infinicode 2.8.57 → 2.8.59

package/dist/kernel/federation/dashboard-html.js

@@ -5530,6 +5530,10 @@ button.act:disabled{opacity:0.5;cursor:default;}
       if(greetings && document.activeElement!==greetings) greetings.value=(device.greeting_phrases||[]).join(String.fromCharCode(10));
       var note=$('pk-device-note');
       if(note){
+        if(!device.id && n && n.connected){
+          note.textContent='mesh connected; scheduler identity is bootstrapping or failed';
+          return;
+        }
         var source=inv.source||'robot heartbeat', counts=(inv.video||[]).length+'/'+(inv.audio_input||[]).length+'/'+(inv.audio_output||[]).length;
         note.textContent=hasRealInventory(inv) ? ('inventory from '+source+' · camera/mic/speaker '+counts) : (device.id ? 'no real hardware inventory reported yet · restart vision-agent + preview-agent on this robot' : 'waiting for robot heartbeat inventory');
       }

package/dist/kernel/federation/self-update.js

@@ -35,7 +35,22 @@ export async function performSelfUpdate(opts = {}) {
     try {
         // Use npm.cmd on Windows so we never need a shell (no injection surface).
         const bin = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-        const res = await execa(bin, ['install', '-g', spec], { all: true, timeout: 300_000 });
+        const args = ['install', '-g', spec];
+        let res;
+        try {
+            res = await execa(bin, args, { all: true, timeout: 300_000 });
+        }
+        catch (err) {
+            const message = String(err.all ?? err.message ?? err);
+            const unprivileged = process.platform !== 'win32' && process.getuid?.() !== 0;
+            if (!unprivileged || !/\bEACCES\b|permission denied/i.test(message))
+                throw err;
+            // RoboPark systemd services normally run as root. This fallback also
+            // supports an operator-launched satellite when sudo is intentionally
+            // configured non-interactively; it never prompts or shells out.
+            info('[update] global npm directory is root-owned; retrying with sudo -n…');
+            res = await execa('sudo', ['-n', bin, ...args], { all: true, timeout: 300_000 });
+        }
         const tail = String(res.all ?? res.stdout ?? '').split('\n').filter(Boolean).slice(-2).join(' ').trim();
         info(`[update] installed ${spec}${tail ? ' — ' + tail : ''}`);
     }

package/dist/kernel/federation/transport-http.d.ts

@@ -63,6 +63,10 @@ export declare class MeshServer {
      *  (browsers, which can't set headers on navigation or EventSource). */
     private presentedToken;
     private authOk;
+    /** A robot uses this header only when it talks to the hub's scheduler proxy.
+     * Its device token remains the Authorization header and is forwarded to the
+     * scheduler. Requiring both keeps arbitrary Tailnet callers out. */
+    private schedulerProxyAuthOk;
     private handle;
     private openStream;
     private readBody;

