byollm 0.1.0-alpha.74 → 0.1.0-alpha.76

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.74`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.76`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@alpha`, or `npm install byollm@alpha`.
 >

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-YFCNYJLR.js";
+} from "./chunk-MSRBBLRQ.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/{chunk-YFCNYJLR.js → chunk-MSRBBLRQ.js}

@@ -53,6 +53,32 @@ function asHttpOrigin(candidate) {
 // src/cli.ts
 import { access } from "fs/promises";
 
+// src/emphasis.ts
+var REVERSE = "\x1B[7m";
+var BOLD = "\x1B[1m";
+var RESET = "\x1B[0m";
+function emphasisAllowed(context2) {
+  if (context2.env["NO_COLOR"] !== void 0) return false;
+  if (context2.env["FORCE_COLOR"] !== void 0) return true;
+  return context2.tty;
+}
+function emphasise(value, context2) {
+  return emphasisAllowed(context2) ? `${REVERSE}${BOLD} ${value} ${RESET}` : value;
+}
+function terminalContext() {
+  return {
+    // `@types/node` declares `isTTY` as `boolean`, and Node sets it to
+    // `undefined` when the stream is not a terminal. So this comparison is
+    // load-bearing even though the type says it cannot be — the linter is
+    // reasoning from a declaration that is wrong about its own runtime, and
+    // deleting it puts `undefined` into a field typed `boolean`. The same
+    // note stands over `setup.ts`, which met this first.
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-boolean-literal-compare
+    tty: process.stdout.isTTY === true,
+    env: process.env
+  };
+}
+
 // src/model.ts
 import { readFile, writeFile } from "fs/promises";
 
@@ -218,8 +244,8 @@ function until(message, now) {
   if (Number.isNaN(parsed)) return void 0;
   return parsed > now ? parsed : void 0;
 }
-function quotaBlock(message, now) {
-  if (!OBSERVED.some((seen) => seen.pattern.test(message))) return void 0;
+function quotaBlock(message, now, corpus = OBSERVED) {
+  if (!corpus.some((seen) => seen.pattern.test(message))) return void 0;
   const at = until(message, now);
   return { detail: message, ...at === void 0 ? {} : { until: at } };
 }
@@ -234,7 +260,6 @@ async function runProcessJob(job) {
       ok: false,
       code: "backend-error",
       message: "no time limit was set for this call",
-      retryable: false,
       durationMs: 0
     };
   }
@@ -253,7 +278,6 @@ function spawnIn(job, scratch) {
         ok: false,
         code: "canceled",
         message: "the job was canceled before it started",
-        retryable: false,
         durationMs: Date.now() - started
       });
       return;
@@ -316,7 +340,6 @@ function spawnIn(job, scratch) {
         ok: false,
         code: "backend-unreachable",
         message: `could not start ${displayName}: ${error.message}`,
-        retryable: false,
         durationMs: Date.now() - started
       });
     });
@@ -328,7 +351,6 @@ function spawnIn(job, scratch) {
           ok: false,
           code: "canceled",
           message: "the job was canceled",
-          retryable: false,
           durationMs
         });
         return;
@@ -338,7 +360,6 @@ function spawnIn(job, scratch) {
           ok: false,
           code: "timeout",
           message: `the model did not answer within ${String(request.timeoutMs)}ms`,
-          retryable: true,
           durationMs
         });
         return;
@@ -348,7 +369,6 @@ function spawnIn(job, scratch) {
           ok: false,
           code: "output-too-large",
           message: `the model produced more than ${String(request.maxOutputBytes)} bytes`,
-          retryable: false,
           durationMs
         });
         return;
@@ -356,13 +376,20 @@ function spawnIn(job, scratch) {
       if (code !== 0) {
         const said = `${stdout}
 ${stderr}`;
-        const blocked = quotaBlock(said, Date.now());
+        const blocked = quotaBlock(said, (job.now ?? Date.now)(), job.corpus);
         const authFailed = blocked === void 0 && isAuthFailure(said);
         finish({
           ok: false,
           code: blocked !== void 0 ? "quota-exhausted" : authFailed ? "unauthorized" : "backend-error",
           ...blocked?.until === void 0 ? {} : { until: blocked.until },
-          message: blocked !== void 0 ? `${displayName} is out of quota for now` : authFailed ? `${displayName} is not signed in` : stderr.trim() !== "" ? `${displayName} failed: ${firstLine(stderr)}` : (
+          message: blocked !== void 0 ? (
+            /* The CLI's own words, as the Codex path already carries —
+               M2, 2026-09-04. This said only "out of quota for now",
+               throwing away the sentence that names the time, on the one
+               surface entitled to it. Owner-only: the class is all a site
+               ever sees. */
+            `${displayName} is out of quota: ${firstLine(blocked.detail)}`
