labgate 0.5.31 → 0.5.33

package/dist/lib/container.js

@@ -203,6 +203,8 @@ function cleanupLabgateInstructionFile(workdir, filename, deleteWhenEmpty) {
     }
 }
 function buildLabgateInstructionBlock(session) {
+    const agentLower = session.agent.toLowerCase();
+    const hasMcp = agentLower === 'claude' || agentLower === 'codex';
     const lines = [
         LABGATE_INSTRUCTION_START,
         '## LabGate Sandbox Context (Auto-Managed)',
@@ -233,7 +235,7 @@ function buildLabgateInstructionBlock(session) {
         lines.push('');
         lines.push('Use these dataset paths directly when the user references data by name.');
     }
-    if (session.agent.toLowerCase() === 'claude') {
+    if (hasMcp) {
         lines.push('');
         lines.push('### Dataset Management');
         lines.push('- Use the `labgate-datasets` MCP tools to manage and explore datasets.');
@@ -244,13 +246,30 @@ function buildLabgateInstructionBlock(session) {
         lines.push('- Use the `labgate-results` MCP tools to record and revisit important outcomes.');
         lines.push('- Available tools: `list_results`, `register_result`, `get_result`, `update_result`, `delete_result`');
         lines.push('- When you finish meaningful work, call `register_result` with a concise title, summary, and relevant tags/artifacts.');
+        lines.push('');
+        lines.push('### Display Widgets');
+        lines.push('- Use the `labgate-display` MCP tool `display_widget` to render rich interactive content in the LabGate web UI.');
+        lines.push('- Supported widgets: `markdown`, `table`, `plot`, `image`, `pdf`, `molecule`, `sequence`, `alignment`, `file_preview`, `tree`, `heatmap`, `tracks`, `domains`, `network`');
+        lines.push('- Use `molecule` with `pdb_id` to show 3D protein structures (e.g. `{ pdb_id: "2HIU" }`).');
+        lines.push('- Use `sequence` to display colored DNA/RNA/protein sequences.');
+        lines.push('- Use `plot` with a Plotly.js spec (`{ plotly: { data: [...], layout: {...} } }`) for interactive charts.');
+        lines.push('- Use `table` for structured data (`{ columns: [...], rows: [...] }`).');
+        lines.push('- Use `image` with `path` to display images from the filesystem.');
+        lines.push('- Use `pdf` with `path` to display PDF documents inline (`{ path: "/work/paper.pdf" }`).');
+        lines.push('- Use `alignment` for multiple sequence alignments with conservation highlighting.');
+        lines.push('- Use `tree` with Newick format string for phylogenetic trees (e.g. `{ newick: "((A,B),(C,D));" }`).');
+        lines.push('- Use `heatmap` for clustered heatmaps with optional dendrograms (`{ matrix: [[...]], row_labels: [...], cluster_rows: true }`).');
+        lines.push('- Use `tracks` for genome feature viewing via igv.js (`{ tracks: [{ path: "/work/file.gff3", format: "gff3" }] }`).');
+        lines.push('- Use `domains` for protein domain architecture (`{ length: 300, features: [{ type: "domain", name: "Kinase", start: 10, end: 120 }] }`).');
+        lines.push('- Use `network` for interactive graph visualization (`{ nodes: [{id:"A"}], edges: [{source:"A", target:"B"}] }`).');
+        lines.push('- Prefer `display_widget` over plain text when showing structured data, sequences, or molecular information.');
     }
     if (session.config.slurm.enabled) {
         lines.push('');
         lines.push('### SLURM Integration');
         lines.push('- SLURM commands (srun, sbatch, squeue, scancel) are available.');
         lines.push('- LabGate tracks your SLURM jobs automatically via squeue polling.');
-        if (session.config.slurm.mcp_server && session.agent.toLowerCase() === 'claude') {
+        if (session.config.slurm.mcp_server && hasMcp) {
             lines.push('- Use the `labgate-cluster` MCP tools to inspect partitions, queue pressure, and available modules.');
             lines.push('- Available tools: `get_cluster_partitions`, `get_partition_limits`, `get_queue_pressure`, `find_module`');
             lines.push('- Use the `labgate-slurm` MCP tools to check job status and read output files.');
@@ -266,14 +285,64 @@ function buildLabgateInstructionBlock(session) {
     lines.push(LABGATE_INSTRUCTION_END);
     return lines.join('\n');
 }
+/**
+ * Remove all [mcp_servers.*] sections (and their key/value lines) from a TOML string,
+ * preserving all other sections (model, projects, features, etc.).
