machinaos 0.0.76 → 0.0.78

package/client/src/types/cloudEvents.ts

@@ -0,0 +1,78 @@
+/**
+ * CloudEvents v1.0 envelope — mirrors the backend Pydantic `WorkflowEvent`
+ * (`server/services/events/envelope.py`) so the FE can statically type
+ * payloads broadcast over the WebSocket without falling back to `any`.
+ *
+ * Spec: https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md
+ *
+ * Wire shape on the WebSocket today (preserved end-to-end across the
+ * PartySocket / TanStack-Query swap):
+ *
+ *     {
+ *       "type": "credential_catalogue_updated",  // legacy outer routing key
+ *       "data": {
+ *         "specversion": "1.0",
+ *         "id": "<uuid>",
+ *         "source": "machinaos://services/credentials",
+ *         "type": "credential.api_key.saved",   // CloudEvents `type`
+ *         "time": "2026-05-06T12:34:56.789Z",
+ *         "subject": "openai",
+ *         "datacontenttype": "application/json",
+ *         "data": { "provider": "openai", ... }
+ *       }
+ *     }
+ *
+ * Future Wave 12 sources (`stripe.*`, `telegram.*`, `task.*`) will use the
+ * same envelope. The `matchesType` helper provides server-parity glob
+ * dispatch (mirrors `WorkflowEvent.matches_type` in envelope.py).
+ *
+ * Pytest invariant `server/tests/test_credential_broadcasts.py` locks the
+ * backend shape; the FE vitest counterpart locks this interface.
+ */
+
+export interface WorkflowEvent<TData = unknown> {
+  // CloudEvents v1.0 required fields (ordered to match envelope.py).
+  specversion: '1.0';
+  id: string;
+  source: string;
+  type: string;
+  /**
+   * ISO 8601 string. The backend serialises `datetime` via Pydantic's
+   * `model_dump(mode="json")` which produces RFC 3339 UTC timestamps.
+   */
+  time: string;
+  subject?: string;
+  datacontenttype?: string;
+  dataschema?: string;
+  data: TData;
+
+  // CloudEvents extension attributes used by MachinaOs.
+  // `model_config = ConfigDict(extra="allow")` on the Pydantic side means
+  // additional fields may appear and should be tolerated; cast through
+  // `WorkflowEvent<T> & {extra?: unknown}` if you need to read them.
+  workflow_id?: string | null;
+  trigger_node_id?: string | null;
+  correlation_id?: string | null;
+}
+
+/**
+ * Glob-style match on the CloudEvents `type` field.
+ *
+ * Mirrors `WorkflowEvent.matches_type` in `server/services/events/envelope.py`.
+ * Test parity is locked by `client/src/types/__tests__/cloudEvents.test.ts`
+ * vs the corresponding pytest cases.
+ *
+ *   matchesType(e, 'stripe.charge.succeeded')  // exact
+ *   matchesType(e, 'stripe.charge.*')          // prefix glob
+ *   matchesType(e, 'stripe.*')                 // prefix glob (1 segment)
+ *   matchesType(e, 'all')                      // wildcard
+ *   matchesType(e, '')                         // wildcard
+ */
+export function matchesType(event: WorkflowEvent, pattern: string): boolean {
+  if (!pattern || pattern === 'all') return true;
+  if (pattern.endsWith('.*')) {
+    const prefix = pattern.slice(0, -2);
+    return event.type === prefix || event.type.startsWith(prefix + '.');
+  }
+  return event.type === pattern;
+}

package/client/src/vite-env.d.ts

@@ -1,4 +1,11 @@
 /// <reference types="vite/client" />
+/// <reference types="google.maps" />
+// `google.maps` namespace is exposed via @types/google.maps. tsc 5.x
+// auto-loads all @types/* packages, but tsgo (TypeScript 7 native
+// preview) does not pick the namespace up reliably under pnpm's
+// symlinked node_modules layout — the explicit reference here is the
+// canonical fix per https://developers.google.com/maps/documentation/javascript/using-typescript
+// and works for both compilers.
 