+          ) : authFailed ? `${displayName} is not signed in` : stderr.trim() !== "" ? `${displayName} failed: ${firstLine(stderr)}` : (
             /* Nothing on stderr does not mean nothing was said. An
             agentic CLI writes its errors to stdout — that is where
             "Failed to authenticate" arrived — and reporting a bare
@@ -371,7 +398,6 @@ ${stderr}`;
             goes to the site on success. */
             stdout.trim() !== "" ? `${displayName} failed: ${firstLine(stdout)}` : `${displayName} exited with status ${String(code)}`
           ),
-          retryable: false,
           durationMs
         });
         return;
@@ -658,16 +684,20 @@ function failureMessage(event) {
   const error = record(event["error"]);
   return diagnostic(event["message"]) ?? diagnostic(error?.["message"]) ?? "codex reported an error";
 }
-function classifyFailure(message) {
-  if (quotaBlock(message, Date.now()) !== void 0) {
-    return { code: "quota-exhausted", retryable: true };
+function classifyFailure(message, now, corpus) {
+  const blocked = quotaBlock(message, now, corpus);
+  if (blocked !== void 0) {
+    return {
+      code: "quota-exhausted",
+      ...blocked.until === void 0 ? {} : { until: blocked.until }
+    };
   }
   if (isAuthFailure(message)) {
-    return { code: "unauthorized", retryable: false };
+    return { code: "unauthorized" };
   }
-  return { code: "backend-error", retryable: false };
+  return { code: "backend-error" };
 }
-function parseCodexOutput(output) {
+function parseCodexOutput(output, now = Date.now(), corpus) {
   const messages = [];
   for (const line of output.split(/\r?\n/u)) {
     if (line.trim() === "") continue;
@@ -689,7 +719,7 @@ function parseCodexOutput(output) {
     }
     if (type === "error" || type === "turn.failed") {
       const detail = failureMessage(event);
-      const classified = classifyFailure(detail);
+      const classified = classifyFailure(detail, now, corpus);
       return {
         ok: false,
         ...classified,
@@ -703,8 +733,7 @@ function parseCodexOutput(output) {
   return {
     ok: false,
     code: "backend-error",
-    message: "the codex CLI ended without a terminal event",
-    retryable: false
+    message: "the codex CLI ended without a terminal event"
   };
 }
 var CodexCliBackend = class {
@@ -953,7 +982,6 @@ var OpenAiHttpBackend = class {
         ok: false,
         code: "backend-error",
         message: "no time limit was set for this call",
-        retryable: false,
         durationMs: 0
       };
     }
@@ -978,7 +1006,6 @@ var OpenAiHttpBackend = class {
         return this.#fail(
           "unauthorized",
           "the model server rejected our credentials",
-          false,
           started
         );
       }
@@ -986,7 +1013,6 @@ var OpenAiHttpBackend = class {
         return this.#fail(
           "model-not-found",
           `the model server does not know "${request.model}"`,
-          false,
           started
         );
       }
@@ -994,7 +1020,6 @@ var OpenAiHttpBackend = class {
         return this.#fail(
           "backend-error",
           `the model server returned HTTP ${String(response.status)}`,
-          response.status >= 500,
           started
         );
       }
@@ -1003,7 +1028,6 @@ var OpenAiHttpBackend = class {
         return this.#fail(
           "output-too-large",
           `the model produced more than ${String(request.maxOutputBytes)} bytes`,
-          false,
           started
         );
       }
@@ -1012,37 +1036,43 @@ var OpenAiHttpBackend = class {
         return this.#fail(
           "backend-error",
           "the model server's response was not in OpenAI chat-completion shape",
-          false,
           started
         );
       }
       return { ok: true, text: content, durationMs: Date.now() - started };
     } catch (error) {
       if (request.signal.aborted) {
-        return this.#fail("canceled", "the job was canceled", false, started);
+        return this.#fail("canceled", "the job was canceled", started);
       }
       if (isAbort(error)) {
         return this.#fail(
           "timeout",
           `the model did not answer within ${String(request.timeoutMs)}ms`,
-          true,
           started
         );
       }
       return this.#fail(
         "backend-unreachable",
         describeFetchError(error, this.#baseUrl.origin),
-        true,
         started
       );
     }
   }
-  #fail(code, message, retryable, started) {
+  /*
+   * No `retryable` argument any more — ruled 2026-09-04.
+   *
+   * This adapter used to decide it per failure, and it was the only one whose
+   * rule was defensible: `true` for unreachable and for a 5xx. That is
+   * exactly why removing it matters. The decision now lives once, in the
+   * site-facing class table, and it was the *disagreement* between three
+   * adapters that let a value only quota produced become readable as a fact
+   * about somebody's account.