+ */
+function stripTomlMcpSections(toml) {
+    const lines = toml.split('\n');
+    const result = [];
+    let inMcpSection = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (/^\[mcp_servers[\].]/i.test(trimmed)) {
+            inMcpSection = true;
+            continue;
+        }
+        if (inMcpSection && /^\[/.test(trimmed) && !/^\[mcp_servers[\].]/i.test(trimmed)) {
+            inMcpSection = false;
+        }
+        if (!inMcpSection) {
+            result.push(line);
+        }
+    }
+    // Trim trailing blank lines
+    while (result.length > 0 && result[result.length - 1].trim() === '') {
+        result.pop();
+    }
+    return result.join('\n');
+}
+/**
+ * Serialize MCP server entries to Codex-compatible TOML format.
+ * Produces [mcp_servers."<name>"] sections with command, args, and optional env.
+ */
+function serializeCodexMcpToml(servers) {
+    const lines = [];
+    for (const [name, server] of Object.entries(servers)) {
+        lines.push(`[mcp_servers.${JSON.stringify(name)}]`);
+        lines.push(`command = ${JSON.stringify(server.command)}`);
+        lines.push(`args = [${server.args.map((a) => JSON.stringify(a)).join(', ')}]`);
+        if (server.env && Object.keys(server.env).length > 0) {
+            lines.push('');
+            lines.push(`[mcp_servers.${JSON.stringify(name)}.env]`);
+            for (const [k, v] of Object.entries(server.env)) {
+                lines.push(`${k} = ${JSON.stringify(v)}`);
+            }
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}
 function prepareMcpServers(session, options = {}) {
-    if (session.agent.toLowerCase() !== 'claude')
+    const agentLower = session.agent.toLowerCase();
+    if (agentLower !== 'claude' && agentLower !== 'codex')
         return;
     try {
         const sandboxHome = (0, config_js_1.getSandboxHome)();
         const mcpDir = (0, path_1.join)(sandboxHome, '.mcp-servers');
         (0, fs_1.mkdirSync)(mcpDir, { recursive: true });
-        // Claude Code reads MCP config from ~/.claude.json (in HOME root)
+        // Claude Code reads MCP config from ~/.claude.json (in HOME root).
+        // For Codex we build the same mcpConfig object, then serialize to TOML below.
         const mcpConfigPath = (0, path_1.join)(sandboxHome, '.claude.json');
         let mcpConfig = {};
         try {
@@ -303,7 +372,7 @@ function prepareMcpServers(session, options = {}) {
                 copyMcpNodePackage('bindings') &&
                 copyMcpNodePackage('file-uri-to-path'));
         };
-        // Dataset MCP server (always for Claude)
+        // Dataset MCP server (always)
         const datasetBundleSrc = (0, path_1.resolve)(__dirname, '../mcp-bundles/dataset-mcp.bundle.mjs');
         if ((0, fs_1.existsSync)(datasetBundleSrc)) {
             (0, fs_1.copyFileSync)(datasetBundleSrc, (0, path_1.join)(mcpDir, 'dataset-mcp.bundle.mjs'));
@@ -321,7 +390,7 @@ function prepareMcpServers(session, options = {}) {
                 args: [datasetMcpPath],
             };
         }
-        // Results MCP server (always for Claude)
+        // Results MCP server (always)
         const resultsBundleSrc = (0, path_1.resolve)(__dirname, '../mcp-bundles/results-mcp.bundle.mjs');
         if ((0, fs_1.existsSync)(resultsBundleSrc)) {
             (0, fs_1.copyFileSync)(resultsBundleSrc, (0, path_1.join)(mcpDir, 'results-mcp.bundle.mjs'));
@@ -338,6 +407,23 @@ function prepareMcpServers(session, options = {}) {
                 args: [resultsMcpPath, '--db', (0, config_js_1.getResultsDbPath)()],
             };
         }
+        // Display MCP server (always — renders rich widgets in LabGate UI)
