT_PATH";
+    readonly TEMPORAL_TLS_KEY_PATH: "TEMPORAL_TLS_KEY_PATH";
+    readonly DEFAULT_AGENT: "AGENT_TEMPO_DEFAULT_AGENT";
+    readonly PLAYER_TYPE: "AGENT_TEMPO_PLAYER_TYPE";
+    readonly CLAUDE_BIN: "AGENT_TEMPO_CLAUDE_BIN";
+    /**
+     * #131 Phase C — claude-api adapter model override. Recruit-arg takes
+     * precedence; this env var is the next fallback before the constants-pinned
+     * default (`claude-opus-4-7`). Ignored by other adapters.
+     */
+    readonly API_MODEL: "AGENT_TEMPO_API_MODEL";
+    /**
+     * #449 Phase C — opencode adapter model override. Distinct from
+     * `API_MODEL` to keep namespaces clean: claude-api is Anthropic-only
+     * with bare model ids (`claude-opus-4-7`); opencode takes combined
+     * `provider/model` strings (`anthropic/claude-opus-4-7`,
+     * `openai/gpt-4o`, `ollama/llama3`, …). Recruit-arg precedence:
+     * recruit `model` arg → this env var → `DEFAULT_MODEL` constant.
+     */
+    readonly OPENCODE_MODEL: "AGENT_TEMPO_OPENCODE_MODEL";
+    /**
+     * #520 — claude-code-headless permission mode. Forwarded to `claude -p
+     * --permission-mode <mode>`. Recruit-arg `permissionMode` takes precedence;
+     * this env var is the fallback before the constants-pinned default
+     * (`'acceptEdits'`). Mutually exclusive with
+     * {@link DANGEROUSLY_SKIP_PERMISSIONS}.
+     */
+    readonly PERMISSION_MODE: "AGENT_TEMPO_PERMISSION_MODE";
+    /**
+     * #520 — claude-code-headless dangerous-skip-permissions opt-in. When set
+     * to `'1'`, the adapter passes `--dangerously-skip-permissions` to
+     * `claude -p` instead of `--permission-mode`. Use only in trusted /
+     * sandboxed contexts. Mutually exclusive with {@link PERMISSION_MODE}.
+     */
+    readonly DANGEROUSLY_SKIP_PERMISSIONS: "AGENT_TEMPO_DANGEROUSLY_SKIP_PERMISSIONS";
+    /**
+     * v0.25 PR-D attachment resume plumbing. When `restart` / `migrate`
+     * enqueues a spawn outbox entry, the workflow passes the pre-claimed
+     * `attachmentId` + pinned `runId` + resolved `adapterId` through the spawn
+     * activity into the child process env. The child's adapter reads these in
+     * `startV2Lifecycle` to renew (rather than freshly claim) the existing lease,
+     * so there is no race window between the workflow's claim and the adapter
+     * boot. Absent on first-recruit spawn (fresh claim path).
+     */
+    readonly ATTACHMENT_ID: "AGENT_TEMPO_ATTACHMENT_ID";
+    readonly ATTACHMENT_RUN_ID: "AGENT_TEMPO_ATTACHMENT_RUN_ID";
+    readonly ADAPTER_ID: "AGENT_TEMPO_ADAPTER_ID";
+    /**
+     * Daemon HTTP/SSE event source (#94, #95). See SSE-PROTOCOL.md §1, §3.
+     * `HTTP_BIND` defaults to `127.0.0.1`. Setting to `0.0.0.0` forces
+     * bearer mode. `DAEMON_PORT` defaults to `8473` (the `t-e-m-p-o`
+     * mnemonic; not IANA-registered). `CORS_ORIGINS` is a comma-separated
+     * explicit allowlist (no wildcards) — only consulted in bearer mode.
+     * `SSE_MAX_CONNECTIONS` caps live SSE subscribers (PR-2; defaults 100).