+   */
+  #fail(code, message, started) {
     return {
       ok: false,
       code,
       message,
-      retryable,
       durationMs: Date.now() - started
     };
   }
@@ -2435,7 +2465,20 @@ var REVOKED_RETURN = "the installed service returns by itself once you do \u2014
 function revokedRemedy(origin, returnsByItself = true) {
   return `  re-pair:  byollm connect${origin === void 0 ? "" : ` ${origin}`}
 ` + (returnsByItself ? `  ${REVOKED_RETURN}.
-` : "");
+` : (
+    /* The restart step, on the one branch that needs one — rider closed
+              2026-09-04.
+    
+              The original rider asked for `byollm install` back in the remedy.
+              It is not the answer: a supervised daemon polls its mark and
+              promotes itself, and a reinstall was work nobody needed to do. But
+              the branch where nothing self-returns was left with a re-pair step
+              and no next step at all — somebody running the daemon in their own
+              terminal, whose process has already exited by the time they read
+              this. Their restart is the command they typed, not an install. */
+    `  then:     byollm run
+`
+  ));
 }
 async function revokedMark(healthPath) {
   return (await readHealth(healthPath))?.revoked;
@@ -3460,33 +3503,44 @@ var SERVICE_UNAVAILABLE = "a device service is unavailable \u2014 its owner has
 var FOR_SITE = Object.freeze({
   "backend-unreachable": {
     code: "service_unavailable",
-    message: SERVICE_UNAVAILABLE
+    message: SERVICE_UNAVAILABLE,
+    retryable: true
   },
   "backend-error": {
     code: "service_unavailable",
-    message: SERVICE_UNAVAILABLE
+    message: SERVICE_UNAVAILABLE,
+    retryable: true
   },
   "model-not-found": {
     code: "service_unavailable",
-    message: SERVICE_UNAVAILABLE
+    message: SERVICE_UNAVAILABLE,
+    retryable: true
   },
   "quota-exhausted": {
     code: "service_unavailable",
-    message: SERVICE_UNAVAILABLE
+    message: SERVICE_UNAVAILABLE,
+    retryable: true
   },
   unauthorized: {
     code: "service_unavailable",
-    message: SERVICE_UNAVAILABLE
+    message: SERVICE_UNAVAILABLE,
+    retryable: true
   },
   timeout: {
     code: "timeout",
-    message: "the device did not answer in time"
+    message: "the device did not answer in time",
+    retryable: true
   },
   "output-too-large": {
     code: "output-too-large",
-    message: "the answer was too large to return"
+    message: "the answer was too large to return",
+    retryable: false
   },
-  canceled: { code: "canceled", message: "the job was canceled" }
+  canceled: {
+    code: "canceled",
+    message: "the job was canceled",
+    retryable: false
+  }
 });
 function outcomeForSite(code) {
   return FOR_SITE[code];
@@ -3601,6 +3655,18 @@ var Runner = class {
    * separately.
    */
   #blocked = /* @__PURE__ */ new Map();
+  /**
+   * The blocked services' own reports, kept so a rebuild can restore them.
+   *
+   * `serviceStates` is rebuilt from scratch on every detection pass and a
+   * blocked service never reaches the probe that would fill its entry, so
+   * without this the state survives one pass and disappears — and `byollm
+   * status`, which is a different process reading the file, could never say a
+   * service was blocked.
+   */
+  #blockedReport = /* @__PURE__ */ new Map();
+  /** What was last handed to the writer, so an unchanged pass writes nothing. */
+  #lastWritten;
   /**
    * The key grants are checked against — from the pairing, or adopted later.
