dahrk-node 0.1.6 → 0.1.8

package/dist/main.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 // src/main.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync5, realpathSync as realpathSync3, writeFileSync as writeFileSync7 } from "fs";
+import { execFileSync as execFileSync7 } from "child_process";
+import { existsSync as existsSync7, realpathSync as realpathSync3 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { homedir as homedir4 } from "os";
-import { basename, join as join9 } from "path";
+import { homedir as homedir5, platform as osPlatform4 } from "os";
+import { basename, join as join10 } from "path";
 import { pathToFileURL } from "url";
 
 // ../../packages/edge/src/ws-client.ts
@@ -640,7 +641,7 @@ function createClaudeRunner() {
         maxTurns: MAX_TURNS,
         includePartialMessages: false
       };
-      const exit = ctx.config.exit ?? "gate";
+      const exit = ctx.config.exit ?? "either";
       const wantsTool = exit === "tool" || exit === "either";
       const mailbox = new ManagedMailbox();
       const q = query({ prompt: mailbox, options });
@@ -914,7 +915,7 @@ function createCodexRunner() {
     async runInteractive(ctx, turns, onTrace) {
       const emit = makeEmit("codex", onTrace);
       const t = openThread(ctx);
-      const exit = ctx.config.exit ?? "gate";
+      const exit = ctx.config.exit ?? "either";
       if (exit === "tool" || exit === "either") {
         process.stderr.write("codex-adapter: interactive tool-exit not supported in M4; using gate exit\n");
       }
@@ -1163,7 +1164,7 @@ function createPiRunner(deps = {}) {
       const emit = makeEmit("pi", onTrace);
       const s = await openSession(ctx);
       const state = newPiBufferState();
-      const exit = ctx.config.exit ?? "gate";
+      const exit = ctx.config.exit ?? "either";
       const wantsTool = exit === "tool" || exit === "either";
       let toolFired = false;
       let toolSummary = null;
@@ -2720,6 +2721,15 @@ async function startEdgeNode(opts) {
         startHeartbeat(ws, msg.heartbeatMs);
       }
       log(`EDGE_WELCOMED:${msg.name} tenant=${msg.tenantId} credentialMode=${msg.credentialMode}`);
+      try {
+        opts.onEnrolled?.({
+          name: msg.name,
+          tenantId: msg.tenantId,
+          credentialMode: msg.credentialMode
+        });
+      } catch (e) {
+        log(`EDGE_ENROL_PERSIST_FAILED ${e.message}`);
+      }
       return;
     }
     if (msg.type === "blob-put-url") {
@@ -3009,7 +3019,7 @@ function probeHub(opts) {
 
 // src/cli.ts
 import { parseArgs } from "util";
-var COMMANDS = /* @__PURE__ */ new Set(["start", "run", "service", "doctor", "update"]);
+var COMMANDS = /* @__PURE__ */ new Set(["start", "run", "service", "doctor", "status", "update"]);
 var isCommand = (s) => COMMANDS.has(s);
 function parseCli(argv) {
   const [first, ...rest] = argv;
@@ -3145,15 +3155,18 @@ function parseUpdate(flagArgs) {
 function usage(bin, command) {
   if (command === "start") {
     return [
-      `Usage: ${bin} start --token <token> [options]`,
+      `Usage: ${bin} start [--token <token>] [options]`,
       "",
       "Run the edge node: dial the hub over WebSocket and serve Jobs in git worktrees.",
       "",
+      "A token is needed only to enrol. Once the hub accepts it, it is cached in ~/.dahrk/node.json and",
+      "every later `start` re-attaches without one. Pass --token again to re-enrol (rotated token, new pool).",
+      "",
       "Options:",
-      "  --token <token>    Enrolment token (required; or set DAHRK_ENROL_TOKEN).",
+      "  --token <token>    Enrolment token (first run only; or set DAHRK_ENROL_TOKEN).",
       "  --hub-url <url>    Hub WebSocket URL (or set DAHRK_HUB_URL).",
       "  --name <name>      Display-name override (else the hub assigns one).",
-      "  --ephemeral        Do not persist a node id; mint a throwaway one (CI / one-shot)."
+      "  --ephemeral        Do not persist (or read) node id and token; mint a throwaway id (CI / one-shot)."
