bloby-bot 0.54.10 → 0.54.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bloby-bot",
-  "version": "0.54.10",
+  "version": "0.54.11",
   "releaseNotes": [
     "1. New Morphy animation system: config-driven sprites loaded from /morphy/*.json",
     "2. Swapped teleporting (splash) and headphones (bubble + chat) to the new format",

package/supervisor/harnesses/codex.ts

@@ -44,11 +44,13 @@ const CLIENT_INFO = { name: 'bloby', title: 'Bloby', version: '1' };
 const REQUEST_TIMEOUT_MS = 60_000;
 const VALID_EFFORTS = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh']);
 /**
- * Per-turn watchdog. `turn/completed` is a NON-guaranteed notification — if the
- * app-server stalls mid-turn without exiting, the RPC `exit` handler never fires
- * and `busy` stays true forever (live: wedges the dashboard + defers backend
- * restarts; one-shot: pins the WhatsApp/scheduler slot since bot:done never
- * arrives). Claude's one-shot path has the same 5-min guard. Mirrors it here.
+ * Per-turn IDLE watchdog. `turn/completed` is a NON-guaranteed notification — if
+ * the app-server stalls mid-turn without exiting, the RPC `exit` handler never
+ * fires and `busy` stays true forever (live: wedges the dashboard + defers
+ * backend restarts; one-shot: pins the WhatsApp/scheduler slot since bot:done
+ * never arrives). This is an IDLE timeout, reset on every notification for the
+ * conversation — a legitimately long turn (deep reasoning, many tool calls)
+ * keeps emitting events and is never killed; only true silence trips recovery.
  */
 const TURN_WATCHDOG_MS = 5 * 60_000;
 
@@ -172,8 +174,8 @@ class CodexRpc {
   private closed = false;
   private stderrBuf = '';
 
-  start(): void {
-    this.proc = spawn(resolveCodexBin(), ['app-server'], { stdio: ['pipe', 'pipe', 'pipe'] });
+  start(extraArgs: string[] = []): void {
+    this.proc = spawn(resolveCodexBin(), ['app-server', ...extraArgs], { stdio: ['pipe', 'pipe', 'pipe'] });
     const rl = readline.createInterface({ input: this.proc.stdout });
     rl.on('line', (line) => this.onLine(line));
 
@@ -246,14 +248,30 @@ class CodexRpc {
   }
 
   private handleServerRequest(msg: { id: number; method: string; params?: any }): void {
-    const isApproval = msg.method.endsWith('/requestApproval');
-    if (isApproval) {
-      log.info(`[codex-rpc] auto-accepting server request: ${msg.method}`);
-      this.respond(msg.id, 'acceptForSession');
-      return;
+    // Responses are OBJECTS, not bare strings: CommandExecution/FileChange approval
+    // responses are `{ decision }` (CommandExecutionApprovalDecision / FileChangeApprovalDecision),
+    // and the legacy v1 aliases take `{ decision }` with the ReviewDecision enum.
+    // (None of these fire under approvalPolicy:'never' + danger-full-access, but reply
+    // correctly so an edge-case request can't stall the turn with a malformed reply.)
+    switch (msg.method) {
+      case 'item/commandExecution/requestApproval':
+      case 'item/fileChange/requestApproval':
+        log.info(`[codex-rpc] auto-accepting ${msg.method}`);
+        this.respond(msg.id, { decision: 'acceptForSession' });
+        return;
+      case 'execCommandApproval':
+      case 'applyPatchApproval':
+        log.info(`[codex-rpc] auto-accepting (legacy) ${msg.method}`);
+        this.respond(msg.id, { decision: 'approved_for_session' });
+        return;
+      // account/chatgptAuthTokens/refresh is only used by client-managed-token
+      // clients; Bloby authenticates via chatgpt OAuth and the app-server refreshes
+      // ~/.codex/auth.json itself, so this server-request never fires for us. Decline
+      // cleanly (a stale-credential edge would surface as a normal turn error instead).
+      default:
+        log.warn(`[codex-rpc] unhandled server request ${msg.method} — replying -32601`);
+        this.respondError(msg.id, -32601, `Method ${msg.method} not implemented by Bloby client`);
     }
-    log.warn(`[codex-rpc] unhandled server request ${msg.method} — replying with error`);
-    this.respondError(msg.id, -32601, `Method ${msg.method} not implemented by Bloby client`);
   }
 