 interface ImportMetaEnv {
   readonly VITE_ANDROID_RELAY_URL: string;

package/client/tsconfig.json

@@ -19,7 +19,7 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
-    "baseUrl": ".",
+    "typeRoots": ["./node_modules/@types"],
     "paths": {
       "@/*": ["./src/*"]
     }

package/client/vite.config.js

@@ -94,12 +94,72 @@ export default defineConfig(({ mode }) => {
       host: true
     },
     build: {
-      // antd + reactflow are large libraries - this is expected
-      chunkSizeWarningLimit: 1500,
+      // ES2022 unlocks native `findLast`, optional-chaining-assignment,
+      // class-fields without polyfills. Browser baseline: Chrome 94+,
+      // Firefox 93+, Safari 15.4+ — within React 19 / Tailwind 4's range.
+      target: 'es2022',
+      // Lowered from 1500 KB once manualChunks splits out the heavy libs.
+      // 850 KB covers the largest legitimate chunk today (`vendor-icons`,
+      // ~800 KB raw / 210 KB gz from lucide-react + @lobehub/icons brand
+      // SVGs that resist tree-shaking). The cap still catches new chunk
+      // bloat in the entry / route bundles.
+      chunkSizeWarningLimit: 850,
       // Emit sourcemaps only when running the bundle analyzer so the
       // visualizer can attribute bytes to source files accurately.
       // Skipped in normal production builds to keep build time down.
       sourcemap: analyze,
+      rollupOptions: {
+        output: {
+          // Split heavy npm libs into their own cacheable chunks so the
+          // main bundle stays lean and unrelated dependency churn doesn't
+          // bust the user's cache. Group rationale:
+          //   vendor-react    — core framework + form runtime
+          //   vendor-flow     — reactflow is huge and only canvas pages use it
+          //   vendor-radix    — accessibility primitives, used widely
+          //   vendor-icons    — lucide + lobehub brand icons
+          //   vendor-query    — TanStack Query + persistence
+          //   vendor-markdown — markdown rendering stack (chat / docs panels)
+          //   vendor-misc     — small but heavyweight utilities
+          // Anything not listed falls into the default route/entry chunks.
+          manualChunks: {
+            'vendor-react': [
+              'react',
+              'react-dom',
+              'react-hook-form',
+              '@hookform/resolvers',
+            ],
+            'vendor-flow': ['reactflow'],
+            'vendor-radix': [
+              'radix-ui',
+              '@radix-ui/react-collapsible',
+              '@radix-ui/react-dialog',
+              '@radix-ui/react-slot',
+            ],
+            'vendor-icons': ['lucide-react', '@lobehub/icons'],
+            'vendor-query': [
+              '@tanstack/react-query',
+              '@tanstack/query-sync-storage-persister',
+              '@tanstack/react-query-persist-client',
+              '@lukemorales/query-key-factory',
+            ],
+            'vendor-markdown': [
+              'react-markdown',
+              'remark-gfm',
+              'remark-breaks',
+              'prismjs',
+              'react-simple-code-editor',
+              '@uiw/react-json-view',
+            ],
+            'vendor-misc': [
+              'idb-keyval',
+              'fuzzysort',
+              'cmdk',
+              'sonner',
+              'qrcode.react',
+            ],
+          },
+        },
+      },
     },
   }
 })

package/install.ps1

@@ -1,5 +1,5 @@
 # MachinaOS Installer for Windows
-# Usage: iwr -useb https://raw.githubusercontent.com/trohitg/MachinaOS/main/install.ps1 | iex
+# Usage: iwr -useb https://raw.githubusercontent.com/zeenie-ai/MachinaOS/main/install.ps1 | iex
 #
 # This script installs MachinaOS and its dependencies:
 # - Node.js 22+ (via winget/choco)

package/install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # MachinaOS Installer
-# Usage: curl -fsSL https://raw.githubusercontent.com/trohitg/MachinaOS/main/install.sh | bash
+# Usage: curl -fsSL https://raw.githubusercontent.com/zeenie-ai/MachinaOS/main/install.sh | bash
 #
 # This script installs MachinaOS and its dependencies:
 # - Node.js 22+ (via brew/apt/dnf/pacman)

package/machina/commands/build.py

@@ -23,6 +23,25 @@ from machina.colors import console
 from machina.platform_ import project_root
 
 
+# Source dirs / entry-point modules under ``server/`` that ``machina build``
+# pre-compiles to optimised bytecode in step [5/6]. Public so tests and
+# ``scripts/install.js`` (which mirrors this list) stay in sync — both
+# the install pipeline and tests should read this constant rather than
+# duplicate the list. Excludes ``.venv/`` (uv compiles deps at install
+# time and some site-packages contain non-Python templates) and
+# ``tests/`` (ships outside the production tarball).
+COMPILEALL_SOURCE_DIRS: tuple[str, ...] = (
+    "services",
+    "core",
+    "nodes",
+    "routers",
+    "models",
+    "middleware",
+    "main.py",
+    "constants.py",
+)
+
+
 # ---------------------------------------------------------------- helpers
 
 def _which_python() -> str | None:
@@ -135,28 +154,53 @@ def build_command() -> None:
     env_path = root / ".env"
     template_path = root / ".env.template"
 
