crew-runner 0.0.0-stage → 0.2.0

package/src/cli.ts

@@ -0,0 +1,186 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createApi, type ClaimMode, type RunnerApi } from "./api.ts";
+import { runAcp } from "./acp.ts";
+import { runComputer } from "./computer-run.ts";
+import { checkClaude, runClaude, type Check } from "./claude.ts";
+import { checkCodex, runCodex } from "./codex.ts";
+import { loop, RUN_TIMEOUT_MS, type Runner } from "./loop.ts";
+import { pairConfirmationCode } from "./pair-code.ts";
+import * as store from "./store.ts";
+
+const DEFAULT_APP_URL = "https://app.crewcortex.com";
+const LINK_WAIT_MS = 5 * 60 * 1000;
+const LINK_POLL_MS = 2_000;
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+function openBrowser(url: string): void {
+  // Not `cmd /c start`: cmd treats the & in a URL as the end of the command. rundll32 takes the URL as one argument.
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => undefined).unref();
+  } catch {
+    // The URL is printed too.
+  }
+}
+
+// The token is made here and never sent. The server only gets its SHA-256 (the "code") through the signed-in member.
+async function login(appUrlArg: string | undefined): Promise<number> {
+  const appUrl = (appUrlArg || process.env.CREW_APP_URL || DEFAULT_APP_URL).replace(/\/+$/, "");
+  if (!/^https?:\/\//.test(appUrl)) {
+    console.error("Usage: crew-runner login [app url]");
+    return 2;
+  }
+  // 32 bytes base64url (43 chars): the only shape the server's bearerToken() accepts.
+  const token = randomBytes(32).toString("base64url");
+  const code = createHash("sha256").update(token).digest("hex");
+  const url = `${appUrl}/runner/link?code=${code}`;
+  console.log(`Open this page, sign in and confirm this computer:\n${url}`);
+  console.log(`\nConfirmation code: ${pairConfirmationCode(code)}\nOnly approve if the page shows this exact code. If it differs, or you did not run this command, close the page.`);
+  openBrowser(url);
+  const api = createApi({ appUrl, token });
+  const until = Date.now() + LINK_WAIT_MS;
+  while (Date.now() < until) {
+    if (await api.ping().catch(() => false)) {
+      await store.save({ appUrl, token });
+      console.log("Linked. Now run `npx crew-runner@latest start` (or `crew-runner start` if you installed it) and leave it running.");
+      return 0;
+    }
+    await sleep(LINK_POLL_MS);
+  }
+  console.error("Timed out waiting for the link to be confirmed.");
+  return 1;
+}
+
+type CliName = "claude" | "codex";
+
+// Default is the ACP path. CREW_RUNNER_PROTOCOL=legacy keeps the old direct adapters for one release.
+const legacy = () => process.env.CREW_RUNNER_PROTOCOL === "legacy";
+
+const CLIS: Record<CliName, { label: string; bin: () => string; check: (bin: string) => Promise<Check>; runner: (bin: string) => Runner }> = {
+  claude: {
+    label: "Claude Code",
+    bin: () => process.env.CREW_CLAUDE_BIN || "claude",
+    check: checkClaude,
+    runner: (bin) => (pkg, sink, signal) =>
+      legacy() ? runClaude(pkg, sink, { bin, timeoutMs: RUN_TIMEOUT_MS }) : runAcp("claude", pkg, sink, { bin, timeoutMs: RUN_TIMEOUT_MS, signal }),
+  },
+  codex: {
+    label: "Codex",
+    bin: () => process.env.CREW_CODEX_BIN || "codex",
+    check: checkCodex,
+    runner: (bin) => (pkg, sink, signal) =>
+      legacy() ? runCodex(pkg, sink, { bin, timeoutMs: RUN_TIMEOUT_MS }) : runAcp("codex", pkg, sink, { timeoutMs: RUN_TIMEOUT_MS, signal }),
+  },
+};
+const CLI_NAMES = Object.keys(CLIS) as CliName[];
+
+function flagValue(args: string[], flag: string): string | undefined {
+  const i = args.indexOf(flag);
+  if (i >= 0) return args[i + 1];
+  return args.find((a) => a.startsWith(`${flag}=`))?.slice(flag.length + 1);
+}
+
+// Picks which app runs the agents: --cli, then CREW_RUNNER_CLI, else the first one that is installed and signed in.