+        const displayBundleSrc = (0, path_1.resolve)(__dirname, '../mcp-bundles/display-mcp.bundle.mjs');
+        if ((0, fs_1.existsSync)(displayBundleSrc)) {
+            (0, fs_1.copyFileSync)(displayBundleSrc, (0, path_1.join)(mcpDir, 'display-mcp.bundle.mjs'));
+            mcpConfig.mcpServers['labgate-display'] = {
+                command: 'node',
+                args: ['/home/sandbox/.mcp-servers/display-mcp.bundle.mjs', '--db', '/labgate-config/display.json'],
+                env,
+            };
+        }
+        else {
+            const displayMcpPath = (0, path_1.resolve)(__dirname, 'display-mcp.js');
+            mcpConfig.mcpServers['labgate-display'] = {
+                command: 'node',
+                args: [displayMcpPath, '--db', (0, config_js_1.getDisplayDbPath)()],
+            };
+        }
         // Cluster MCP server (when SLURM integration is enabled)
         if (session.config.slurm.enabled && session.config.slurm.mcp_server) {
             const clusterBundleSrc = (0, path_1.resolve)(__dirname, '../mcp-bundles/cluster-mcp.bundle.mjs');
@@ -389,8 +475,29 @@ function prepareMcpServers(session, options = {}) {
         else {
             delete mcpConfig.mcpServers['labgate-slurm'];
         }
-        (0, fs_1.writeFileSync)(mcpConfigPath, JSON.stringify(mcpConfig, null, 2), 'utf-8');
-        (0, config_js_1.ensurePrivateFile)(mcpConfigPath);
+        if (agentLower === 'claude') {
+            (0, fs_1.writeFileSync)(mcpConfigPath, JSON.stringify(mcpConfig, null, 2), 'utf-8');
+            (0, config_js_1.ensurePrivateFile)(mcpConfigPath);
+        }
+        if (agentLower === 'codex') {
+            // Codex reads MCP config from ~/.codex/config.toml
+            const codexDir = (0, path_1.join)(sandboxHome, '.codex');
+            (0, fs_1.mkdirSync)(codexDir, { recursive: true });
+            const codexConfigPath = (0, path_1.join)(codexDir, 'config.toml');
+            let existingToml = '';
+            try {
+                if ((0, fs_1.existsSync)(codexConfigPath)) {
+                    existingToml = (0, fs_1.readFileSync)(codexConfigPath, 'utf-8');
+                }
+            }
+            catch { /* start fresh */ }
+            // Strip old [mcp_servers.*] sections and append fresh ones
+            const cleaned = stripTomlMcpSections(existingToml);
+            const mcpToml = serializeCodexMcpToml(mcpConfig.mcpServers);
+            const separator = cleaned.length > 0 && !cleaned.endsWith('\n') ? '\n\n' : cleaned.length > 0 ? '\n' : '';
+            (0, fs_1.writeFileSync)(codexConfigPath, cleaned + separator + mcpToml, 'utf-8');
+            (0, config_js_1.ensurePrivateFile)(codexConfigPath);
+        }
     }
     catch {
         // Best effort — MCP registration failure is non-fatal
@@ -984,6 +1091,7 @@ function buildApptainerArgs(session, sifPath, sessionId, tokenEnv = []) {
         // ── LabGate config for in-container MCP servers ──
         ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--bind', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
         ...(resultsDbPath ? ['--bind', `${resultsDbPath}:/labgate-config/results.json`] : []),
+        ...((0, fs_1.existsSync)((0, config_js_1.getDisplayDbPath)()) ? ['--bind', `${(0, config_js_1.getDisplayDbPath)()}:/labgate-config/display.json`] : []),
         ...(config.slurm.enabled && (0, fs_1.existsSync)((0, config_js_1.getSlurmDbPath)())
             ? ['--bind', `${(0, config_js_1.getSlurmDbPath)()}:/labgate-config/slurm.db`] : []),
         ...(config.slurm.enabled && (0, fs_1.existsSync)(`${(0, config_js_1.getSlurmDbPath)()}.json`)
@@ -1047,6 +1155,7 @@ function buildPodmanArgs(session, image, sessionId, tokenEnv = [], options = { t
