headlesscode 1.2.1 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "headlesscode",
-	"version": "1.2.1",
+	"version": "1.3.0",
 	"description": "Standalone headless coding-agent harness: runs the Zoo Code agent loop (prompts, tools, modes) without a VS Code UI, driven by CLI, HTTP, and parallel worktree orchestration.",
 	"license": "Apache-2.0",
 	"repository": {
@@ -17,7 +17,7 @@
 	],
 	"type": "module",
 	"engines": {
-		"node": ">=18"
+		"node": ">=22.19"
 	},
 	"bin": {
 		"headlesscode": "bin/headlesscode.mjs"
@@ -41,14 +41,18 @@
 		"dev": "tsx src/index.ts",
 		"start": "tsx src/cli.ts",
 		"cli": "tsx src/cli.ts",
+		"monitor:pilot": "tsx scripts/monitor-pilot/run.ts",
+		"rsi:promote-curriculum": "tsx src/rsi/promote-curriculum.ts",
 		"test": "node scripts/run-tests.mjs",
 		"prepublishOnly": "npm ci && npm test"
 	},
 	"dependencies": {
+		"@aws-sdk/client-s3": "^3.1142.0",
 		"@modelcontextprotocol/sdk": "^1.30.0",
 		"@octokit/auth-app": "^8.2.0",
 		"fastest-levenshtein": "^1.0.16",
 		"p-wait-for": "^5.0.2",
+		"pg": "^8.23.0",
 		"playwright": "^1.62.1",
 		"simple-git": "^3.36.0",
 		"tsx": "^4.19.0",
@@ -58,6 +62,7 @@
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@types/node": "^22.10.0"
+		"@types/node": "^22.10.0",
+		"@types/pg": "^8.23.1"
 	}
 }

package/shared/openshell/headlesscode-openrouter.yaml

@@ -0,0 +1,21 @@
+id: headlesscode-openrouter
+display_name: HeadlessCode OpenRouter
+description: OpenRouter inference access for HeadlessCode workers running in Node.js
+category: inference
+inference_capable: true
+credentials:
+  - name: api_key
+    description: OpenRouter API key
+    env_vars: [HEADLESSCODE_OPENROUTER_API_KEY]
+    required: true
+    auth_style: bearer
+    header_name: authorization
+discovery:
+  credentials: [api_key]
+endpoints:
+  - host: openrouter.ai
+    port: 443
+    protocol: rest
+    access: read-write
+    enforcement: enforce
+binaries: [/usr/local/bin/node]

package/shared/openshell/headlesscode-policy.yaml

@@ -0,0 +1,21 @@
+version: 1
+filesystem_policy:
+  include_workdir: true
+  read_only:
+    - /usr
+    - /lib
+    - /lib64
+    - /etc
+    - /proc
+    - /dev/urandom
+    - /var/log
+  read_write:
+    - /sandbox
+    - /tmp
+    - /dev/null
+landlock:
+  compatibility: hard_requirement
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+network_policies: {}

package/src/cli.ts

@@ -43,7 +43,7 @@ import { analyzeCliMain } from "./orchestrator/analyze-cli.js"
 import { costHistoryCliMain } from "./orchestrator/cost-history-cli.js"
 import { resolvePermissions, type PermissionsConfig } from "./permissions/config.js"
 import { resolveModelForMode, resolveReasoningEffortForMode } from "./config/mode-models.js"
-import { improveMain } from "./rsi/controller.js"
+import { openShellSessionMain } from "./cloud/openshell-session.js"
 
 const VERSION = "0.1.0"
 
@@ -187,6 +187,9 @@ Usage:
   headlesscode --dry-run [options]          # build system prompt + validate config, no LLM call
 