+     */
+    readonly HTTP_BIND: "AGENT_TEMPO_HTTP_BIND";
+    readonly DAEMON_PORT: "AGENT_TEMPO_DAEMON_PORT";
+    readonly CORS_ORIGINS: "AGENT_TEMPO_CORS_ORIGINS";
+    readonly SSE_MAX_CONNECTIONS: "AGENT_TEMPO_SSE_MAX_CONNECTIONS";
+    /**
+     * Dev profile gate (ADR 0014 §5.2). One source of truth — every layer
+     * (paths, namespace, port, task queue, banner, registry gating) consults
+     * `isDevMode()` rather than reading the env var directly. The `--dev`
+     * top-level CLI flag in `src/cli.ts` sets this to `'1'` before any other
+     * module loads (see `src/cli/dev-mode-bootstrap.ts`).
+     */
+    readonly DEV_MODE: "AGENT_TEMPO_DEV_MODE";
+    /**
+     * Escape hatch for triple-isolated environments (ADR 0014 §5.3). When
+     * set, `resolveTempoHome()` returns this path verbatim — bypassing both
+     * the production default and the dev-mode default. Lets a power user
+     * coordinate three or more parallel agent-tempo profiles on one box.
+     */
+    readonly DEV_HOME_OVERRIDE: "AGENT_TEMPO_HOME_OVERRIDE";
+};
+export interface Config {
+    temporalAddress: string;
+    temporalNamespace: string;
+    temporalApiKey?: string;
+    temporalTlsCertPath?: string;
+    temporalTlsKeyPath?: string;
+    defaultAgent: AgentType;
+    claudeBin?: string;
+    taskQueue: string;
+    ensemble: string;
+}
+/** Persisted config file fields (stored in ~/.agent-tempo/config.json). */
+export interface PersistedConfig {
+    temporalAddress?: string;
+    temporalNamespace?: string;
+    temporalApiKey?: string;
+    temporalTlsCertPath?: string;
+    temporalTlsKeyPath?: string;
+    defaultAgent?: AgentType;
+    claudeBin?: string;
+    /**
+     * Bearer token for the daemon's HTTP/SSE event source (#94, #95,
+     * SSE-PROTOCOL.md §3.1). Auto-generated on first daemon boot when
+     * bearer mode is required (`AGENT_TEMPO_HTTP_BIND` non-loopback OR
+     * a request with a non-loopback `Origin`) and no token is set:
+     * `crypto.randomBytes(32).toString('base64url')`, 0600 on POSIX.
+     * Rotation = delete this field; next daemon boot regenerates.
+     */
+    httpToken?: string;
+}
+/**
+ * Dev profile defaults — one switch (`--dev` top-level flag, or
+ * `AGENT_TEMPO_DEV_MODE=1` env var) flips four isolation axes at once
+ * (ADR 0014 §5.1). Production stays on the existing defaults.
+ */
+export declare const DEV_HOME_DIR_NAME = ".agent-tempo-dev";
+export declare const PROD_HOME_DIR_NAME = ".agent-tempo";
+export declare const DEV_TEMPORAL_NAMESPACE = "agent-tempo-dev";
+export declare const PROD_TEMPORAL_NAMESPACE = "default";
+export declare const DEV_TASK_QUEUE = "agent-tempo-dev";
+export declare const PROD_TASK_QUEUE = "agent-tempo";
+export declare const DEV_DAEMON_PORT = 8474;
+export declare const PROD_DAEMON_PORT = 8473;
+/**
+ * Single source of truth for the dev profile gate (ADR 0014 §5.2).
+ * Every layer that needs to switch behaviour consults this helper; future
+ * staging/ci/demo profiles would follow the same `isStagingMode()` pattern.
+ *
+ * Recognises `'1'` and `'true'` (case-insensitive) so users can write
+ * either `AGENT_TEMPO_DEV_MODE=1` or `AGENT_TEMPO_DEV_MODE=true`. Any
+ * other value (including the empty string) is treated as production.
+ *
+ * **Important**: when the `--dev` CLI flag is used, the env var must be
+ * set BEFORE `src/config.ts` is first imported (see
+ * `src/cli/dev-mode-bootstrap.ts`) so the module-load-time `AGENT_TEMPO_HOME`
+ * constant resolves to the dev profile.
+ */
+export declare function isDevMode(): boolean;
+/**
+ * Resolve the agent-tempo home directory. Three-tier precedence:
+ *   1. `AGENT_TEMPO_HOME_OVERRIDE` env — explicit override (multi-isolation
+ *      escape hatch; ADR 0014 §5.3).