   private respond(id: number, result: any): void {
@@ -304,8 +322,16 @@ class CodexRpc {
       p.reject(new Error('RPC connection closed'));
     }
     this.pending.clear();
-    try { this.proc?.stdin.end(); } catch {}
-    try { this.proc?.kill('SIGTERM'); } catch {}
+    const proc = this.proc;
+    try { proc?.stdin.end(); } catch {}
+    try { proc?.kill('SIGTERM'); } catch {}
+    // Escalate to SIGKILL if the app-server ignores SIGTERM (no true leak today
+    // since SIGTERM reaps it, but a SIGTERM-ignoring build would otherwise survive).
+    if (proc) {
+      const t = setTimeout(() => { try { proc.kill('SIGKILL'); } catch {} }, 2000);
+      if (typeof t.unref === 'function') t.unref();
+      proc.once('exit', () => clearTimeout(t));
+    }
     this.proc = null;
   }
 }
@@ -320,6 +346,9 @@ interface CodexConversation {
   onMessage: OnAgentMessage;
   /** Currently in-flight turn id (set on `turn/started`, cleared on `turn/completed`). */
   currentTurnId: string | null;
+  /** itemId of the agentMessage currently streaming — used to insert a paragraph
+   *  break when a turn emits multiple separate agentMessage items. */
+  currentMsgItemId: string | null;
   /** Streaming text accumulator for the current turn's agentMessage items. */
   fullText: string;
   /** Tools/items used during the current turn, for the bot:turn-complete payload. */
@@ -462,10 +491,14 @@ async function steerOrQueue(conv: CodexConversation, content: string, savedFiles
 
 function handleNotification(conv: CodexConversation, n: { method: string; params?: any }): void {
   const p = n.params || {};
+  // Any notification for this conv proves the app-server is alive and working —
+  // reset the idle watchdog so a long-but-active turn isn't torn down.
+  if (conv.turnWatchdog) armTurnWatchdog(conv);
   switch (n.method) {
     case 'turn/started': {
       conv.currentTurnId = p.turn?.id || null;
       conv.fullText = '';
+      conv.currentMsgItemId = null;
       conv.usedFileTools = false;
       break;
     }
@@ -473,6 +506,13 @@ function handleNotification(conv: CodexConversation, n: { method: string; params
     case 'item/agentMessage/delta': {
       const delta: string = p.delta || '';
       if (!delta) break;
+      // A turn can emit multiple agentMessage items (commentary then final_answer).
+      // On a new itemId, insert a paragraph break so they don't run together (mirrors claude.ts).
+      if (p.itemId && conv.currentMsgItemId && p.itemId !== conv.currentMsgItemId && conv.fullText && !conv.fullText.endsWith('\n')) {
+        conv.fullText += '\n\n';
+        conv.onMessage('bot:token', { conversationId: conv.id, token: '\n\n' });
+      }
+      if (p.itemId) conv.currentMsgItemId = p.itemId;
       conv.fullText += delta;
       conv.onMessage('bot:token', { conversationId: conv.id, token: delta });
       break;
@@ -512,6 +552,17 @@ function handleNotification(conv: CodexConversation, n: { method: string; params
             input: { query: item.query || '' },
           });
           break;
+        case 'collabAgentToolCall':
+          // Codex's collaborating sub-agents (rarely enabled) → Bloby's sub-agent UX.
+          if (item.tool === 'spawnAgent') {
+            conv.onMessage('bot:task-created', {
+              conversationId: conv.id,
+              taskId: item.id,
+              description: item.prompt || 'sub-agent',
+              type: 'collab',
+            });
+          }
+          break;
         // userMessage / agentMessage / reasoning — no tool-style event.
       }
       break;
@@ -528,6 +579,14 @@ function handleNotification(conv: CodexConversation, n: { method: string; params
           conv.onMessage('bot:token', { conversationId: conv.id, token: text });
         }
       }
+      if (item.type === 'collabAgentToolCall' && item.tool === 'spawnAgent') {
+        conv.onMessage('bot:task-done', {
+          conversationId: conv.id,
+          taskId: item.id,
+          status: item.status,
+          summary: item.prompt || '',
+        });
+      }
       break;
     }
 