    *
@@ -3716,8 +3782,14 @@ var Runner = class {
       if (this.#unauthenticated.has(route.service)) continue;
       const blockedUntil = this.#blocked.get(route.service);
       if (this.#blocked.has(route.service)) {
-        if (blockedUntil !== void 0 && this.#now() < blockedUntil) continue;
+        if (blockedUntil !== void 0 && this.#now() < blockedUntil) {
+          const kept = this.#blockedReport.get(route.service);
+          if (kept !== void 0) this.serviceStates.set(route.service, kept);
+          continue;
+        }
         this.#blocked.delete(route.service);
+        this.#blockedReport.delete(route.service);
+        this.serviceStates.delete(route.service);
       }
       let usable = probed.get(route.service);
       if (usable === void 0) {
@@ -3780,6 +3852,7 @@ var Runner = class {
       });
     }
     this.#capabilities = capabilities;
+    this.#writeServiceStates();
     return capabilities;
   }
   #backendFor(route) {
@@ -4115,6 +4188,9 @@ var Runner = class {
         outcome: "error",
         code: "no-capability",
         message: "this device has no route for that job kind",
+        /* Not retryable, and not from the class table: this is the runner's
+           own refusal rather than a backend failure. A device with no route
+           for a kind will not grow one by being asked again. */
         retryable: false
       };
     }
@@ -4159,6 +4235,12 @@ var Runner = class {
       });
       if (!result.ok && result.code === "unauthorized") {
         this.#unauthenticated.add(route.service);
+        this.#noteServiceState(route.service, {
+          state: {
+            kind: "signed-out",
+            detail: result.message
+          }
+        });
         this.#options.onEvent?.({
           type: "service-not-signed-in",
           service: route.service,
@@ -4167,7 +4249,7 @@ var Runner = class {
       }
       if (!result.ok && result.code === "quota-exhausted") {
         this.#blocked.set(route.service, result.until);
-        this.serviceStates.set(route.service, {
+        const report2 = this.#noteServiceState(route.service, {
           ...this.serviceStates.get(route.service),
           state: {
             kind: "blocked",
@@ -4175,6 +4257,7 @@ var Runner = class {
             ...result.until === void 0 ? {} : { until: result.until }
           }
         });
+        this.#blockedReport.set(route.service, report2);
         this.#options.onEvent?.({
           type: "service-out-of-quota",
           service: route.service,
@@ -4200,13 +4283,15 @@ var Runner = class {
          * named its backend, so every failure leaked what every success
          * is careful to hide.
          *
-         * `retryable` still travels: whether to try again is the site's
-         * decision and says nothing about whose machine it was.
+         * `retryable` comes from the class, not from this result —
+         * ruled 2026-09-04. Taking it from the backend let one path
+         * inside `service_unavailable` report `true` and made the pair
+         * readable as "rate-limited". A flag a site can read is a channel
+         * whether or not anybody meant it as one.
          */
         {
           outcome: "error",
-          ...outcomeForSite(result.code),
-          retryable: result.retryable
+          ...outcomeForSite(result.code)
         }
       );
       await this.#options.ingress.recordOutcome({
@@ -4282,6 +4367,34 @@ var Runner = class {
       await sleep(heartbeatMs * (0.85 + Math.random() * 0.3), signal);
     }
   }
+  /**
+   * Record a service's state, and tell whoever writes the file — S-2.
+   *
+   * One door, because the bug was two doors and only one of them wrote. The
+   * quota path wrote on block and not on lift; the sign-out path never wrote
+   * at all. Both are changes `byollm status` would report differently, and
+   * status is a different process whose only source is that file.
+   */
+  #noteServiceState(service, report2) {
+    this.serviceStates.set(service, report2);
+    this.#writeServiceStates();
+    return report2;
+  }
+  /**
+   * Hand the current map to whoever persists it.
+   *
+   * Not awaited, and the rejection is swallowed on purpose: a job must not
+   * fail — nor the runner die on an unhandled rejection — because a status
+   * note could not be written. The note is evidence about the job, not part
+   * of it.
+   */
+  #writeServiceStates() {
+    const now = JSON.stringify([...this.serviceStates]);
+    if (now === this.#lastWritten) return;
+    this.#lastWritten = now;
+    const noted = this.#options.onServiceStates?.(this.serviceStates);
+    if (noted !== void 0) void noted.catch(() => void 0);
+  }
   /**
    * Note a refusal that means the relationship is over.
    *
@@ -5850,7 +5963,7 @@ Connecting to ${origin}
           `
   Your steps:
     1) Open:       ${info.verificationUrl}
-    2) Enter code: ${info.userCode}   (expires in ${String(minutes)} minutes)
+    2) Enter code: ${emphasise(info.userCode, terminalContext())}   (expires in ${String(minutes)} minutes)
     3) Check the screen shows this device's fingerprint, then approve:
 
        ${fingerprint3(deviceIdentity.identity)}
@@ -6077,6 +6190,9 @@ async function runLoop(paths, origins, io, signal, supervised = !process.stdout.
       // write a count from one attempt, which says nothing about how the
       // daemon that actually runs is getting on.
       healthPath: paths.health,
+      // Written whenever it changes, not only at start — S2. `byollm status`
+      // is a different process and this file is the whole of what reaches it.
+      onServiceStates: (states) => writeServiceStates(paths.serviceStates, states),
       identity: {
         keys: () => identity.load(Date.now()),
         // What was on disk. The runner replaces it from each heartbeat and
@@ -6913,7 +7029,7 @@ async function exists(path) {
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0-alpha.74";
+var DAEMON_VERSION = "0.1.0-alpha.76";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -6965,4 +7081,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-YFCNYJLR.js.map
+//# sourceMappingURL=chunk-MSRBBLRQ.js.map