+async function chooseCli(args: string[]): Promise<{ name: CliName; version: string } | { error: string }> {
+  const asked = flagValue(args, "--cli") ?? process.env.CREW_RUNNER_CLI;
+  if (asked) {
+    if (!CLI_NAMES.includes(asked as CliName)) return { error: `Unknown --cli "${asked}". Use claude or codex.` };
+    const name = asked as CliName;
+    const check = await CLIS[name].check(CLIS[name].bin());
+    return check.ok ? { name, version: check.version } : { error: check.message };
+  }
+  const messages: string[] = [];
+  for (const name of CLI_NAMES) {
+    const check = await CLIS[name].check(CLIS[name].bin());
+    if (check.ok) return { name, version: check.version };
+    messages.push(check.message);
+  }
+  return { error: messages.join("\n") };
+}
+
+async function start(args: string[]): Promise<number> {
+  const cfg = await store.load();
+  if (!cfg) {
+    console.error("Not linked. Run `npx crew-runner@latest login` first.");
+    return 1;
+  }
+  if (args.includes("--computer")) return startComputer(cfg);
+  const chosen = await chooseCli(args);
+  if ("error" in chosen) {
+    console.error(chosen.error);
+    return 1;
+  }
+  const cli = CLIS[chosen.name];
+  return serve(cfg, [`Ready. ${cli.label} ${chosen.version}. Waiting for runs. Press Ctrl+C to stop.`], () => cli.runner(cli.bin()), "default");
+}
+
+// Computer mode: only this member's @mac runs, with Claude Code's own tools in the allowed folders. An ordinary
+// `start` never receives them. Claude Code only (Codex is not supported here).
+async function startComputer(cfg: store.Stored): Promise<number> {
+  const bin = CLIS.claude.bin();
+  const check = await CLIS.claude.check(bin);
+  if (!check.ok) {
+    console.error(check.message);
+    return 1;
+  }
+  return serve(cfg, [
+    `Computer mode. Claude Code ${check.version}. Works in ~/CrewCortex/<workspace>, ~/Downloads and ~/.cursor/dev projects.`,
+    "Deletes, git push, sends, payments and changes outside those folders wait for your yes in CrewCortex. Press Ctrl+C to stop.",
+  ], (api) => (pkg, sink, signal) => runComputer(api, pkg, sink, { bin, timeoutMs: RUN_TIMEOUT_MS, signal }), "computer");
+}
+
+// Both modes: check the device, then claim and run until Ctrl+C (or SIGTERM, or SIGBREAK on Windows).
+async function serve(cfg: store.Stored, banner: string[], runnerFor: (api: RunnerApi) => Runner, mode: ClaimMode): Promise<number> {
+  const api = createApi(cfg);
+  if (!(await api.ping().catch(() => false))) {
+    console.error("The server did not accept this device. Run `npx crew-runner@latest login` again.");
+    return 1;
+  }
+  for (const line of banner) console.log(line);
+  const ac = new AbortController();
+  process.once("SIGINT", () => ac.abort());
+  process.once("SIGTERM", () => ac.abort());
+  // Windows sends SIGBREAK (Ctrl+Break, closing the console window) instead of SIGTERM.
