agent-tempo 1.0.1

package/dist/daemon-adapter-versions.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probeAdapterVersions = probeAdapterVersions;
+exports.resolveCopilotSdkVersionSync = resolveCopilotSdkVersionSync;
+/**
+ * Probe upstream tool versions for the adapters this daemon ships.
+ * Issue #399 Q5.4 — `HostProfile.adapterVersions`.
+ *
+ * Runs once at daemon boot, in parallel with `ensureGlobalMaestro`, so
+ * the host-profile signal can advertise something like:
+ *
+ *   { "claude-code": "1.2.4", "copilot": "0.5.2" }
+ *
+ * Adapter probes:
+ *   - **claude-code** — shells out to `claude --version` and pulls the
+ *     first `MAJOR.MINOR.PATCH` triple via a defensive regex. Claude
+ *     Code's `--version` output isn't part of its public API contract
+ *     (the format may change between releases); on parse failure or
+ *     spawn failure we omit the entry, and the dashboard renders `—`.
+ *   - **copilot** — reads `@github/copilot-sdk/package.json#version` via
+ *     dynamic import. The SDK is an optional npm dep; when absent
+ *     (no copilot bridge available) we omit the entry.
+ *   - **mock** — never probed in production. The mock adapter is
+ *     dev-mode-only (`isDevMode()` gate in `src/adapters/index.ts`)
+ *     and its npm tarball is stripped at prepack; including it here
+ *     would just produce a literal `"dev"` that nobody wants in their
+ *     Hosts table. Skipped.
+ *
+ * Latency budget: ~50–100ms total. Each probe runs in parallel; the
+ * outer `Promise.all` resolves when the slowest finishes. Each
+ * individual probe has its own timeout so a hung `claude --version`
+ * (rare but possible — claude CLI sometimes pauses on first launch
+ * to register) doesn't keep the daemon's first signal pending.
+ *
+ * **Failure semantics: never throw.** A probe failure → that key is
+ * omitted from the result map. The caller treats the map as a
+ * best-effort snapshot; consumers (Hosts table) gracefully degrade.
+ */
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** Per-probe timeout. Generous enough to cover a cold launch but short
+ * enough that the daemon-boot pipeline isn't held up. */
+const PROBE_TIMEOUT_MS = 5000;
+/** Defensive semver-ish capture. Tolerates leading `v`, optional
+ * pre-release suffix. Anchored to the FIRST `MAJOR.MINOR.PATCH` triple
+ * in the output so headers / banners / multi-line greetings don't break
+ * the parse. */
+const VERSION_REGEX = /v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+/**
+ * Probe the upstream tool versions for every adapter this daemon ships.
+ *
+ * @returns A map keyed by adapter name. Adapters whose probe failed or
+ * whose output couldn't be parsed are omitted entirely. The map may be
+ * empty in environments without any of the supported adapters available.
+ */
+async function probeAdapterVersions(deps = {}) {
+    const runCommand = deps.runCommand ?? defaultRunCommand;
+    const resolveCopilotSdkVersion = deps.resolveCopilotSdkVersion ?? defaultResolveCopilotSdkVersion;
+    const log = deps.log ?? defaultLog;
+    // Each probe is `Promise<[name, version] | null>`. Resolved-null →
+    // omit from the result map. Promise.all won't reject because each
+    // catches its own errors.
+    const probes = [
+        probeClaudeCode({ runCommand, log }),
+        probeCopilot({ resolveCopilotSdkVersion, log }),
+    ];
+    const results = await Promise.all(probes);
+    const out = {};
+    for (const r of results) {
+        if (r)
+            out[r[0]] = r[1];
+    }
+    return out;
+}
+async function probeClaudeCode(deps) {
+    try {
+        const stdout = await deps.runCommand('claude', ['--version']);
+        const match = VERSION_REGEX.exec(stdout);
+        if (!match) {
+            deps.log('probeAdapterVersions: claude --version produced no MAJOR.MINOR.PATCH match; omitting');
+            return null;
+        }
+        return ['claude-code', match[1]];
+    }
+    catch (err) {
+        deps.log('probeAdapterVersions: claude --version failed:', err instanceof Error ? err.message : err);
+        return null;
+    }
+}
+async function probeCopilot(deps) {
+    try {
+        const version = await deps.resolveCopilotSdkVersion();
+        if (!version)
+            return null;
+        // Reuse the same defensive regex so a malformed package.json
+        // version field doesn't poison the result map.