@@ -598,8 +657,17 @@ function handleNotification(conv: CodexConversation, n: { method: string; params
       break;
     }
 
-    // thread/started, thread/status/changed, mcpServer/startupStatus/updated,
-    // remoteControl/status/changed — informational, no-op for the dashboard.
+    case 'mcpServer/startupStatus/updated': {
+      // Surface MCP servers (from MCP.json → -c overrides) that fail to start,
+      // so a misconfigured server is visible instead of silently absent.
+      if (p.status === 'failed' || p.status === 'cancelled') {
+        log.warn(`[codex] MCP server "${p.name}" ${p.status}${p.error ? `: ${p.error}` : ''}`);
+      }
+      break;
+    }
+
+    // thread/started, thread/status/changed, remoteControl/status/changed —
+    // informational, no-op for the dashboard.
   }
 }
 
@@ -631,7 +699,7 @@ async function spawnAndInitialize(
 
   const { id: modelId, effort } = parseModelString(model);
   const rpc = new CodexRpc();
-  rpc.start();
+  rpc.start(buildMcpConfigArgs());
 
   const conv: CodexConversation = {
     id: conversationId,
@@ -640,6 +708,7 @@ async function spawnAndInitialize(
     effort,
     onMessage,
     currentTurnId: null,
+    currentMsgItemId: null,
     fullText: '',
     usedFileTools: false,
     pendingInputs: [],
@@ -703,27 +772,109 @@ async function spawnAndInitialize(
 }
 
 const SKILLS_DIR = path.join(WORKSPACE_DIR, 'skills');
+// Codex discovers "repo"-scope skills under `<cwd>/.codex/skills` (verified
+// against 0.135.0 — a bare `<cwd>/skills` is NOT scanned, and `skills/list`
+// has no extra-root param). Bloby keeps the canonical skills in
+// `workspace/skills/<name>`, so we mirror each one into `.codex/skills/<name>`
+// as a symlink — single source of truth, discoverable by codex's native router.
+// (Each SKILL.md needs YAML frontmatter or codex rejects it — see SKILL_FORMAT_MIGRATION.md.)
+const CODEX_SKILLS_ROOT = path.join(WORKSPACE_DIR, '.codex', 'skills');
+
+/** Mirror workspace/skills/<name> → workspace/.codex/skills/<name> as symlinks (idempotent). */
+function syncCodexSkillRoot(): void {
+  let names: string[] = [];
+  try {
+    names = fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
+      .filter((e) => e.isDirectory() || e.isSymbolicLink())
+      .map((e) => e.name);
+  } catch {
+    return; // no skills dir — nothing to mirror
+  }
+  try { fs.mkdirSync(CODEX_SKILLS_ROOT, { recursive: true }); } catch {}
+  for (const name of names) {
+    const target = path.join(SKILLS_DIR, name);
+    const link = path.join(CODEX_SKILLS_ROOT, name);
+    try {
+      const cur = fs.existsSync(link) ? fs.realpathSync(link) : null;
+      if (cur === fs.realpathSync(target)) continue; // already correct
+      try { fs.rmSync(link, { recursive: true, force: true }); } catch {}
+      fs.symlinkSync(target, link, 'dir');
+    } catch (err: any) {
+      log.warn(`[codex] could not mirror skill "${name}" into .codex/skills: ${err.message}`);
+    }
+  }
+}
 