         // ── LabGate config for in-container MCP servers ──
         ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--volume', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
         ...(resultsDbPath ? ['--volume', `${resultsDbPath}:/labgate-config/results.json`] : []),
+        ...((0, fs_1.existsSync)((0, config_js_1.getDisplayDbPath)()) ? ['--volume', `${(0, config_js_1.getDisplayDbPath)()}:/labgate-config/display.json`] : []),
         ...(config.slurm.enabled && (0, fs_1.existsSync)((0, config_js_1.getSlurmDbPath)())
             ? ['--volume', `${(0, config_js_1.getSlurmDbPath)()}:/labgate-config/slurm.db`] : []),
         ...(config.slurm.enabled && (0, fs_1.existsSync)(`${(0, config_js_1.getSlurmDbPath)()}.json`)
@@ -1176,7 +1285,7 @@ function buildEntrypoint(agent) {
     }
     const preLaunchLines = [];
     if (agent === 'codex') {
-        preLaunchLines.push('labgate_ensure_ca_certificates() {', '  if [ -s /etc/ssl/certs/ca-certificates.crt ] || [ -s /etc/ssl/cert.pem ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing CA certificates and no root access to install them; Codex login may fail." >&2', '    return 0', '  fi', '  echo "[labgate] Installing ca-certificates for Codex TLS..."', '  if command -v apt-get >/dev/null 2>&1; then', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || return 0', '    apt-get install -y ca-certificates >/dev/null 2>&1 || return 0', '    update-ca-certificates >/dev/null 2>&1 || true', '    return 0', '  fi', '  if command -v apk >/dev/null 2>&1; then', '    apk add --no-cache ca-certificates >/dev/null 2>&1 || return 0', '    update-ca-certificates >/dev/null 2>&1 || true', '    return 0', '  fi', '  if command -v dnf >/dev/null 2>&1; then', '    dnf install -y ca-certificates >/dev/null 2>&1 || return 0', '    return 0', '  fi', '  if command -v yum >/dev/null 2>&1; then', '    yum install -y ca-certificates >/dev/null 2>&1 || return 0', '    return 0', '  fi', '  if command -v microdnf >/dev/null 2>&1; then', '    microdnf install -y ca-certificates >/dev/null 2>&1 || return 0', '  fi', '}', 'labgate_ensure_ca_certificates', 'if [ "${LABGATE_CODEX_PODMAN_DARWIN_WORKAROUND:-}" = "1" ]; then', '  if ! codex login status >/dev/null 2>&1; then', '    echo "[labgate] Starting Codex device-code login (Podman macOS callback workaround)..."', '    codex login --device-auth', '  fi', 'fi');
+        preLaunchLines.push('labgate_ensure_ca_certificates() {', '  if [ -s /etc/ssl/certs/ca-certificates.crt ] || [ -s /etc/ssl/cert.pem ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing CA certificates and no root access to install them; Codex login may fail." >&2', '    return 0', '  fi', '  echo "[labgate] Installing ca-certificates for Codex TLS..."', '  if command -v apt-get >/dev/null 2>&1; then', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || return 0', '    apt-get install -y ca-certificates >/dev/null 2>&1 || return 0', '    update-ca-certificates >/dev/null 2>&1 || true', '    return 0', '  fi', '  if command -v apk >/dev/null 2>&1; then', '    apk add --no-cache ca-certificates >/dev/null 2>&1 || return 0', '    update-ca-certificates >/dev/null 2>&1 || true', '    return 0', '  fi', '  if command -v dnf >/dev/null 2>&1; then', '    dnf install -y ca-certificates >/dev/null 2>&1 || return 0', '    return 0', '  fi', '  if command -v yum >/dev/null 2>&1; then', '    yum install -y ca-certificates >/dev/null 2>&1 || return 0', '    return 0', '  fi', '  if command -v microdnf >/dev/null 2>&1; then', '    microdnf install -y ca-certificates >/dev/null 2>&1 || return 0', '  fi', '}', 'labgate_ensure_ca_certificates', 'if [ "${LABGATE_CODEX_PODMAN_DARWIN_WORKAROUND:-}" = "1" ] || [ "${LABGATE_CODEX_APPTAINER_REMOTE_DEVICE_AUTH:-}" = "1" ]; then', '  if ! codex login status >/dev/null 2>&1; then', '    if [ "${LABGATE_CODEX_PODMAN_DARWIN_WORKAROUND:-}" = "1" ]; then', '      echo "[labgate] Starting Codex device-code login (Podman macOS callback workaround)..."', '    else', '      echo "[labgate] Starting Codex device-code login (Apptainer remote login flow)..."', '    fi', '    codex login --device-auth', '  fi', 'fi');