+  if (process.platform === "win32") process.once("SIGBREAK", () => ac.abort());
+  await loop(api, runnerFor(api), ac.signal, (m) => console.log(m), mode);
+  return 0;
+}
+
+async function status(): Promise<number> {
+  const cfg = await store.load();
+  if (!cfg) {
+    console.log("Not linked.");
+    return 1;
+  }
+  const linked = await createApi(cfg).ping().catch(() => false);
+  console.log(`Server: ${cfg.appUrl}`);
+  console.log(`Device: ${linked ? "linked" : "not accepted (run login again)"}`);
+  let anyReady = false;
+  for (const name of CLI_NAMES) {
+    const check = await CLIS[name].check(CLIS[name].bin());
+    anyReady ||= check.ok;
+    console.log(`${CLIS[name].label}: ${check.ok ? `ready (${check.version})` : check.message}`);
+  }
+  return linked && anyReady ? 0 : 1;
+}
+
+async function logout(): Promise<number> {
+  const cfg = await store.load();
+  if (cfg) await createApi(cfg).revoke().catch(() => false);
+  await store.clear();
+  console.log("Logged out. This device can no longer receive runs.");
+  return 0;
+}
+
+export async function main(argv: string[]): Promise<number> {
+  const [cmd, arg] = argv;
+  if (cmd === "studio") return (await import("./studio-cli.ts")).studioMain(argv.slice(1));
+  if (cmd === "login") return login(arg);
+  if (cmd === "start") return start(argv.slice(1));
+  if (cmd === "status") return status();
+  if (cmd === "logout") return logout();
+  console.log("Usage: crew-runner <login [app url] | start [--cli claude|codex] | start --computer | status | logout>");
+  return cmd ? 2 : 0;
+}

package/src/codex.ts

@@ -0,0 +1,158 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import type { Claimed, RunEvent } from "./api.ts";
+import { spawnBin } from "./spawn.ts";
+import { parseVersion, promptFrom, run, type Check, type Outcome } from "./claude.ts";
+
+// Drives the member's own `codex` app in exec mode. Like claude.ts we only run its public commands
+// (--version, login status) and read the exit code. We never open its files or environment.
+const MIN_CODEX_MAJOR = 0;
+const MIN_CODEX_MINOR = 142;
+const MAX_TEXT = 100_000;
+const TOKEN_ENV = "CREW_RUN_TOKEN";
+
+// Every enabled feature in `codex features list` that adds tool surface (checked on 0.142.5). Our MCP server is the only
+// intended tool, so the shell, browser, computer, image, apps, plugin and sub-agent tools are all switched off.
+export const DISABLED_FEATURES = [
+  "shell_tool",
+  "unified_exec",
+  "apps",
+  "browser_use",
+  "browser_use_external",
+  "browser_use_full_cdp_access",
+  "computer_use",
+  "in_app_browser",
+  "image_generation",
+  "multi_agent",
+  "plugins",
+  "tool_suggest",
+  "goals",
+  "hooks",
+  "skill_mcp_dependency_install",
+] as const;
+
+export async function checkCodex(bin = "codex"): Promise<Check> {
+  const v = await run(bin, ["--version"]);
+  if (v.code !== 0) return { ok: false, message: "Codex is not installed. Install it, sign in with `codex login`, then run this again." };
+  const ver = parseVersion(v.out);
+  if (!ver) return { ok: false, message: "Could not read the Codex version." };
+  if (ver.major < MIN_CODEX_MAJOR || (ver.major === MIN_CODEX_MAJOR && ver.minor < MIN_CODEX_MINOR)) {
+    return { ok: false, message: `Codex ${ver.text} is too old (${MIN_CODEX_MAJOR}.${MIN_CODEX_MINOR}.x or later is needed). Update it.` };
+  }
+  const s = await run(bin, ["login", "status"]);
+  if (s.code !== 0) return { ok: false, message: "Codex is not signed in. Run `codex login`, then run this again." };
+  return { ok: true, version: ver.text };
+}
+
+// The run token is NOT in these args: Codex reads it from the child env var named by bearer_token_env_var.
+// Values go through JSON.stringify, which is a valid TOML basic string. The prompt is sent on stdin ("-").
+export function buildCodexArgs(pkg: Pick<Claimed, "instructions" | "mcp_url">, cwd: string): string[] {
+  const args = [
+    "exec",
+    "--json",
+    "-s", "read-only",
+    "--ephemeral",
+    "--skip-git-repo-check",
+    "--ignore-user-config",
+    "--ignore-rules",
+    "-C", cwd,
+  ];
+  for (const f of DISABLED_FEATURES) args.push("--disable", f);
+  const cfg: [string, string][] = [
+    ["web_search", JSON.stringify("disabled")],
+    ["approval_policy", JSON.stringify("never")],
+    ["developer_instructions", JSON.stringify(pkg.instructions)],
+    ["mcp_servers.crew.url", JSON.stringify(pkg.mcp_url)],
+    ["mcp_servers.crew.bearer_token_env_var", JSON.stringify(TOKEN_ENV)],
+    ["mcp_servers.crew.default_tools_approval_mode", JSON.stringify("approve")],
+    ["mcp_servers.crew.required", "true"],
+  ];
+  for (const [k, v] of cfg) args.push("-c", `${k}=${v}`);
+  args.push("-");
+  return args;
+}
+
+type Item = {
+  type?: string;
+  text?: string;
+  server?: string;
+  tool?: string;
+  arguments?: unknown;
+  result?: { content?: unknown; structured_content?: unknown } | null;
+  error?: { message?: string } | null;
+};
+type Line = {
+  type?: string;
+  item?: Item;
+  usage?: { input_tokens?: number; output_tokens?: number };
+};
+
+// One `codex exec --json` line -> zero or more events for the server.