package/dist/kernel/federation/transport-http.js

@@ -106,8 +106,24 @@ export class MeshServer {
         this.readBody(req)
             .then(async (body) => {
             const headers = { 'content-type': req.headers['content-type'] ?? 'application/json' };
+            const meshProxyToken = req.headers['x-robopark-mesh-token'];
+            if (typeof meshProxyToken === 'string') {
+                // The scheduler uses this only for device bootstrap. The mesh server
+                // has already validated it before this proxy method is reached.
+                headers['x-robopark-mesh-token'] = meshProxyToken;
+            }
             if (this.opts.schedulerToken)
                 headers['authorization'] = `Bearer ${this.opts.schedulerToken}`;
+            else {
+                const inbound = req.headers.authorization;
+                const presented = this.presentedToken(req);
+                const isMeshToken = this.opts.token && presented && safeEqual(presented, this.opts.token);
+                // Robot device tokens must reach the scheduler unchanged. Mesh tokens
+                // authenticate the proxy itself and are not scheduler credentials.
+                if (!isMeshToken && typeof inbound === 'string' && inbound.startsWith('Bearer ')) {
+                    headers.authorization = inbound;
+                }
+            }
             const upstream = await fetch(target, {
                 method: req.method,
                 headers,
@@ -250,6 +266,15 @@ export class MeshServer {
         const presented = this.presentedToken(req);
         return presented !== undefined && safeEqual(presented, this.opts.token);
     }
+    /** A robot uses this header only when it talks to the hub's scheduler proxy.
+     * Its device token remains the Authorization header and is forwarded to the
+     * scheduler. Requiring both keeps arbitrary Tailnet callers out. */
+    schedulerProxyAuthOk(req, path) {
+        if (!path.startsWith('/robopark/api/') || !this.opts.token)
+            return false;
+        const presented = req.headers['x-robopark-mesh-token'];
+        return typeof presented === 'string' && safeEqual(presented, this.opts.token);
+    }
     handle(req, res) {
         const url = req.url ?? '/';
         const path = url.split('?', 1)[0];
@@ -257,7 +282,7 @@ export class MeshServer {
             res.writeHead(204).end();
             return;
         }
-        if (!this.authOk(req)) {
+        if (!this.authOk(req) && !this.schedulerProxyAuthOk(req, path)) {
             res.writeHead(401).end('unauthorized');
             return;
         }

package/dist/robopark/robot-runtime.js

@@ -105,7 +105,18 @@ export async function roboparkRobotRuntime(opts) {
         previewArgs.push('--robovision-url', 'http://127.0.0.1:5000');
     if (opts.enrollmentToken)
         previewArgs.push('--enrollment-token', opts.enrollmentToken);
-    const preview = { label: 'preview', command: process.execPath, args: previewArgs };
+    const preview = {
+        label: 'preview',
+        command: process.execPath,
+        args: previewArgs,
+        // Tailscale scheduler access goes through the authenticated hub proxy.
+        // Keep this in the child environment, never in the persisted robot config.
+        env: {
+            ROBOPARK_MESH_TOKEN: opts.token,
+            // Inventory changes should reach the Control Center promptly.
+            HEARTBEAT_INTERVAL: '5',
+        },
+    };
     const start = (entry) => {
         const child = spawn(entry.command, entry.args, {
             env: { ...process.env, ...entry.env, ROBOPARK_ROBOT_RUNTIME: '1' },
@@ -160,20 +171,18 @@ export async function roboparkRobotRuntime(opts) {
         start(children[0]);
         if (opts.vision !== false) {
             start(children[1]);
-            if (!await waitForVision()) {
-                console.error(chalk.red('  RoboVision did not recover after the mesh update; retrying in 5s'));
-                // Stop the partially restarted stack before retrying. Otherwise a
-                // second mesh child would collide with the existing listener.
-                await Promise.all([...children, preview].map(stopChild));
-                recycling = false;
-                setTimeout(() => { if (!stopping)
-                    void recycleAfterMeshUpdate(); }, RESTART_DELAY_MS);
-                return;
-            }
         }
         start(preview);
         recycling = false;
         console.log(chalk.green('  robot runtime updated and healthy'));
+        if (opts.vision !== false) {
+            void waitForVision().then(ready => {
+                if (!stopping)
+                    console.log(ready
+                        ? chalk.green('  RoboVision camera/audio inventory ready')
+                        : chalk.yellow('  RoboVision is degraded; preview heartbeat remains online and will retry'));
+            });
+        }
     };
     console.log(chalk.bold('\n  robopark robot up'));
     console.log(chalk.dim('  ' + '─'.repeat(52)));
@@ -186,21 +195,20 @@ export async function roboparkRobotRuntime(opts) {
         console.log(chalk.dim('  clearing stale device identity for fresh enrollment…'));
         resetStaleEnrollment();
     }
-    // The mesh can reconnect independently; camera/audio must be healthy before
-    // preview sends its first inventory heartbeat or opens the motion webhook.
+    // Identity and inventory reporting start immediately. RoboVision may still
+    // be installing or recovering without making the robot disappear.
     start(children[0]);
+    start(preview);
     if (opts.vision !== false) {
         start(children[1]);
-        console.log(chalk.dim('  waiting for RoboVision camera/audio inventory…'));
-        if (!await waitForVision()) {
-            stopping = true;
-            for (const entry of children)
-                entry.child?.kill('SIGTERM');
-            throw new Error('RoboVision did not become healthy at http://127.0.0.1:5000 within 120s');
-        }
-        console.log(chalk.green('  ✓ RoboVision ready; starting preview agent'));
+        console.log(chalk.dim('  RoboVision health check running in background…'));
+        void waitForVision().then(ready => {
+            if (!stopping)
+                console.log(ready
+                    ? chalk.green('  RoboVision camera/audio inventory ready')
+                    : chalk.yellow('  RoboVision is degraded; preview heartbeat remains online and will retry'));
+        });
     }
-    start(preview);
     const shutdown = () => {
         stopping = true;
         for (const entry of [...children, preview])