+        const match = VERSION_REGEX.exec(version);
+        if (!match) {
+            deps.log('probeAdapterVersions: copilot SDK package.json version unparseable; omitting');
+            return null;
+        }
+        return ['copilot', match[1]];
+    }
+    catch (err) {
+        deps.log('probeAdapterVersions: copilot SDK probe failed:', err instanceof Error ? err.message : err);
+        return null;
+    }
+}
+/** Real `execFile` with a timeout + stderr-friendly options. Used in
+ * production; tests stub `runCommand`. */
+async function defaultRunCommand(cmd, args) {
+    const { stdout } = await execFileAsync(cmd, args, {
+        timeout: PROBE_TIMEOUT_MS,
+        encoding: 'utf8',
+        // Don't fail on non-zero stderr; we only care about stdout.
+        windowsHide: true,
+    });
+    return stdout;
+}
+/**
+ * Synchronous companion to {@link defaultResolveCopilotSdkVersion}.
+ * Returns the Copilot SDK's `package.json#version` if the optional
+ * dependency is installed, or `undefined` when the require fails.
+ *
+ * Exported for #532 PR-2 — `src/daemon.ts` `computeHostProfile()` is
+ * synchronous (matches the existing `claude-code-headless` block at
+ * `daemon.ts:278-288`, which uses synchronous probes from
+ * `src/adapters/claude-code-headless/pre-flight.ts`). Awaiting an
+ * async helper from a sync function isn't possible without cascading
+ * the change to all `computeHostProfile` call sites; instead, this
+ * sync helper is the single require-source-of-truth, and the async
+ * `defaultResolveCopilotSdkVersion` (kept for the
+ * `ProbeAdapterVersionsDeps['resolveCopilotSdkVersion']` contract)
+ * delegates to it.
+ *
+ * Tests stub this directly via the `resolveCopilotSdkVersionSync` dep
+ * on `computeHostProfile` (see `test/daemon-boot.test.ts`).
+ *
+ * Never throws — a `try/catch` swallows MODULE_NOT_FOUND and any
+ * other failure mode to `undefined`. A throw here would crash the
+ * daemon-boot critical path.
+ */
+function resolveCopilotSdkVersionSync() {
+    try {
+        // `require` rather than ESM `import` so we read the package.json
+        // synchronously without the await + dynamic-import-of-JSON dance.
+        // The wrapper try/catch keeps the require inside a guard so a
+        // bundler that statically analyzes imports still treats it as
+        // optional.
+        const pkg = require('@github/copilot-sdk/package.json');
+        return pkg.version;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Try to resolve the Copilot SDK's package.json version. Returns
+ * `undefined` when the optional dep isn't installed (covers npm
+ * installs that opted out, dev environments without the bridge, etc.).
+ *
+ * Delegates to {@link resolveCopilotSdkVersionSync} so the require
+ * call has a single source of truth — see that function's docstring
+ * for why the sync sibling exists. */
+async function defaultResolveCopilotSdkVersion() {
+    return resolveCopilotSdkVersionSync();
+}
+function defaultLog(...args) {
+    console.error('[agent-tempo:adapter-versions]', ...args);
+}

package/dist/daemon.d.ts

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+import { Client, Connection } from '@temporalio/client';
+import { type Config, type DaemonConfig } from './config';
+import { type OrphanCandidate } from './reconcile/orphans';
+import type { HostProfile } from './types';
+/**
+ * Atomically write the daemon PID file via `writeFile(tmp) + rename(tmp, final)`.
+ *
+ * A racing reader (a CLI invocation that happens to poll during startup) will
+ * either see the previous file or the new one — never a half-written one.
+ *
+ * Windows sometimes fails the rename with EPERM/EBUSY/EACCES if an antivirus
+ * scanner or the previous handle is still active. We retry with short backoffs
+ * before giving up so a transient scanner doesn't crash startup.
+ *
+ * Exported for unit testing.
+ */
+export declare function writePidFileAtomic(pidFilePath: string, pid: number): Promise<void>;
+/**
+ * Runtime drift detector — #423 PR-A Fix 3. When dev mode is active but
+ * the resolved namespace is NOT the dev default, an explicit override is
+ * in play (CLI `--namespace`, `~/.agent-tempo-dev/config.json`, or — if
+ * the env-var carve-out from Fix 1 ever regressed — a leaked shell var).