+export function codexEventsFromLine(line: Line): RunEvent[] {
+  const item = line.item;
+  if (!item || item.type !== "mcp_tool_call") return [];
+  if (line.type === "item.started") {
+    return [{ type: "step", kind: "tool", name: `mcp__${item.server}__${item.tool}`, input: item.arguments }];
+  }
+  if (line.type === "item.completed") {
+    const output = item.error ? item.error.message : (item.result?.structured_content ?? item.result?.content);
+    return [{ type: "step", kind: "tool", output }];
+  }
+  return [];
+}
+
+export async function runCodex(
+  pkg: Claimed,
+  sink: (events: RunEvent[]) => Promise<void>,
+  opts: { bin?: string; timeoutMs: number },
+): Promise<Outcome> {
+  // Empty temp directory, as in claude.ts: there is nothing of the member's to touch.
+  const cwd = await mkdtemp(join(tmpdir(), "crew-run-"));
+  const env = { ...process.env, [TOKEN_ENV]: pkg.token };
+  const child = spawnBin(opts.bin ?? "codex", buildCodexArgs(pkg, cwd), { cwd, env, stdio: ["pipe", "pipe", "ignore"] });
+  const timer = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs);
+  child.stdin!.on("error", () => undefined);
+  child.stdin!.end(promptFrom(pkg.messages));
+
+  let text = "";
+  let usage: Line["usage"];
+  let completed = false;
+  let failed = false;
+  const pending: Promise<void>[] = [];
+  const rl = createInterface({ input: child.stdout! });
+  rl.on("line", (raw) => {
+    let line: Line;
+    try {
+      line = JSON.parse(raw) as Line;
+    } catch {
+      return;
+    }
+    if (line.type === "turn.completed") {
+      completed = true;
+      usage = line.usage;
+    }
+    if (line.type === "turn.failed") failed = true;
+    if (line.type === "item.completed" && line.item?.type === "agent_message") text = line.item.text ?? "";
+    const events = codexEventsFromLine(line);
+    if (events.length) pending.push(sink(events).catch(() => undefined));
+  });
+  const code = await new Promise<number>((resolve) => {
+    child.on("error", () => resolve(127));
+    child.on("close", (c) => resolve(c ?? 1));
+  });
+  clearTimeout(timer);
+  await Promise.all(pending);
+  await rm(cwd, { recursive: true, force: true });
+
+  if (!completed || failed || code !== 0) {
+    return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  }
+  return {
+    status: "completed",
+    text: text.slice(0, MAX_TEXT),
+    inputTokens: usage?.input_tokens ?? 0,
+    outputTokens: usage?.output_tokens ?? 0,
+  };
+}

package/src/computer-run.ts

@@ -0,0 +1,118 @@
+import type * as acp from "@agentclientprotocol/sdk";
+import { runAcp, type SeenCall } from "./acp.ts";
+import type { Claimed, RunEvent, RunnerApi } from "./api.ts";
+import type { Outcome } from "./claude.ts";
+import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { computerFolders, computerPrompt, judge, prepareWorkspaceFolder, type Verdict } from "./computer.ts";
+
+const POLL_MS = 3_000;
+// How often a computer run checks it is still running. The owner's off switch cancels it on the server.
+const ALIVE_MS = 5_000;
+const sleep = (ms: number, signal?: AbortSignal) =>
+  new Promise<void>((r) => {
+    const t = setTimeout(r, ms);
+    signal?.addEventListener("abort", () => (clearTimeout(t), r()), { once: true });
+  });
+
+type Ask = Pick<RunnerApi, "askOwner" | "ownerAnswer" | "alive">;
+
+// Waits for the owner's answer on their CrewCortex card. Anything but a yes (no, expired, run stopped, network) is a no.