     ].join("\n");
   }
   if (command === "run") {
@@ -3201,6 +3214,18 @@ function usage(bin, command) {
       "  --hub-url <url>    Hub WebSocket URL to reach (or set DAHRK_HUB_URL)."
     ].join("\n");
   }
+  if (command === "status") {
+    return [
+      `Usage: ${bin} status`,
+      "",
+      "Report this node's local state: whether it is enrolled (and as whom), its node id, the runtimes",
+      "it can serve, and whether the always-on service is installed and actually running.",
+      "",
+      "Local only - it dials nothing, so it is instant and works offline. Use `doctor` to check the hub",
+      "is reachable and the token still valid. Exits non-zero only when the service is installed but",
+      "not running, so it works as a health check in a script."
+    ].join("\n");
+  }
   if (command === "update") {
     return [
       `Usage: ${bin} update [--check]`,
@@ -3217,9 +3242,10 @@ function usage(bin, command) {
     `Usage: ${bin} <command> [options]`,
     "",
     "Commands:",
-    "  start     Run the edge node (default). Needs a --token and a hub URL.",
+    "  start     Run the edge node (default). Needs a --token to enrol; cached thereafter.",
     "  run       Run a workflow locally (engine-backed), e.g. `run preflight`.",
     "  service   Install/uninstall the node as an always-on service (launchd/systemd).",
+    "  status    Is this node enrolled, and is the service running? (local, dials nothing)",
     "  doctor    Preflight checks: Node, runtimes, hub reachability, token validity.",
     "  update    Update the client to the latest release (or print how for your channel).",
     "  version   Print the client version.",
@@ -3578,9 +3604,10 @@ function gatherHostFacts(repoPath) {
 
 // src/service.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, realpathSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync6, realpathSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir3, platform as osPlatform3, userInfo } from "os";
 import { join as join8 } from "path";
+var UNIT_FILE_MODE = 384;
 var LAUNCHD_LABEL = "ai.dahrk.node";
 var SYSTEMD_UNIT = "dahrk-node.service";
 function detectManager(plat) {
@@ -3699,6 +3726,24 @@ function buildPlan(inputs) {
     logHint: `journalctl --user -u ${SYSTEMD_UNIT} -f`
   };
 }
+function unitPath(manager, homeDir) {
+  return manager === "launchd" ? join8(homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`) : join8(homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+}
+function statusCommand(manager) {
+  return manager === "launchd" ? ["launchctl", "list", LAUNCHD_LABEL] : ["systemctl", "--user", "show", SYSTEMD_UNIT, "-p", "ActiveState", "-p", "MainPID"];
+}
+function parseServiceStatus(manager, unitExists, probe2) {
+  if (!unitExists) return { installed: false, running: false };
+  if (probe2.code !== 0) return { installed: true, running: false };
+  if (manager === "launchd") {
+    const pid2 = Number(/"PID"\s*=\s*(\d+);/.exec(probe2.stdout)?.[1]);
+    return pid2 > 0 ? { installed: true, running: true, pid: pid2 } : { installed: true, running: false };
+  }
+  const active = /^ActiveState=(.*)$/m.exec(probe2.stdout)?.[1]?.trim();
+  const pid = Number(/^MainPID=(\d+)$/m.exec(probe2.stdout)?.[1]);
+  const running = active === "active";
+  return running && pid > 0 ? { installed: true, running: true, pid } : { installed: true, running };
+}
 function printUnsupported(out) {
   out("dahrk service is supported on macOS (launchd) and Linux (systemd) only.");
   out("On other platforms, run the node under a process manager such as pm2 (see the README).");
@@ -3797,17 +3842,39 @@ function resolveScriptPath() {
     return argv1;
   }
 }
+function stableNodeBin(execPath, realpath) {
+  const m = /^(?<prefix>.*)\/Cellar\/(?<formula>node(?:@[\d.]+)?)\/[^/]+\/bin\/node$/.exec(execPath);
+  const { prefix, formula } = m?.groups ?? {};
+  if (!prefix || !formula) return execPath;
+  const candidates = [`${prefix}/opt/${formula}/bin/node`, `${prefix}/bin/node`];
+  return candidates.find((c) => realpath(c) === execPath) ?? execPath;
+}
+var realpathOrUndefined = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return void 0;
+  }
+};
 var defaultDeps3 = () => ({
   platform: osPlatform3(),
   homeDir: homedir3(),
-  nodeBin: process.execPath,
+  // Not `process.execPath` raw: that is the versioned Homebrew Cellar path, which the next
+  // `brew upgrade node` deletes out from under the unit. See `stableNodeBin`.