+ * Either way, the operator deserves a load-bearing diagnostic so the
+ * "banner says X, daemon connects to Y" drift doesn't recur silently.
+ *
+ * Pure function over the resolved Config + an injected log sink so the
+ * unit test can capture the message without a live daemon process.
+ * Returns whether a warning fired so callers (and tests) can assert on
+ * the branch directly.
+ *
+ * The check is intentionally loose: any namespace mismatch in dev mode
+ * triggers the warning, even for intentional overrides. We can't tell
+ * a typo'd `config.json` entry from a deliberate one — the warning is
+ * cheap, and an operator who overrode the namespace on purpose can
+ * grep-skip a single line.
+ */
+export declare function warnIfDevNamespaceDrift(config: Pick<Config, 'temporalNamespace'>, logFn?: (...args: unknown[]) => void): boolean;
+/**
+ * Outcome of {@link ensureDevNamespace} — exposed so unit tests can assert
+ * on which branch fired without having to inspect log output.
+ *
+ *   - `created`: registerNamespace succeeded (first dev daemon boot)
+ *   - `already-exists`: namespace already registered (every subsequent boot)
+ *   - `permission-denied`: server rejected; daemon continues, worker may fail
+ *   - `error`: any other failure
+ *
+ * @internal
+ */
+export interface EnsureDevNamespaceResult {
+    ok: boolean;
+    status: 'created' | 'already-exists' | 'permission-denied' | 'error';
+    message?: string;
+}
+/**
+ * Auto-create the dev profile's Temporal namespace on dev daemon boot
+ * (ADR 0014 §6.2). Idempotent — calling it on every boot is correct and
+ * cheap.
+ *
+ *   - `ALREADY_EXISTS`: the steady state after the first boot. Happy path.
+ *   - `PERMISSION_DENIED`: e.g. managed Temporal Cloud where `RegisterNamespace`
+ *     isn't granted. Log + return; the subsequent worker bootstrap fails
+ *     loudly with `Namespace not found` and the operator can run
+ *     `temporal operator namespace create -n agent-tempo-dev` themselves.
+ *   - any other error: same fall-through; daemon stays alive without
+ *     mutating state.
+ *
+ * Production daemons never call this — guarded by `isDevMode()` at the
+ * single callsite in `main()` below. Exported for direct unit testing
+ * with an injected stub workflow service.
+ */
+export declare function ensureDevNamespace(connection: Pick<Connection, 'workflowService'>, namespace: string, logFn?: (...args: unknown[]) => void): Promise<EnsureDevNamespaceResult>;
+/**
+ * Test-only dependency-injection seam for {@link computeHostProfile}.
+ *
+ * Production callers omit `deps` entirely; the defaults resolve to the
+ * real probes in `daemon-adapter-versions.ts`. Tests inject stubs to
+ * exercise installed-vs-not-installed scenarios deterministically
+ * without touching the host filesystem. Mirrors the
+ * `ProbeAdapterVersionsDeps` shape from `daemon-adapter-versions.ts`,
+ * but only includes synchronous probes — `computeHostProfile` is sync
+ * by contract.
+ *
+ * Added in #532 PR-2 for the copilot host-profile probe.
+ */
+export interface ComputeHostProfileDeps {
+    /**
+     * Synchronous Copilot SDK version probe. Default:
+     * {@link resolveCopilotSdkVersionSync} from `daemon-adapter-versions.ts`.
+     * Returns the SDK's `package.json#version` when installed, or
+     * `undefined` when missing or unresolvable.
+     */
+    resolveCopilotSdkVersionSync?: () => string | undefined;
+}
+/**
+ * Build the daemon's capability profile from its config + runtime env.
+ * Result is NOT scrubbed — call `scrubHostProfile` before signaling.
+ *
+ * Exported for testability; production callers go through
+ * `runDaemonBoot(client, deps)` which provides this as the default
+ * `computeHostProfile` dep.
+ */
+export declare function computeHostProfile(config: Config, deps?: ComputeHostProfileDeps): HostProfile;
+/**
+ * #274 AC5c / M10 — HARD REQUIREMENT privacy scrub.