 Subcommands:
+  headlesscode openshell-session --repo <path> --task <text> --policy <path>
+              Run one task in an OpenShell sandbox and keep its Git worktree
+              for review. See \`openshell-session --help\` for options.
   headlesscode improve --repo <path> [--model <id>] [--population <n>] [--dry-run]
               Run a bounded recursive self-improvement generation. Candidates
               use isolated git worktrees; evaluator/scoring paths are protected.
@@ -721,10 +724,73 @@ export function parseArgs(argv: string[]): { options: CliOptions; error?: string
 }
 
 export async function main(argv: string[] = process.argv.slice(2)): Promise<number> {
+	if (argv[0] === "openshell-review-session" || argv[0] === "openshell-qa-session") {
+		let payload: Record<string, unknown>
+		try {
+			payload = JSON.parse(Buffer.from(argv[1] ?? "", "base64url").toString("utf8")) as Record<string, unknown>
+		} catch {
+			process.stderr.write("headlesscode: invalid OpenShell session payload\n")
+			return 2
+		}
+		if (argv[0] === "openshell-review-session") {
+			const { runReview } = await import("./orchestrator/reviewer.js")
+			const result = await runReview(payload as unknown as Parameters<typeof runReview>[0])
+			process.stdout.write(`HEADLESSCODE_RESULT_JSON:${JSON.stringify(result)}\n`)
+			return 0
+		}
+		const { runQa } = await import("./qa/qa.js")
+		const result = await runQa(payload as unknown as Parameters<typeof runQa>[0])
+		process.stdout.write(`HEADLESSCODE_RESULT_JSON:${JSON.stringify(result)}\n`)
+		return 0
+	}
+	if (argv[0] === "openshell-worker") {
+		const { openShellWorkerMain } = await import("./cloud/openshell-worker.js")
+		return openShellWorkerMain(argv.slice(1))
+	}
+	if (argv[0] === "openshell-session") {
+		return openShellSessionMain(argv.slice(1))
+	}
+	if (argv[0] === "rsi-worker") {
+		const { rsiWorkerMain } = await import("./rsi/worker.js")
+		return rsiWorkerMain()
+	}
+	if (argv[0] === "rsi-train-model") {
+		const { parseRsiArgs } = await import("./rsi/config.js")
+		const { readArchive } = await import("./rsi/archive.js")
+		const { PostgresRsiJobQueue, fleetQueuePolicy } = await import("./rsi/postgres-queue.js")
+		const { runBoundedModelCandidate } = await import("./rsi/model-training.js")
+		const parsed = parseRsiArgs(argv.slice(1))
+		if (parsed.help) {
+			process.stdout.write("Usage: headlesscode rsi-train-model --repo <path> --archive-dir <path> --resume <run-id> --model-candidate-id <id>\nThe registered worker must use an OpenShell training image and a local Hugging Face checkpoint.\n")
+			return 0
+		}
+		if (parsed.error || !parsed.config || !parsed.config.resumeRunId || !parsed.config.modelCandidateId || parsed.config.dryRun) {
+			process.stderr.write(`headlesscode rsi-train-model: ${parsed.error ?? "--resume and --model-candidate-id are required; dry-run is unsupported"}\n`)
+			return 2
+		}
+		const config = parsed.config
+		const archive = await readArchive(config.archiveDir)
+		const run = archive.activeRuns.find((entry) => entry.runId === config.resumeRunId) ?? archive.runs.find((entry) => entry.runId === config.resumeRunId)
+		if (!run) {
+			process.stderr.write(`headlesscode rsi-train-model: RSI run not found in ${config.archiveDir}\n`)
+			return 2
+		}
+		const policy = fleetQueuePolicy(process.env.HEADLESSCODE_RSI_QUEUE_NAME?.trim() || "rsi-default", config.maxConcurrent, process.env)
+		const queue = PostgresRsiJobQueue.fromEnvironment(policy, process.env)
+		try {
+			await queue.migrate()
+			const model = await runBoundedModelCandidate(config, run, queue, config.modelCandidateId!)
+			process.stdout.write(`[rsi-model] ${model.id}: ${model.status}; eligible=${model.eligibleForSelection === true}\n`)
+			return model.eligibleForSelection ? 0 : 1
+		} finally {
+			await queue.close()
+		}
+	}
 	// Bounded recursive self-improvement: the supervisor owns the evaluator,
 	// archive, and selection logic while each candidate runs in its own
 	// worktree. See docs/recursive-self-improvement.md.
 	if (argv[0] === "improve") {
+		const { improveMain } = await import("./rsi/controller.js")
 		return improveMain(argv.slice(1))
 	}
 