+  nodeBin: stableNodeBin(process.execPath, realpathOrUndefined),
   scriptPath: resolveScriptPath(),
   logDir: join8(process.env.DAHRK_STATE_DIR ?? join8(homedir3(), ".dahrk"), "logs"),
   // Snapshot the operator's PATH at install time so the daemon finds git + the runtime CLIs (Homebrew /
   // npm-global bins) that a supervisor's minimal PATH would otherwise hide.
   pathEnv: process.env.PATH,
   mkdirp: (dir) => void mkdirSync6(dir, { recursive: true }),
-  writeFile: (path, content) => writeFileSync6(path, content),
+  // The unit's environment block carries the enrolment token, so the file is a secret: write it
+  // owner-only. `writeFileSync`'s `mode` applies only when it CREATES the file, so chmod explicitly
+  // too - re-installing over a unit an older client left at 0644 must tighten it, not keep it.
+  writeFile: (path, content) => {
+    writeFileSync6(path, content, { mode: UNIT_FILE_MODE });
+    chmodSync(path, UNIT_FILE_MODE);
+  },
   removeFile: (path) => rmSync4(path, { force: true }),
   fileExists: (path) => existsSync5(path),
   run: (argv) => {
@@ -3947,47 +4014,149 @@ var defaultDeps4 = () => ({
 `)
 });
 
-// src/main.ts
-var CLIENT_VERSION = "0.1.6";
-var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
-var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-var RUNTIMES = ["claude-code", "codex", "pi"];
-var isRuntime = (r) => RUNTIMES.includes(r);
+// src/state.ts
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join9 } from "path";
+var STRING_FIELDS = ["nodeId", "enrolToken", "name", "tenantId"];
+var FILE_MODE = 384;
+var DIR_MODE = 448;
 function stateDir(env) {
   return env.DAHRK_STATE_DIR ?? join9(homedir4(), ".dahrk");
 }
 function legacyStateDir(env) {
   return env.DAHRK_STATE_DIR ? void 0 : join9(homedir4(), ".skakel");
 }
-function readNodeId(file) {
-  if (!existsSync6(file)) return void 0;
+function stateFile(env) {
+  return join9(stateDir(env), "node.json");
+}
+function readState(file) {
+  if (!existsSync6(file)) return {};
   try {
     const parsed = JSON.parse(readFileSync5(file, "utf8"));
-    if (typeof parsed.nodeId === "string" && parsed.nodeId) return parsed.nodeId;
+    const state = {};
+    for (const key of STRING_FIELDS) {
+      const value = parsed[key];
+      if (typeof value === "string" && value) state[key] = value;
+    }
+    return state;
   } catch {
+    return {};
   }
-  return void 0;
 }
+function writeState(env, patch) {
+  const dir = stateDir(env);
+  const file = stateFile(env);
+  try {
+    mkdirSync7(dir, { recursive: true, mode: DIR_MODE });
+    const next = { ...readState(file), ...patch };
+    writeFileSync7(file, `${JSON.stringify(next, null, 2)}
+`, { mode: FILE_MODE });
+    chmodSync2(file, FILE_MODE);
+  } catch (e) {
+    console.warn(`could not persist node state to ${file}: ${e.message}`);
+  }
+}
+function readPersistedToken(env) {
+  return readState(stateFile(env)).enrolToken;
+}
+function persistEnrolment(env, enrolment) {
+  const { token, name, tenantId } = enrolment;
+  if (!token) return;
+  const current = readState(stateFile(env));
+  const unchanged = current.enrolToken === token && (name === void 0 || current.name === name) && (tenantId === void 0 || current.tenantId === tenantId);
+  if (unchanged) return;
+  writeState(env, {
+    enrolToken: token,
+    ...name ? { name } : {},
+    ...tenantId ? { tenantId } : {}
+  });
+}
+function resolveEnrolToken(env, opts = {}) {
+  if (env.DAHRK_ENROL_TOKEN) return env.DAHRK_ENROL_TOKEN;
+  if (opts.ephemeral) return void 0;
+  return readPersistedToken(env);
+}
+
+// src/status.ts