+ *
+ * Strips absolute paths and file extensions from every `HostProfile` field
+ * before the payload crosses the signal boundary. The global maestro is
+ * namespace-wide; a multi-tenant or multi-ensemble corporate setup would
+ * leak username-containing paths across ensembles if this is ever
+ * violated. Unit-tested in `test/daemon-boot.test.ts` with a dedicated
+ * "no `/` or `\\` in any string" invariant assertion against pathological
+ * inputs.
+ *
+ * Contract per architect AC5c:
+ * - `claudeBin` — basename only (e.g. `claude`), never absolute
+ * - `availableAgentTypes` — names only, never paths
+ * - `availablePlayerTypes` — names only, never paths
+ * - No env var values, no `workDir`, no user directories in any field
+ *
+ * The scrub is defense-in-depth: production callers (`computeHostProfile`)
+ * already produce clean inputs from `listAgentTypes().map(a => a.name)`.
+ * If a future code path accidentally passes a path, this function catches
+ * it before the workflow handler ever sees it.
+ */
+export declare function scrubHostProfile(raw: HostProfile): HostProfile;
+/**
+ * Signal `hostProfile` with bounded retry (AC5b / M11).
+ *
+ * Default backoff: `[0, 5000, 15000]` ms → 3 attempts, ≤20 s wall-clock,
+ * well under the 30 s budget. Tests override to `[0, 0, 0]` for fast
+ * execution. On total failure, logs a warning and returns — the daemon
+ * stays alive without its profile advertised.
+ *
+ * Exported for reuse by the Phase 5 `agent-tempo refresh-host-profile`
+ * CLI subcommand, which re-signals without needing the full
+ * `runDaemonBoot` sequence (the global maestro is already up).
+ */
+export declare function advertiseHostProfile(client: Client, profile: HostProfile, opts?: {
+    retryBackoffsMs?: number[];
+    log?: (...args: unknown[]) => void;
+    sendSignal?: (client: Client, profile: HostProfile) => Promise<void>;
+}): Promise<{
+    ok: boolean;
+    attempts: number;
+    lastError?: unknown;
+}>;
+/**
+ * #274 M14 — boot-sequence deps. Injected at `runDaemonBoot` so the
+ * ordering + retry + scrub invariants are all unit-testable without
+ * subprocess fixtures. Production callers pass the default impls
+ * already exported from this module.
+ */
+export interface DaemonBootDeps {
+    /** Ensure the global maestro workflow is running. Awaited before any signal. */
+    ensureGlobalMaestro: () => Promise<void>;
+    /** Signal the global maestro with the scrubbed host profile. */
+    sendHostProfileSignal: (client: Client, profile: HostProfile) => Promise<void>;
+    /**
+     * Compute the daemon's capability profile. Output is fed into
+     * `scrubHostProfile` before signaling — computeHostProfile itself does
+     * not need to scrub, the dep-swap pattern makes the pipeline testable.
+     */
+    computeHostProfile: () => HostProfile;
+    /**
+     * Probe upstream tool versions for each adapter. Issue #399 Q5.4 —
+     * the result is merged into the profile as
+     * {@link HostProfile.adapterVersions} before the first signal. Runs
+     * in parallel with `ensureGlobalMaestro`, so a slow probe doesn't
+     * extend the boot. Probe failures yield an empty / partial map; the
+     * caller never throws. Tests stub this to return canned maps.
+     *
+     * Optional — when omitted (existing tests, embedded callers), the
+     * profile is signaled without an `adapterVersions` field. The
+     * production daemon entry-point passes the real `probeAdapterVersions`
+     * from `daemon-adapter-versions.ts`.
+     */
+    probeAdapterVersions?: () => Promise<Record<string, string>>;
+    /**
+     * Retry backoffs for the `hostProfile` signal (ms). Production uses
+     * `[0, 5000, 15000]`; tests override to `[0, 0, 0]` for speed.
+     */
+    retryBackoffsMs?: number[];
+    /** Log sink. Tests stub to capture output. Defaults to module-level `log`. */
+    log?: (...args: unknown[]) => void;
+}
+/**
+ * #274 M14 — daemon boot sequence: ensure global maestro is running,
+ * then advertise the (scrubbed) capability profile with bounded retry.
+ *
+ * Ordering is load-bearing (AC5a / M11): the `hostProfile` signal MUST
+ * NOT fire until `ensureGlobalMaestro` has resolved. Otherwise the
+ * signal races the workflow-start and gets silently dropped by Temporal
+ * (WorkflowNotFound on an unknown workflow id).