@@ -1019,9 +1085,17 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 		}
 	}
 
-	// ── real run: API key required ────────────────────────────────────────────
+	// ── real run: OpenRouter key required unless this mode is local ────────────
+	const codeModeBackend = process.env.HEADLESSCODE_CODE_MODE_BACKEND ?? "openrouter"
+	const localBackendModes = new Set(
+		(process.env.HEADLESSCODE_LOCAL_BACKEND_MODES ?? "code")
+			.split(",")
+			.map((s) => s.trim())
+			.filter(Boolean),
+	)
+	const useLocalCodeBackend = localBackendModes.has(options.mode) && codeModeBackend === "ollama"
 	const apiKey = process.env.HEADLESSCODE_OPENROUTER_API_KEY
-	if (!apiKey) {
+	if (!apiKey && !useLocalCodeBackend) {
 		process.stderr.write(
 			"headlesscode: HEADLESSCODE_OPENROUTER_API_KEY is not set.\n" +
 				"  Export it (e.g. export HEADLESSCODE_OPENROUTER_API_KEY=sk-or-...) or use --dry-run to\n" +
@@ -1068,21 +1142,6 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 		env: process.env,
 	})
 
-	// Generalized 2026-08-21 (issue #142) beyond the original `code`-only
-	// scope (plans/local-dual-model-code-agent.md, D2) — real need: two
-	// separate local daemons on two different GPUs (a coder model and a
-	// review model), each needing its own mode -> URL/model mapping.
-	// HEADLESSCODE_LOCAL_BACKEND_MODES defaults to "code" alone, so
-	// nobody's existing setup changes behavior unless they opt in.
-	const codeModeBackend = process.env.HEADLESSCODE_CODE_MODE_BACKEND ?? "openrouter"
-	const localBackendModes = new Set(
-		(process.env.HEADLESSCODE_LOCAL_BACKEND_MODES ?? "code")
-			.split(",")
-			.map((s) => s.trim())
-			.filter(Boolean),
-	)
-	const useLocalCodeBackend = localBackendModes.has(options.mode) && codeModeBackend === "ollama"
-
 	// The local daemon's own proxy (ollama_shim.py) deliberately runs a 600s
 	// upstream request timeout — its own comment documents why: a shorter
 	// shim timeout was once found to cut off calls before the harness's own

package/src/cloud/openshell-preflight.ts

@@ -0,0 +1,16 @@
+import { spawnSync } from "node:child_process"
+import * as fs from "node:fs"
+
+export function openshellPreflight(options: { requireOpenRouterCredential?: boolean } = {}): string | undefined {
+	const policy = process.env.HEADLESSCODE_OPENSHELL_POLICY
+	if (!policy || !fs.existsSync(policy)) return "set HEADLESSCODE_OPENSHELL_POLICY to an existing base policy YAML"
+	if (options.requireOpenRouterCredential !== false && !process.env.HEADLESSCODE_OPENROUTER_API_KEY) return "set HEADLESSCODE_OPENROUTER_API_KEY so OpenShell can provide the imported credential profile"
+	const version = spawnSync("openshell", ["--version"], { encoding: "utf8", timeout: 5000 })
+	if (version.error || version.status !== 0) return "OpenShell CLI is unavailable"
+	const gateway = spawnSync("openshell", ["gateway", "info"], { encoding: "utf8", timeout: 10000 })
+	const output = `${gateway.stdout ?? ""}${gateway.stderr ?? ""}`
+	if (gateway.error || gateway.status !== 0 || !/Status:\s+healthy/i.test(output)) {
+		return `OpenShell gateway is not healthy${output.trim() ? ": " + output.trim() : ""}`
+	}
+	return undefined
+}