 function primeWorkspaceSkills(rpc: CodexRpc): void {
+  syncCodexSkillRoot();
   rpc.request('skills/list', {
     cwds: [WORKSPACE_DIR],
     forceReload: true,
-    perCwdExtraUserRoots: [{
-      cwd: WORKSPACE_DIR,
-      extraUserRoots: [SKILLS_DIR],
-    }],
   }).then((result: any) => {
     const entry = result?.data?.[0];
     const all = entry?.skills ?? [];
-    const workspace = all.filter((s: any) => s.scope !== 'system');
+    const repo = all.filter((s: any) => s.scope === 'repo');
     const errors = entry?.errors ?? [];
-    log.ok(`[codex] skills primed: ${workspace.length} workspace, ${all.length - workspace.length} system${errors.length ? `, ${errors.length} rejected` : ''}`);
+    log.ok(`[codex] skills primed: ${repo.length} workspace (repo), ${all.length - repo.length} user/system${errors.length ? `, ${errors.length} rejected` : ''}`);
     for (const err of errors) log.warn(`[codex] skill load error: ${err.path} — ${err.message}`);
   }).catch((err: any) => {
     log.warn(`[codex] skills/list failed: ${err.message}`);
   });
 }
 
+/* ── MCP wiring ────────────────────────────────────────────────────────── */
+
+const MCP_CONFIG_FILE = path.join(WORKSPACE_DIR, 'MCP.json');
+
+/**
+ * Load MCP servers from workspace/MCP.json (the same file the Claude harness
+ * reads). Accepts the canonical unwrapped map `{ name: { command, args, env } }`,
+ * a `{ mcpServers: {...} }` wrapper, or a legacy array of single-key maps.
+ * Returns {} when absent/invalid — so this is a no-op until the user populates MCP.json.
+ */
+function loadMcpServersForCodex(): Record<string, any> {
+  try {
+    const raw = JSON.parse(fs.readFileSync(MCP_CONFIG_FILE, 'utf-8'));
+    let map: any = raw;
+    if (raw && typeof raw === 'object' && raw.mcpServers && typeof raw.mcpServers === 'object') map = raw.mcpServers;
+    else if (Array.isArray(raw)) map = Object.assign({}, ...raw);
+    if (map && typeof map === 'object' && !Array.isArray(map)) return map;
+  } catch {}
+  return {};
+}
+
+/** Serialize a JS value as a TOML literal for a `-c key=value` override. */
+function toToml(v: any): string {
+  if (Array.isArray(v)) return `[${v.map(toToml).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.entries(v).map(([k, val]) => `${JSON.stringify(k)}=${toToml(val)}`).join(',')}}`;
+  if (typeof v === 'number' || typeof v === 'boolean') return String(v);
+  return JSON.stringify(String(v)); // TOML basic string — JSON escaping is compatible
+}
+
+/**
+ * Translate MCP.json into `codex app-server -c mcp_servers.<name>.<field>=<toml>`
+ * spawn flags. Codex sources MCP from its own config layer rather than a per-query
+ * param (verified against 0.135.0: a `-c mcp_servers.X.command=...` override shows
+ * up in both mcpServerStatus/list and config/read). Only the stdio fields Bloby
+ * uses (command/args/env) are translated; names must be TOML-bare-key safe.
+ */
+function buildMcpConfigArgs(): string[] {
+  const servers = loadMcpServersForCodex();
+  const args: string[] = [];
+  let wired = 0;
+  for (const [name, cfg] of Object.entries(servers)) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name)) { log.warn(`[codex] skipping MCP server "${name}" — name not TOML-bare-key safe`); continue; }
+    const c: any = cfg || {};
+    if (!c.command) { log.warn(`[codex] skipping MCP server "${name}" — no command`); continue; }
+    args.push('-c', `mcp_servers.${name}.command=${toToml(c.command)}`);
+    if (Array.isArray(c.args) && c.args.length) args.push('-c', `mcp_servers.${name}.args=${toToml(c.args)}`);
+    if (c.env && typeof c.env === 'object' && Object.keys(c.env).length) args.push('-c', `mcp_servers.${name}.env=${toToml(c.env)}`);
+    wired++;
+  }
+  if (wired) log.info(`[codex] wiring ${wired} MCP server(s) from MCP.json via -c overrides`);
+  return args;
+}
+
 /* ── Harness implementation ────────────────────────────────────────────── */
 