package/dist/robopark/setup.js

@@ -163,7 +163,9 @@ async function setupRobot(config, opts, ctx, internal) {
     // preview-agent) silently kept talking to whatever hub auto-discovery
     // found (e.g. a real hub reachable over Tailscale), not the one requested.
     const hubHost = new URL(hubUrl).hostname;
-    const schedulerUrl = `http://${hubHost}:${opts.schedulerPort ? parseInt(opts.schedulerPort, 10) : DEFAULT_SCHEDULER_PORT}`;
+    const schedulerUrl = network === 'tailscale'
+        ? `${hubUrl.replace(/\/+$/, '')}/robopark`
+        : `http://${hubHost}:${opts.schedulerPort ? parseInt(opts.schedulerPort, 10) : DEFAULT_SCHEDULER_PORT}`;
     // Vision (camera/motion detection -> presence-triggered session) is the
     // production trigger — on by default. --no-vision opts out (e.g. no camera
     // on this box, or RoboVisionAI_PI isn't installed).
@@ -193,7 +195,12 @@ async function setupRobot(config, opts, ctx, internal) {
         runDetached(robotArgv[0], robotArgv.slice(1));
     }
     if (opts.autoStart) {
-        const robotArgv = [process.execPath, process.argv[1], ...runtimeArgs, '--foreground'];
+        // Enrollment is a one-time bootstrap action. Persisting it in the
+        // supervisor would erase the device identity and attempt a new enrollment
+        // on every reboot, creating duplicate robots (or failing after the token
+        // is consumed).
+        const bootRuntimeArgs = runtimeArgs.filter((arg, index) => arg !== '--enrollment-token' && runtimeArgs[index - 1] !== '--enrollment-token');
+        const robotArgv = [process.execPath, process.argv[1], ...bootRuntimeArgs, '--foreground'];
         for (const role of ['robot', 'robot-preview-agent', 'robot-vision-agent']) {
             unregisterAutoStart(role, internal.name);
         }

package/dist/robopark-cli.js

@@ -183,7 +183,9 @@ robotProgram
     await roboparkRobotRuntime({
         name: opts.name,
         hubUrl: opts.hubUrl,
-        schedulerUrl: opts.schedulerUrl ?? `http://${hub.hostname}:8080`,
+        schedulerUrl: opts.schedulerUrl ?? (opts.tailscale
+            ? `${opts.hubUrl.replace(/\/+$/, '')}/robopark`
+            : `http://${hub.hostname}:8080`),
         token: opts.token,
         port: opts.port,
         network: opts.tailscale ? 'tailscale' : 'lan',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.8.57",
+  "version": "2.8.59",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",
@@ -74,7 +74,6 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@anthropic-ai/claude-code": "^2.1.207",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",

package/packages/robopark/scheduler/main.py

@@ -43,6 +43,21 @@ ROBOPARK_AGENT_TOKEN_FILE = os.getenv(
     "ROBOPARK_AGENT_TOKEN_FILE",
     os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), ".robopark-agent-token"),
 )
+
+
+def _load_mesh_token() -> str:
+    """Load the hub credential shared with unified robot runtimes."""
+    configured = os.getenv("ROBOPARK_MESH_TOKEN", "").strip()
+    if configured:
+        return configured
+    try:
+        with open(os.path.expanduser("~/.robopark/mesh.token"), "r", encoding="utf8") as handle:
+            return handle.read().strip()
+    except OSError:
+        return ""
+
+
+ROBOPARK_MESH_TOKEN = _load_mesh_token()
 