-    # Step markers go through ``console.log`` so each [N/5] line is
+    # Step markers go through ``console.log`` so each [N/6] line is
     # timestamped — diff between consecutive timestamps is the wall-clock
     # cost of that step, no manual instrumentation needed.
     if not env_path.exists() and template_path.exists():
         shutil.copy2(template_path, env_path)
-        console.log("[0/5] Created .env from template")
+        console.log("[0/6] Created .env from template")
 
     if not is_postinstall:
-        console.log("[1/5] Installing dependencies...")
+        console.log("[1/6] Installing dependencies...")
         run(["pnpm", "install"], cwd=root)
     else:
-        console.log("[1/5] Dependencies already installed by package manager")
+        console.log("[1/6] Dependencies already installed by package manager")
 
-    console.log("[2/5] Building client...")
+    console.log("[2/6] Building client...")
     run(["pnpm", "--filter", "react-flow-client", "run", "build"], cwd=root)
 
-    console.log("[3/4] Installing Python dependencies...")
+    # Pre-bundle the Node.js sidecar (server/nodejs) with esbuild so the
+    # production `npm start` runs `node dist/index.js` instead of
+    # interpreting `tsx src/index.ts`. Saves ~500ms-1s of cold start
+    # whenever the executor is launched. The bundle keeps Express
+    # external (it stays in node_modules), so the patch flow is intact.
+    console.log("[3/6] Building Node.js sidecar...")
+    run(["pnpm", "--filter", "machinaos-nodejs-executor", "run", "build"], cwd=root)
+
+    console.log("[4/6] Installing Python dependencies...")
     if not (server_dir / ".venv").exists():
         run(["uv", "venv"], cwd=server_dir)
     run(["uv", "sync"], cwd=server_dir)
 
-    console.log("[4/4] Verifying edgymeow binary...")
+    # Pre-compile our Python sources to optimised bytecode (.opt-1.pyc).
+    # `-O` strips `assert` statements + `__debug__` branches; `-q`
+    # silences per-file output (errors still print); `-j 0` parallelises
+    # across all CPU cores. Cuts a measurable few seconds off cold
+    # start by avoiding source-to-bytecode work on first import.
+    #
+    # Scoped to the project's own source dirs — `uv sync` already
+    # compiles `.venv/` packages, and `tests/` ships outside the
+    # tarball. Compiling `.venv/` is wasted work and fails on cookiecutter
+    # template files inside packages like crawlee that aren't real Python.
+    console.log("[5/6] Compiling Python bytecode...")
+    run(
+        ["uv", "run", "python", "-O", "-m", "compileall", "-q", "-j", "0", *COMPILEALL_SOURCE_DIRS],
+        cwd=server_dir,
+        check=False,  # missing pyc is non-fatal — runtime regenerates as needed
+    )
+
+    console.log("[6/6] Verifying edgymeow binary...")
     bin_name = "edgymeow-server.exe" if sys.platform == "win32" else "edgymeow-server"
     edgymeow_bin = root / "node_modules" / "edgymeow" / "bin" / bin_name
     if edgymeow_bin.exists():

package/machina/pyproject.toml

@@ -9,6 +9,10 @@ dependencies = [
   "psutil>=6",
   "anyio>=4",
   "python-dotenv>=1",
+  # Required on Windows for the supervisor's Job Object (machina/tree.py).
+  # Without it, child processes survive abnormal supervisor exit (SIGKILL,
+  # BSOD, console close) and accumulate as orphans across dev restarts.
+  # Floor 308 is the first release shipping prebuilt wheels for Python 3.13.
   "pywin32>=308; platform_system == 'Windows'",
 ]
 

package/machina/supervisor.py

@@ -287,9 +287,19 @@ class Manager:
             stderr=subprocess.PIPE,
             **spawn_kwargs,
         ) as proc:
-            if sys.platform == "win32":
-                add_to_job(proc.pid)
             color = spec.color or "white"
+            if sys.platform == "win32":
+                # Best-effort enrollment in the supervisor's Job Object so
+                # the OS tree-kills the child if the supervisor itself
+                # dies abnormally. Loud warning (from tree.py) on failure.
+                if not add_to_job(proc.pid):
+                    emit(
+                        spec.name,
+                        "yellow",
+                        f"WARN: pid={proc.pid} not enrolled in Job Object -- "
+                        f"orphan risk if supervisor crashes",
+                        stream="stderr",
+                    )
             emit(spec.name, color, f"started pid={proc.pid}")
             # Register for force-kill access on second Ctrl-C; deregister on
             # exit so a restarted-then-died service doesn't leave a stale entry.