 export function hasConversation(conversationId: string): boolean {
@@ -856,7 +1007,7 @@ export async function runAgentQuery(req: AgentQueryRequest): Promise<AgentQueryR
   const timeout = Math.min(Math.max(req.timeout || 120_000, 5_000), 300_000);
 
   const rpc = new CodexRpc();
-  rpc.start();
+  rpc.start(buildMcpConfigArgs());
 
   let fullText = '';
   const usedTools = new Set<string>();

package/supervisor/index.ts

@@ -1856,6 +1856,28 @@ mint();
         };
       }
 
+      // Same for Codex OAuth: the app-server reads ~/.codex/auth.json at spawn, so a
+      // running subprocess only adopts a new identity on re-spawn. End live conversations
+      // after a successful exchange so the next message cold-starts with the fresh token.
+      // (Wraps only the one-shot /exchange; the device-code /status route latches
+      //  success on every poll and must not re-fire teardown — handled at re-spawn instead.)
+      if (req.method === 'POST' && req.url === '/api/auth/codex/exchange') {
+        const origEnd = res.end.bind(res);
+        (res as any).end = function (this: typeof res, ...args: any[]) {
+          try {
+            const body = typeof args[0] === 'string' ? args[0] : args[0]?.toString();
+            if (body) {
+              const json = JSON.parse(body);
+              if (json.success) {
+                log.info('[orchestrator] Codex re-auth succeeded — restarting conversations with fresh token');
+                endAllConversations();
+              }
+            }
+          } catch {}
+          return origEnd(...args);
+        };
+      }
+
       workerApp(req, res);
       return;
     }

package/workspace/skills/alexa/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: alexa
+description: "Alexa voice channel for your agent via the public 'Morphy' skill. Code-based pairing, voice-first response style, three-pattern decision tree (fast / chat-deferred / HA-announce-deferred)."
+---
+
 # Alexa
 
 ## What This Is

package/workspace/skills/mac/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: mac
+description: "Morphy native macOS companion. Activates on the [Mac] tag. Output is a concise spoken reply (TTS); optionally accompany it with a <notch_html>…</notch_html> visual card rendered inside the MacBook notch (383×147pt, transparent over black). Frequent snippets are cached in workspace/skills/mac/frequentSnippets/ for instant re-use."
+---
+
 # Mac (Morphy notch)
 
 ## What This Is

package/workspace/skills/plaud/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: plaud
+description: "Plaud Note integration. Pairs the user's Plaud account (email OTP or paste-token for Google/Apple identities), pulls recordings into workspace/files/audio/plaud/, and routes transcription through either the Bloby Marketplace audio-to-text service (pay-per-minute) or the human's own provider (Groq / OpenAI Whisper / Mistral Voxtral / local)."
+---
+
 # Plaud
 
 ## What This Is

package/workspace/skills/whatsapp/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: whatsapp
+description: "WhatsApp channel for your agent via Baileys. QR auth, messaging, voice transcription, channel and business modes."
+---
+
 # WhatsApp
 
 ## What This Is