 # ElevenLabs credentials used by the /api/voices/elevenlabs endpoint. We accept
 # both the long-form ELEVENLABS_API_KEY and a shorter ELEVENLABS_KEY alias so
@@ -180,7 +195,7 @@ class DeviceCreate(BaseModel):
     notes: Optional[str] = None
     enrollment_token: Optional[str] = None  # if omitted, one is auto-generated
 
-class DeviceEnrollRequest(BaseModel):
+class DeviceEnrollRequest(BaseModel):
     enrollment_token: str
     name: Optional[str] = None
     tailscale_ip: Optional[str] = None
@@ -188,8 +203,13 @@ class DeviceEnrollRequest(BaseModel):
     motor_server_url: Optional[str] = None
     livekit_url: Optional[str] = None
     character_id: Optional[str] = None
-    video_device: Optional[str] = None
-    audio_device: Optional[str] = None
+    video_device: Optional[str] = None
+    audio_device: Optional[str] = None
+
+class DeviceBootstrapRequest(BaseModel):
+    name: str
+    lan_ip: Optional[str] = None
+    tailscale_ip: Optional[str] = None
 
 class DeviceEnrollResponse(BaseModel):
     device_id: str
@@ -2343,7 +2363,7 @@ async def rotate_device_token(device_id: str):
     await _log_history("device", "device", device_id, "token_rotated", "operator")
     return {"device_id": device_id, "device_token": new_token}
 
-async def _authorize_device(device_id: str, authorization: Optional[str]) -> bool:
+async def _authorize_device(device_id: str, authorization: Optional[str]) -> bool:
     """Verify Bearer token matches stored hash for this device."""
     if not authorization or not authorization.lower().startswith("bearer "):
         return False
@@ -2351,9 +2371,18 @@ async def _authorize_device(device_id: str, authorization: Optional[str]) -> boo
     async with aiosqlite.connect(DB_PATH) as db:
         async with db.execute("SELECT token_hash FROM devices WHERE id = ?", (device_id,)) as c:
             row = await c.fetchone()
-    if not row or not row[0]:
-        return False
-    return hmac.compare_digest(row[0], _hash(token))
+    if not row or not row[0]:
+        return False
+    return hmac.compare_digest(row[0], _hash(token))
+
+
+def _authorize_mesh_bootstrap(presented: Optional[str]) -> bool:
+    """Authenticate bootstrap before a device-scoped token exists."""
+    return bool(
+        ROBOPARK_MESH_TOKEN
+        and presented
+        and hmac.compare_digest(ROBOPARK_MESH_TOKEN, presented.strip())
+    )
 
 async def _log_history(category: str, entity_type: Optional[str] = None, entity_id: Optional[str] = None,
                        action: Optional[str] = None, actor: Optional[str] = None, details: Optional[str] = None):
@@ -2430,8 +2459,61 @@ async def _authorize_fleet(authorization: Optional[str]) -> bool:
             rows = await c.fetchall()
     return any(r[0] and hmac.compare_digest(r[0], token_hash) for r in rows)
 