package/machina/tree.py

@@ -48,40 +48,90 @@ def signal_group(pid: int, sig: signal.Signals = signal.SIGTERM) -> None:
 # ---------------------------------------------------------------- Windows Job Object
 
 class _JobObject:
-    """Lazy-imported wrapper around a Windows Job Object."""
+    """Lazy-imported wrapper around a Windows Job Object.
 
+    Failure modes are surfaced to stderr instead of swallowed. When this
+    fails the supervisor cannot tree-kill children if it itself dies
+    abnormally (SIGKILL, BSOD, console close), so silent failure leads
+    directly to orphan-process accumulation on Windows.
+    """
+
+    # Win10/11 supports nested jobs, but the parent must allow it. When
+    # the supervisor was launched from another process that already put
+    # us inside a Job Object (npm/pnpm/conhost wrappers occasionally do
+    # this), AssignProcessToJobObject succeeds at the API level but the
+    # child silently lands in the OUTER job, not ours. We detect that
+    # via IsProcessInJob in ``add()`` and warn explicitly.
     def __init__(self) -> None:
         self._handle = None
         self._win32job = None
-        if sys.platform == "win32":
-            try:
-                import win32job  # type: ignore[import-not-found]
-
-                self._win32job = win32job
-                self._handle = win32job.CreateJobObject(None, "")
-                info = win32job.QueryInformationJobObject(
-                    self._handle, win32job.JobObjectExtendedLimitInformation
-                )
-                info["BasicLimitInformation"]["LimitFlags"] |= (
-                    win32job.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
-                )
-                win32job.SetInformationJobObject(
-                    self._handle, win32job.JobObjectExtendedLimitInformation, info
-                )
-            except Exception:  # pywin32 missing or denied
-                self._handle = None
+        if sys.platform != "win32":
+            return
+        try:
+            import win32job  # type: ignore[import-not-found]
+        except ImportError as e:
+            sys.stderr.write(
+                f"[supervisor] WARN: pywin32 import failed ({e}). "
+                f"Children will NOT be tree-killed if the supervisor dies "
+                f"abnormally on Windows. Reinstall via: pip install --force-reinstall pywin32\n"
+            )
+            return
+        try:
+            self._win32job = win32job
+            self._handle = win32job.CreateJobObject(None, "")
+            info = win32job.QueryInformationJobObject(
+                self._handle, win32job.JobObjectExtendedLimitInformation
+            )
+            info["BasicLimitInformation"]["LimitFlags"] |= (
+                win32job.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+            )
+            win32job.SetInformationJobObject(
+                self._handle, win32job.JobObjectExtendedLimitInformation, info
+            )
+        except Exception as e:
+            sys.stderr.write(
+                f"[supervisor] WARN: Job Object init failed: {e!r}. "
+                f"Tree-kill on abnormal supervisor exit will not work.\n"
+            )
+            self._handle = None
+            self._win32job = None
 