+ *   2. Dev mode (`AGENT_TEMPO_DEV_MODE=1`): `~/.agent-tempo-dev/`.
+ *   3. Production default: `~/.agent-tempo/`.
+ *
+ * Evaluated once at module load time; downstream callers consume the
+ * exported `AGENT_TEMPO_HOME` constant. The bootstrap module guarantees
+ * the env var is set before this function first runs.
+ *
+ * Exported (rather than file-private) so unit tests can exercise the
+ * three-tier precedence directly without resorting to `vi.resetModules()`
+ * gymnastics. Production code should consume {@link AGENT_TEMPO_HOME}
+ * — calling this helper per-request would re-read env on every call.
+ */
+export declare function resolveTempoHome(): string;
+export declare const AGENT_TEMPO_HOME: string;
+export declare const CONFIG_FILE_PATH: string;
+/**
+ * Daemon-level configuration persisted in `~/.agent-tempo/config.json`
+ * alongside the existing `PersistedConfig` fields.
+ *
+ * `restorePolicy` is the effective off-switch for daemon reconcile-on-boot
+ * auto-restore — there is no feature flag. `"never"` disables all automatic
+ * restoration and leaves the CLI `restore` command as the sole revive path.
+ */
+export declare const CleanupPolicySchema: z.ZodDefault<z.ZodObject<{
+    detachedMaxAgeDays: z.ZodDefault<z.ZodNumber>;
+    destroyedMaxAgeDays: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    detachedMaxAgeDays: number;
+    destroyedMaxAgeDays: number;
+}, {
+    detachedMaxAgeDays?: number | undefined;
+    destroyedMaxAgeDays?: number | undefined;
+}>>;
+export declare const DaemonConfigSchema: z.ZodDefault<z.ZodObject<{
+    restorePolicy: z.ZodDefault<z.ZodEnum<["auto", "prompt", "never"]>>;
+    autoRestoreMaxAgeHours: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Ensemble allowlist for `auto` restore. Empty array means "all ensembles
+     * allowed". Each entry is a simple prefix match: trailing `*` is stripped
+     * and the remaining string is compared with `String.startsWith()`. Entries
+     * without trailing `*` are exact matches. See {@link matchEnsembleGlob}.
+     */
+    autoRestoreEnsembles: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    cleanupPolicy: z.ZodDefault<z.ZodObject<{
+        detachedMaxAgeDays: z.ZodDefault<z.ZodNumber>;
+        destroyedMaxAgeDays: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        detachedMaxAgeDays: number;
+        destroyedMaxAgeDays: number;
+    }, {
+        detachedMaxAgeDays?: number | undefined;
+        destroyedMaxAgeDays?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    restorePolicy: "auto" | "prompt" | "never";
+    autoRestoreMaxAgeHours: number;
+    autoRestoreEnsembles: string[];
+    cleanupPolicy: {
+        detachedMaxAgeDays: number;
+        destroyedMaxAgeDays: number;
+    };
+}, {
+    restorePolicy?: "auto" | "prompt" | "never" | undefined;
+    autoRestoreMaxAgeHours?: number | undefined;
+    autoRestoreEnsembles?: string[] | undefined;
+    cleanupPolicy?: {
+        detachedMaxAgeDays?: number | undefined;
+        destroyedMaxAgeDays?: number | undefined;
+    } | undefined;
+}>>;
+/** Inferred config type matching {@link DaemonConfigSchema}. */
+export type DaemonConfig = z.infer<typeof DaemonConfigSchema>;
+/**
+ * Load `~/.agent-tempo/config.json` and extract the daemon-level fields.
+ * Returns fully-defaulted `DaemonConfig` if the file is missing, unreadable,
+ * or contains no daemon fields. Partial configs (user sets one field only)
+ * merge with defaults via Zod's `.default()` per-field behaviour.
+ *
+ * Invalid JSON logs a warning and falls back to defaults rather than
+ * crashing — the daemon must boot even if the user has a mangled config.
+ */
+export declare function loadDaemonConfig(): DaemonConfig;
+/**
+ * Simple-prefix ensemble match — PR-E §8 answer 5. No glob library dep.
+ *
+ *  - Pattern ends with `*` → strip the `*`, match by `ensemble.startsWith(prefix)`.