+export async function ownerSaysYes(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<boolean> {
+  const id = await api.askOwner(runId, v.category, v.detail).catch(() => null);
+  if (!id) return false;
+  while (!signal?.aborted) {
+    const answer = await api.ownerAnswer(runId, id).catch(() => null);
+    if (answer === "approved") return true;
+    if (answer !== "pending") return false;
+    await sleep(pollMs, signal);
+  }
+  return false;
+}
+
+// Claude Code's working folder for one run: new, empty and read-only, so Claude Code never finds anything there to read
+// or run without asking the runner, and no approved step can leave a file or link there. Removed after the run.
+export async function makeScratch(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "crew-mac-"));
+  await chmod(dir, 0o500);
+  return dir;
+}
+
+export type ComputerRunOptions = {
+  timeoutMs: number; bin?: string; signal?: AbortSignal; home?: string; aliveMs?: number;
+  launch?: { command: string; args: string[]; env?: Record<string, string> };
+};
+
+// Aborts `stop` once the server says the run is no longer running (the owner switched @mac off, or it was cancelled).
+// A network error or an older server (no answer) is not a stop. Returns the function that ends the watch.
+export function watchRun(api: Pick<RunnerApi, "alive">, runId: string, stop: AbortController, everyMs = ALIVE_MS): () => void {
+  let busy = false;
+  const timer = setInterval(() => {
+    if (busy || stop.signal.aborted) return;
+    busy = true;
+    api.alive(runId).catch(() => null).then((running) => {
+      busy = false;
+      if (running === false) stop.abort();
+    });
+  }, everyMs);
+  return () => clearInterval(timer);
+}
+
+// One @mac run: the workspace folder, Claude Code's own tools, every decision written to the run's action log.
+export async function runComputer(api: Ask, pkg: Claimed, sink: (events: RunEvent[]) => Promise<void>, opts: ComputerRunOptions): Promise<Outcome> {
+  const slug = pkg.computer?.workspace_slug;
+  if (!slug) return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  let f;
+  let scratch;
+  try {
+    f = computerFolders(slug, opts.home);
+    await prepareWorkspaceFolder(f);
+    scratch = await makeScratch();
+  } catch {
+    return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  }
+  // One signal for Ctrl+C and for the owner's off switch.
+  const stop = new AbortController();
+  const onOuter = () => stop.abort();
+  if (opts.signal?.aborted) stop.abort();
+  else opts.signal?.addEventListener("abort", onOuter, { once: true });
+  const unwatch = watchRun(api, pkg.run_id, stop, opts.aliveMs);
+  // Every decision goes into the run's action log. A step is allowed only once its record is saved; a refusal is
+  // recorded as well as possible (refusing never needs the record to land).
+  const record = async (output: Record<string, unknown>): Promise<boolean> => {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        await sink([{ type: "step", kind: "tool", name: "permission", output }]);
+        return true;
+      } catch {
+        if (stop.signal.aborted) return false;
+      }
+    }
+    return false;
+  };
+  const decide = async (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>): Promise<boolean> => {
+    const v = judge(f, p, calls);
+    const why = v.kind === "allow" ? {} : v.kind === "deny" ? { reason: v.reason } : { asked: v.category, detail: v.detail };
+    const allowed = (v.kind === "allow" || (v.kind === "ask" && (await ownerSaysYes(api, pkg.run_id, v, stop.signal))))
+      && (await record({ decision: "allowed", ...why }));
+    if (!allowed) await record({ decision: "refused", ...why });
+    return allowed;
+  };
+  const systemPrompt = `${computerPrompt(f, slug)}\n\nWorkspace guidance (from CrewCortex):\n${pkg.instructions}`;
+  try {
+    return await runAcp("claude", pkg, sink, {
+      timeoutMs: opts.timeoutMs,
+      bin: opts.bin,
+      signal: stop.signal,
+      launch: opts.launch,
+      // No additional directories: Claude Code then asks the runner about everything outside the scratch folder (the
+      // workspace folder, Downloads and dev projects included), instead of approving reads and read-only commands by itself.
+      computer: { cwd: scratch, additionalDirectories: [], systemPrompt, decide },
+    });
+  } finally {
+    unwatch();
+    await chmod(scratch, 0o700).then(() => rm(scratch, { recursive: true, force: true })).catch(() => undefined);
+    opts.signal?.removeEventListener("abort", onOuter);
+  }
+}