+var bullet = (label, value) => `  ${label.padEnd(12)}${value}`;
+function renderStatus(f) {
+  const lines = ["dahrk status", ""];
+  const { nodeId, name, tenantId, enrolToken } = f.state;
+  if (enrolToken) {
+    lines.push(bullet("Enrolled", name ? `yes, as ${name}` : "yes"));
+    if (tenantId) lines.push(bullet("Tenant", tenantId));
+  } else if (f.envToken) {
+    lines.push(bullet("Enrolled", "yes, via DAHRK_ENROL_TOKEN (caches on the next successful start)"));
+  } else {
+    lines.push(bullet("Enrolled", "no - run `dahrk start --token <token>` once to enrol"));
+  }
+  lines.push(bullet("Node id", nodeId ?? "not yet minted (first `dahrk start` mints one)"));
+  lines.push(bullet("Client", f.clientVersion));
+  lines.push(bullet("Hub", f.hubUrl));
+  lines.push(
+    bullet(
+      "Runtimes",
+      f.runtimes.length > 0 ? f.runtimes.join(", ") : "none detected - this node will serve no Jobs (install claude / codex / pi)"
+    )
+  );
+  if (!f.service) {
+    lines.push(bullet("Service", "not supported on this host (run `dahrk start` under pm2 instead)"));
+  } else if (!f.service.installed) {
+    lines.push(bullet("Service", "not installed - run `dahrk service install` to run on boot"));
+  } else if (f.service.running) {
+    const pid = f.service.pid ? ` (pid ${f.service.pid})` : "";
+    lines.push(bullet("Service", `running${pid}`));
+  } else {
+    lines.push(bullet("Service", "INSTALLED BUT NOT RUNNING - it is failing to start or crash-looping"));
+    if (f.logHint) lines.push(bullet("", `check the logs: ${f.logHint}`));
+  }
+  lines.push("", `State file: ${f.stateFile}`);
+  return lines;
+}
+async function runStatus(inputs, deps) {
+  const manager = detectManager(deps.platform);
+  let service;
+  let logHint;
+  if (manager !== "unsupported") {
+    const unit = unitPath(manager, deps.homeDir);
+    const exists = deps.fileExists(unit);
+    const probe2 = exists ? deps.capture(statusCommand(manager)) : { code: 1, stdout: "" };
+    service = parseServiceStatus(manager, exists, probe2);
+    logHint = manager === "launchd" ? `tail -f ${deps.homeDir}/.dahrk/logs/node.err.log` : "journalctl --user -u dahrk-node.service -f";
+  }
+  const facts = {
+    clientVersion: inputs.clientVersion,
+    hubUrl: inputs.hubUrl,
+    stateFile: stateFile(deps.env),
+    state: readState(stateFile(deps.env)),
+    envToken: Boolean(deps.env.DAHRK_ENROL_TOKEN),
+    runtimes: await deps.detectRuntimes(),
+    ...service ? { service } : {},
+    ...logHint ? { logHint } : {}
+  };
+  for (const line of renderStatus(facts)) deps.out(line);
+  return service?.installed && !service.running ? 1 : 0;
+}
+
+// src/main.ts
+var CLIENT_VERSION = "0.1.8";
+var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
+var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+var RUNTIMES = ["claude-code", "codex", "pi"];
+var isRuntime = (r) => RUNTIMES.includes(r);
 function resolveNodeId(env, opts = {}) {
   if (env.DAHRK_NODE_ID) return env.DAHRK_NODE_ID;
   if (opts.ephemeral) return randomUUID3();
-  const dir = stateDir(env);
-  const file = join9(dir, "node.json");
-  const existing = readNodeId(file);
+  const existing = readState(stateFile(env)).nodeId;
   if (existing) return existing;
   const legacy = legacyStateDir(env);
   if (legacy) {
-    const legacyId = readNodeId(join9(legacy, "node.json"));
+    const legacyId = readState(join10(legacy, "node.json")).nodeId;
     if (legacyId) return legacyId;
   }
   const nodeId = randomUUID3();
-  try {
-    mkdirSync7(dir, { recursive: true });
-    writeFileSync7(file, `${JSON.stringify({ nodeId }, null, 2)}