+ *  - Pattern without trailing `*` → exact equality.
+ *  - Empty pattern list → allow all (caller decides; this helper returns `false`).
+ */
+export declare function matchEnsembleGlob(ensemble: string, pattern: string): boolean;
+/**
+ * Check an ensemble name against a list of patterns.
+ * Empty list → allow all (returns `true`).
+ * Any matching pattern → allow (returns `true`).
+ * No matches → deny (returns `false`).
+ */
+export declare function isEnsembleAllowed(ensemble: string, allowlist: string[]): boolean;
+/** Load ~/.agent-tempo/config.json if it exists. */
+export declare function loadConfigFile(): PersistedConfig;
+/** Save config to ~/.agent-tempo/config.json with restrictive permissions. */
+export declare function saveConfigFile(config: PersistedConfig): void;
+/**
+ * Load Temporal CLI config from ~/.config/temporalio/temporal.yaml as a fallback.
+ * The Temporal CLI stores named environments there. We read the active environment
+ * or the first one we find.
+ *
+ * Format is simple YAML — we parse it with basic string operations.
+ */
+export declare function loadTemporalCliConfig(): PersistedConfig;
+/**
+ * Minimal YAML parser for Temporal CLI config files.
+ * Handles the subset of YAML used by the Temporal CLI:
+ *   active-env: local
+ *   env:
+ *     local:
+ *       address: localhost:7233
+ *       namespace: default
+ *       api-key: ...
+ *       tls-cert-path: ...
+ *       tls-key-path: ...
+ */
+export declare function parseTemporalYaml(content: string): PersistedConfig;
+/**
+ * Parse an agent value against the {@link AgentType} union.
+ * Throws when `value` is present but not a valid agent; returns `'claude'`
+ * for empty/unset values so callers can use it as a source-aware default.
+ */
+export declare function parseAgent(value: string | undefined, source: ConfigSource): AgentType;
+/** CLI flag overrides — passed down from the arg parser. */
+export interface CliOverrides {
+    temporalAddress?: string;
+    temporalNamespace?: string;
+    temporalApiKey?: string;
+    temporalTlsCertPath?: string;
+    temporalTlsKeyPath?: string;
+    defaultAgent?: AgentType;
+}
+/**
+ * Build a resolved Config using the priority chain:
+ *   CLI flag > env var > agent-tempo config file > temporal CLI config > defaults
+ *
+ * In dev mode, `TEMPORAL_NAMESPACE` and `TEMPORAL_ADDRESS` env vars are
+ * dropped from the chain — see {@link DEV_ENV_CARVE_OUT}.
+ */
+export declare function getConfig(overrides?: CliOverrides): Config;
+export type ConfigSource = 'flag' | 'env' | 'config' | 'temporal-cli' | 'default' | 'none';
+export interface ConfigWithSources {
+    config: Config;
+    sources: Record<string, ConfigSource>;
+}
+/**
+ * Like getConfig(), but also returns which source each value came from.
+ * Used by `agent-tempo config show` to help users debug.
+ *
+ * Mirrors {@link getConfig}'s dev-mode env-var carve-out — without this
+ * parity the user would see `env: TEMPORAL_NAMESPACE=default` in
+ * `config show` while the daemon happily ignores it.
+ */
+export declare function getConfigWithSources(overrides?: CliOverrides): ConfigWithSources;
+/** Build a per-host task queue name for cross-machine activities: {taskQueue}-{hostname} */
+export declare function hostTaskQueue(taskQueue: string, hostname: string): string;
+/** Build a workflow ID for a player session: agent-session-{ensemble}-{playerId} */
+export declare function sessionWorkflowId(ensemble: string, playerId: string): string;
+/** Build a workflow ID for a conductor: agent-session-{ensemble}-conductor */
+export declare function conductorWorkflowId(ensemble: string): string;
+/** Build a workflow ID for the scheduler: agent-scheduler-{ensemble} */
+export declare function schedulerWorkflowId(ensemble: string): string;
+/** Build a workflow ID for the Maestro: agent-maestro-{ensemble} */
+export declare function maestroWorkflowId(ensemble: string): string;
+/** Workflow ID for the single global Maestro instance. */
+export declare const GLOBAL_MAESTRO_WORKFLOW_ID = "agent-maestro-global";