     }
     lines.push(`if ! command -v ${setup.bin} >/dev/null 2>&1; then`, `  ${setup.installer}`, 'fi', ...preLaunchLines, `echo "[labgate] Starting ${setup.bin} in /work"`, `exec ${setup.bin}`);
     return lines.join('\n');
@@ -1206,6 +1315,21 @@ function osc52Copy(text) {
     const tty = process.stderr.isTTY ? process.stderr : process.stdout;
     tty.write(`\x1b]52;c;${encoded}\x07`);
 }
+function supportsTerminalHyperlinks() {
+    if (!(process.stderr.isTTY ?? false))
+        return false;
+    if (process.env.LABGATE_HYPERLINKS === '0')
+        return false;
+    if ((process.env.TERM || '').toLowerCase() === 'dumb')
+        return false;
+    return true;
+}
+function formatTerminalHyperlink(url) {
+    if (!supportsTerminalHyperlinks())
+        return url;
+    const safe = String(url || '').replace(/[\u001b\u0007]/g, '');
+    return `\u001b]8;;${safe}\u0007${url}\u001b]8;;\u0007`;
+}
 const OAUTH_URL_DEDUPE_WINDOW_MS = 20_000;
 let lastHandledOAuthUrl = '';
 let lastHandledOAuthAt = 0;
@@ -1278,6 +1402,7 @@ function handleOAuthUrl(url, options) {
     const normalizedUrl = normalizeClaudeOAuthUrl(url);
     if (!normalizedUrl)
         return;
+    const displayUrl = formatTerminalHyperlink(normalizedUrl);
     const now = Date.now();
     if (normalizedUrl === lastHandledOAuthUrl && (now - lastHandledOAuthAt) < OAUTH_URL_DEDUPE_WINDOW_MS) {
         return;
@@ -1287,7 +1412,7 @@ function handleOAuthUrl(url, options) {
     if (options.isRemote) {
         // SSH / headless: push URL to local clipboard via OSC 52 if supported.
         osc52Copy(normalizedUrl);
-        log.info(`Login URL:\n${normalizedUrl}`);
+        log.info(`Login URL:\n${displayUrl}`);
         log.info('Tried to copy URL via terminal clipboard (OSC 52).');
         log.info('Open it in your local browser, then paste the code back here.');
         return;
@@ -1303,7 +1428,7 @@ function handleOAuthUrl(url, options) {
         }
         catch {
             log.warn('Could not auto-open browser. URL copied to clipboard (if available).');
-            log.info(`Login URL:\n${normalizedUrl}`);
+            log.info(`Login URL:\n${displayUrl}`);
         }
         return;
     }
@@ -1315,7 +1440,7 @@ function handleOAuthUrl(url, options) {
     catch {
         osc52Copy(normalizedUrl);
         log.warn('Could not auto-open browser. Tried clipboard copy via terminal.');
-        log.info(`Login URL:\n${normalizedUrl}`);
+        log.info(`Login URL:\n${displayUrl}`);
     }
 }
 /**
@@ -1647,9 +1772,16 @@ async function startSession(session) {
         (0, os_1.platform)() === 'darwin')
         ? ['--env', 'LABGATE_CODEX_PODMAN_DARWIN_WORKAROUND=1']
         : [];
+    const codexApptainerRemoteDeviceAuth = (runtime === 'apptainer' &&
+        session.agent === 'codex' &&
+        tokenEnv.length === 0 &&
+        !canOpenBrowser())
+        ? ['--env', 'LABGATE_CODEX_APPTAINER_REMOTE_DEVICE_AUTH=1']
+        : [];
     const runtimeEnvArgs = [
         ...claudeEnvGuard,
         ...codexPodmanDarwinLoginWorkaround,
+        ...codexApptainerRemoteDeviceAuth,
         ...tokenEnv,
         ...(browserHook?.env ?? []),
     ];