-@app.post("/api/devices/enroll", response_model=DeviceEnrollResponse)
-async def enroll_device(payload: DeviceEnrollRequest):
+@app.post("/api/devices/bootstrap", response_model=DeviceEnrollResponse)
+async def bootstrap_device(
+    payload: DeviceBootstrapRequest,
+    x_robopark_mesh_token: Optional[str] = Header(default=None),
+):
+    """Create or recover one scheduler identity for a mesh-authenticated robot."""
+    if not _authorize_mesh_bootstrap(x_robopark_mesh_token):
+        raise HTTPException(401, "Invalid or missing RoboPark mesh token")
+    name = payload.name.strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+
+    new_token = secrets.token_urlsafe(32)
+    new_hash = _hash(new_token)
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute(
+            """SELECT id FROM devices WHERE lower(name) = lower(?)
+               ORDER BY CASE lower(status) WHEN 'online' THEN 0 WHEN 'running' THEN 1 ELSE 2 END,
+                        last_heartbeat DESC, enrolled_at DESC LIMIT 1""",
+            (name,),
+        ) as cursor:
+            existing = await cursor.fetchone()
+        if existing:
+            device_id = existing["id"]
+            await db.execute(
+                """UPDATE devices SET token_hash = ?, status = 'enrolled',
+                   lan_ip = COALESCE(?, lan_ip), tailscale_ip = COALESCE(?, tailscale_ip),
+                   enrolled_at = COALESCE(enrolled_at, ?) WHERE id = ?""",
+                (new_hash, payload.lan_ip, payload.tailscale_ip, now, device_id),
+            )
+        else:
+            device_id = f"dev_{secrets.token_hex(4)}"
+            await db.execute(
+                """INSERT INTO devices
+                   (id, name, lan_ip, tailscale_ip, token_hash, status, enrolled_at, created_at)
+                   VALUES (?, ?, ?, ?, ?, 'enrolled', ?, ?)""",
+                (device_id, name, payload.lan_ip, payload.tailscale_ip, new_hash, now, now),
+            )
+        await db.execute(
+            "INSERT OR IGNORE INTO robots (id, name, status) VALUES (?, ?, 'idle')",
+            (device_id, name),
+        )
+        await db.execute("UPDATE robots SET name = ? WHERE id = ?", (name, device_id))
+        await db.commit()
+
+    await broadcast("device_bootstrapped", {"device_id": device_id, "name": name})
+    await _log_history("device", "device", device_id, "bootstrapped", "mesh", f"name={name}")
+    scheduler_url = os.getenv("SCHEDULER_PUBLIC_URL", f"http://localhost:{os.getenv('SCHEDULER_PORT', '8080')}")
+    return DeviceEnrollResponse(device_id=device_id, device_token=new_token, scheduler_url=scheduler_url)
+
+
+@app.post("/api/devices/enroll", response_model=DeviceEnrollResponse)
+async def enroll_device(payload: DeviceEnrollRequest):
     """First-boot enrollment for a Pi. Requires production_mode = true and a valid enrollment token.
     Returns a long-lived device_token the Pi will use for heartbeats."""
     if not await get_production_mode():

package/packages/robopark/scheduler/preview_agent.py

@@ -68,7 +68,7 @@ logger = logging.getLogger("robopark.preview_agent")
 
 _DEVICE_INVENTORY_CACHE: Optional[dict] = None
 _DEVICE_INVENTORY_CACHE_AT = 0.0
-DEVICE_INVENTORY_CACHE_SECONDS = 30.0
+DEVICE_INVENTORY_CACHE_SECONDS = 5.0
 ROBOVISION_MEDIA_URL = os.getenv("ROBOVISION_MEDIA_URL", "http://127.0.0.1:5000/api/media/inventory")
 