+ *
+ * Hard-failure behavior (AC5b): if `ensureGlobalMaestro` rejects, the
+ * daemon stays alive WITHOUT advertising its profile. Next opportunity
+ * is the next daemon restart OR a manual `agent-tempo refresh-host-profile`
+ * invocation (Phase 5).
+ *
+ * Tests in `test/daemon-boot.test.ts` exercise:
+ *   - ensure-before-signal ordering via deferred promises
+ *   - retry success on 3rd attempt
+ *   - all-retries-exhausted stays alive
+ *   - ensure-fails-stays-alive
+ */
+export declare function runDaemonBoot(client: Client, deps: DaemonBootDeps): Promise<void>;
+/**
+ * PR-E reconcile-on-boot — design §10.1.
+ *
+ * Called once during daemon startup, after workers are running but before
+ * the main run loop blocks. Queries for orphaned sessions owned by this
+ * host and applies the effective {@link DaemonConfig.restorePolicy}:
+ *
+ *  - `auto`: call `restart` on each orphan inside the allowlist + age
+ *    window. `AttachmentConflict` is caught silently — another process
+ *    may have restored concurrently.
+ *  - `prompt`: log the orphan list and leave the restore to the CLI
+ *    `agent-tempo restore` command. No automatic action.
+ *  - `never`: silent no-op.
+ *
+ * All three branches exit in bounded time — never blocks worker startup.
+ * Non-fatal: any failure is logged and reconcile bails without crashing
+ * the daemon (worker loop takes over and the user can re-run the query
+ * via the CLI).
+ */
+export declare function reconcileOnBoot(client: Client, daemonConfig: DaemonConfig, hostname?: string, now?: number): Promise<void>;
+/**
+ * Pure formatter — turns a `process.memoryUsage()` snapshot into a single
+ * space-separated `key=NNNmb` string suitable for grepping out of the log.
+ *
+ * Exported for unit testing without a live process.
+ */
+export declare function formatMemoryUsage(usage: NodeJS.MemoryUsage): string;
+/**
+ * #336 — schedule a periodic `[agent-tempo:daemon ...] memory: ...` log
+ * line so the next memory-leak investigation has a baseline + growth curve
+ * directly in the daemon log instead of needing a debugger attach.
+ *
+ * Returns a stop function the daemon's shutdown handler invokes.
+ *
+ * `unref()` on the timer handle so memory reporting alone never keeps the
+ * daemon alive — workers + the HTTP listener are the only legitimate
+ * long-lived references.
+ */
+export declare function startMemoryReporter(intervalMs?: number, logFn?: (...args: unknown[]) => void, sample?: () => NodeJS.MemoryUsage): () => void;
+/**
+ * Filter a set of orphan candidates to those that exceed the
+ * `detachedMaxAgeDays` retention threshold. Exported for unit testing the
+ * retention math without a live Temporal connection.
+ */
+export declare function selectStaleDetachedOrphans(orphans: OrphanCandidate[], detachedMaxAgeDays: number, now?: number): OrphanCandidate[];
+/**
+ * PR-E cleanup loop — design §13.4 regression row 1.
+ *
+ * Runs on a 6-hour timer (hardcoded per §8 answer 2). Destroys detached
+ * orphans older than `detachedMaxAgeDays` via `TempoClient.destroy` so the
+ * workflow completes and eventually falls out of the namespace.
+ *
+ * Never touches `Running` workflows that still hold a live attachment
+ * (filter is explicit on `phase === 'detached'`).
+ *
+ * **Note (#144)**: an earlier revision included a "pass 2" that tried to
+ * `terminate()` already-Completed workflows as belt-and-suspenders retention.
+ * `terminate()` throws on Completed workflows in every Temporal namespace
+ * setting, so the pass was dead code masked by a swallowing catch. It was
+ * removed: namespace retention (Temporal Cloud default 30d, self-hosted
+ * configurable) is the authoritative reaper for Completed workflows.
+ */
+export declare function cleanupLoop(client: Client, daemonConfig: DaemonConfig, hostname?: string): Promise<void>;
+/**
+ * Schedule {@link cleanupLoop} to run every 6 hours. Returns a clearer
+ * function that cancels the timer — called during shutdown.
+ */
+export declare function startCleanupLoop(client: Client, daemonConfig: DaemonConfig, hostname?: string): () => void;