-`);
-  } catch (e) {
-    console.warn(`could not persist node id to ${file}: ${e.message}`);
-  }
+  writeState(env, { nodeId });
   return nodeId;
 }
 async function resolveRuntimes(env) {
@@ -4053,6 +4222,8 @@ function envWithFlags(env, flags) {
 async function start(flags) {
   const env = envWithFlags(process.env, flags);
   const nodeId = resolveNodeId(env, { ephemeral: flags.ephemeral });
+  const token = resolveEnrolToken(env, { ephemeral: flags.ephemeral });
+  if (token) env.DAHRK_ENROL_TOKEN = token;
   const runtimes = await resolveRuntimes(env);
   if (runtimes.length === 0) {
     console.warn(
@@ -4060,7 +4231,34 @@ async function start(flags) {
     );
   }
   const resolved = { nodeId, runtimes, clientVersion: CLIENT_VERSION };
-  await startEdgeNode(buildEdgeOptions(env, resolved));
+  const persist = token !== void 0 && !flags.ephemeral;
+  await startEdgeNode({
+    ...buildEdgeOptions(env, resolved),
+    ...persist ? {
+      onEnrolled: (welcome) => persistEnrolment(env, { token, name: welcome.name, tenantId: welcome.tenantId })
+    } : {}
+  });
+}
+function statusDeps(env) {
+  return {
+    platform: osPlatform4(),
+    homeDir: homedir5(),
+    env,
+    detectRuntimes: () => resolveRuntimes(env),
+    fileExists: (path) => existsSync7(path),
+    capture: (argv) => {
+      const [cmd, ...args] = argv;
+      try {
+        const stdout = execFileSync7(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        return { code: 0, stdout };
+      } catch (e) {
+        const status = e.status;
+        return { code: typeof status === "number" ? status : 1, stdout: "" };
+      }
+    },
+    out: (line) => void process.stdout.write(`${line}
+`)
+  };
 }
 var KNOWN_WORKFLOWS = ["preflight"];
 async function runWorkflow(flags) {
@@ -4072,7 +4270,7 @@ async function runWorkflow(flags) {
   }
   const env = applyEnvAliases(process.env);
   const hubUrl = flags.hubUrl ?? env.DAHRK_HUB_URL;
-  const token = flags.token ?? env.DAHRK_ENROL_TOKEN;
+  const token = flags.token ?? resolveEnrolToken(env);
   return runPreflight({
     ...flags.repo ? { repoPath: flags.repo } : {},
     ...hubUrl ? { hubUrl } : {},
@@ -4101,11 +4299,21 @@ async function main() {
       const env = envWithFlags(process.env, parsed.flags);
       process.exitCode = await runDoctor({
         hubUrl: env.DAHRK_HUB_URL,
-        token: env.DAHRK_ENROL_TOKEN,
+        // Same resolution as `start`, so doctor checks the token the node would actually present:
+        // the flag/env if given, else the one cached by the last successful enrolment.
+        token: resolveEnrolToken(env),
         clientVersion: CLIENT_VERSION
       });
       break;
     }
+    case "status": {
+      const env = envWithFlags(process.env, parsed.flags);
+      process.exitCode = await runStatus(
+        { clientVersion: CLIENT_VERSION, hubUrl: env.DAHRK_HUB_URL ?? DEFAULT_HUB_URL },
+        statusDeps(env)
+      );
+      break;
+    }
     case "run":
       process.exitCode = await runWorkflow(parsed.flags);
       break;
@@ -4115,7 +4323,7 @@ async function main() {
         break;
       }
       const env = applyEnvAliases(process.env);
-      const token = parsed.flags.token ?? env.DAHRK_ENROL_TOKEN;
+      const token = parsed.flags.token ?? resolveEnrolToken(env);
       const name = parsed.flags.name ?? env.DAHRK_NODE_NAME;
       const hubUrl = parsed.flags.hubUrl ?? env.DAHRK_HUB_URL;
       process.exitCode = await runServiceInstall({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dahrk-node",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",