 
@@ -256,13 +256,48 @@ def _load_token() -> Optional[str]:
     return None
 
 
-def _save_token(token: str) -> None:
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-    TOKEN_FILE.write_text(token, encoding="utf8")
-    os.chmod(TOKEN_FILE, 0o600)
-
-
-async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> str:
+def _save_token(token: str) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    TOKEN_FILE.write_text(token, encoding="utf8")
+    os.chmod(TOKEN_FILE, 0o600)
+
+
+def _mesh_proxy_headers() -> dict:
+    """Add hub authentication only when the runtime supplied it.
+
+    Direct LAN scheduler calls work unchanged. Tailscale calls use the hub's
+    /robopark proxy, which needs this separate mesh credential while the normal
+    Authorization header remains the scheduler device token.
+    """
+    token = os.getenv("ROBOPARK_MESH_TOKEN", "").strip()
+    return {"X-RoboPark-Mesh-Token": token} if token else {}
+
+
+async def _bootstrap_mesh_device(scheduler_url: str, robot_id: str) -> tuple[str, str]:
+    """Create or recover this robot's scheduler identity using mesh auth."""
+    async with httpx.AsyncClient(headers=_mesh_proxy_headers()) as client:
+        response = await client.post(
+            f"{scheduler_url.rstrip('/')}/api/devices/bootstrap",
+            json={"name": robot_id, "lan_ip": _get_lan_ip()},
+            timeout=30.0,
+        )
+        response.raise_for_status()
+        data = response.json()
+    device_id = str(data.get("device_id") or "").strip()
+    device_token = str(data.get("device_token") or "").strip()
+    if not device_id or not device_token:
+        raise RuntimeError("mesh bootstrap did not return device credentials")
+    _save_token(device_token)
+    cfg = _load_config()
+    cfg["device_id"] = device_id
+    cfg["device_token"] = device_token
+    cfg["scheduler_url"] = scheduler_url
+    _save_config(cfg)
+    logger.info("mesh bootstrap resolved scheduler device %s", device_id)
+    return device_id, device_token
+
+
+async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> str:
     """Enroll this Pi with the scheduler and return the device token."""
     import socket
     payload = {
@@ -270,7 +305,7 @@ async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> s
         "name": robot_id,
         "lan_ip": _get_lan_ip(),
     }
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(headers=_mesh_proxy_headers()) as client:
         r = await client.post(
             f"{scheduler_url.rstrip('/')}/api/devices/enroll",
             json=payload,
@@ -305,11 +340,12 @@ def _get_lan_ip() -> Optional[str]:
 async def _send_heartbeat(scheduler_url: str, device_id: str, token: str) -> Optional[bool]:
     try:
         inventory = _get_device_inventory()
+        headers = {"Authorization": f"Bearer {token}", **_mesh_proxy_headers()}
         async with httpx.AsyncClient() as client:
             response = await client.post(
                 f"{scheduler_url.rstrip('/')}/api/devices/{device_id}/heartbeat",
                 json={"status": "online", "ip": _get_lan_ip(), "device_inventory": inventory},
-                headers={"Authorization": f"Bearer {token}"},
+                headers=headers,
                 timeout=10.0,
             )
             response.raise_for_status()
@@ -387,16 +423,24 @@ class PreviewAgent:
         self._motion_capture: Optional[VideoCapture] = None
         self._motion_capture_lock = asyncio.Lock()
 
-    async def run(self) -> None:
-        enrollment_token = os.getenv("ENROLLMENT_TOKEN") or self.enrollment_token
-        if not self.device_token and enrollment_token:
+    async def run(self) -> None:
+        enrollment_token = os.getenv("ENROLLMENT_TOKEN") or self.enrollment_token
+        if _mesh_proxy_headers():
+            try:
+                self.device_id, self.device_token = await _bootstrap_mesh_device(
+                    self.scheduler_url, self.robot_id
+                )
+            except Exception as exc:
+                logger.warning("mesh device bootstrap failed: %s", exc)
+
+        if not self.device_token and enrollment_token:
             self.device_token = await _enroll(self.scheduler_url, enrollment_token, self.robot_id)
 
         if not self.device_token:
             logger.error("no DEVICE_TOKEN and no ENROLLMENT_TOKEN; cannot poll scheduler")
             sys.exit(1)
 
-        self._session = httpx.AsyncClient()
+        self._session = httpx.AsyncClient(headers=_mesh_proxy_headers())
 
         # Must come after self._session exists — _resolve_device_id() guards
         # on it and silently no-ops otherwise. On a fresh enroll (no cached