     def add(self, pid: int) -> bool:
-        """Enroll ``pid`` in the job. Returns False when unavailable."""
+        """Enroll ``pid`` in the job. Returns False when enrollment did
+        not actually take effect.
+
+        ``AssignProcessToJobObject`` can return success even when the
+        child remains in a different job (inherited from an outer
+        wrapper that doesn't allow nesting). We verify with
+        ``IsProcessInJob`` so the caller learns the truth.
+        """
         if self._handle is None or self._win32job is None:
             return False
         try:
             import win32api  # type: ignore[import-not-found]
-
+        except ImportError as e:
+            sys.stderr.write(f"[supervisor] WARN: win32api import failed ({e})\n")
+            return False
+        try:
+            # PROCESS_ALL_ACCESS = 0x1F0FFF
             handle = win32api.OpenProcess(0x1F0FFF, False, pid)
             self._win32job.AssignProcessToJobObject(self._handle, handle)
+            in_our_job = self._win32job.IsProcessInJob(handle, self._handle)
+            if not in_our_job:
+                in_some_job = self._win32job.IsProcessInJob(handle, None)
+                sys.stderr.write(
+                    f"[supervisor] WARN: pid={pid} did not enter our Job Object "
+                    f"(already in another job: {in_some_job}). Likely cause: "
+                    f"this supervisor was launched from a wrapper (npm/pnpm/conhost) "
+                    f"whose own Job Object disallows nesting. Tree-kill on abnormal "
+                    f"supervisor exit will not reach this child.\n"
+                )
+                return False
             return True
-        except Exception:
+        except Exception as e:
+            sys.stderr.write(
+                f"[supervisor] WARN: AssignProcessToJobObject(pid={pid}) failed: {e!r}\n"
+            )
             return False
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machinaos",
-  "version": "0.0.76",
+  "version": "0.0.78",
   "description": "Open source workflow automation platform with AI agents, React Flow, and n8n-inspired architecture",
   "type": "module",
   "keywords": [
@@ -18,13 +18,13 @@
   ],
   "author": "Rohit G <trohitg@gmail.com>",
   "license": "MIT",
-  "homepage": "https://github.com/trohitg/MachinaOS#readme",
+  "homepage": "https://github.com/zeenie-ai/MachinaOS#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/trohitg/MachinaOS.git"
+    "url": "git+https://github.com/zeenie-ai/MachinaOS.git"
   },
   "bugs": {
-    "url": "https://github.com/trohitg/MachinaOS/issues"
+    "url": "https://github.com/zeenie-ai/MachinaOS/issues"
   },
   "bin": {
     "machina": "./bin/cli.js"

package/scripts/install.js

@@ -159,7 +159,7 @@ try {
   // Calculate total steps
   let totalSteps = 1;  // .env always
   if (!clientDistExists) totalSteps += 2;  // client deps + build
-  totalSteps += 1;  // Python deps always
+  totalSteps += 2;  // Python deps + bytecode compile
   let step = 0;
 
   // Create .env if needed
@@ -198,6 +198,21 @@ try {
   }
   run('uv sync', serverDir, 600000);  // 10 min timeout
 
+  // Pre-compile our Python sources to optimised bytecode (.opt-1.pyc).
+  // `-O` strips assertions and `__debug__` branches; `-q` silences
+  // per-file output; `-j 0` parallelises across CPU cores. Scoped to
+  // our own source dirs — `uv sync` already compiles `.venv/` and
+  // some site-packages contain non-Python template files that would
+  // log spurious errors. Failure is non-fatal: the runtime regenerates
+  // missing .pyc on first import. Trims a few seconds off cold start.
+  step++;
+  console.log(`[${step}/${totalSteps}] Compiling Python bytecode...`);
+  try {
+    run('uv run python -O -m compileall -q -j 0 services core nodes routers models middleware main.py constants.py', serverDir, 120000);
+  } catch (err) {
+    console.log(`  Warning: bytecode compilation failed (non-fatal): ${err.message}`);
+  }
+
   // WhatsApp RPC is now an npm dependency - binary downloaded via postinstall
   console.log('');
   console.log('Done!');

package/server/config/ai_cli_providers.json

@@ -0,0 +1,54 @@
+{
+  "claude": {
+    "package_name": "@anthropic-ai/claude-code",
+    "binary_name": "claude",
+    "login_argv": ["claude", "login"],
+    "auth_status_argv": ["claude", "--print", "-p", "ok"],
+    "ide_lock_env_var": "CLAUDE_IDE_LOCK",
+    "ide_lockfile_dir": "~/.claude/ide",
+    "default_model": "claude-sonnet-4-6",
+    "default_max_turns": 10,
+    "default_max_budget_usd": 5.0,
+    "default_allowed_tools": "Read,Edit,Bash,Glob,Grep,Write,Skill,WebSearch,WebFetch",
+    "default_permission_mode": "acceptEdits",
+    "supports": [
+      "max_budget",
+      "max_turns",
+      "session_id",
+      "resume",
+      "mcp_runtime",
+      "json_cost",
+      "ide_lockfile"
+    ]
+  },
+  "codex": {
+    "package_name": "@openai/codex",
+    "binary_name": "codex",
+    "login_argv": ["codex", "login"],
+    "auth_status_argv": ["codex", "--version"],
+    "ide_lock_env_var": null,
+    "ide_lockfile_dir": null,
+    "default_model": "gpt-5.2-codex",
+    "default_sandbox": "workspace-write",
+    "default_ask_for_approval": "never",
+    "supports": [
+      "sandbox"
+    ]
+  },
+  "gemini": {
+    "package_name": "@google/gemini-cli",
+    "binary_name": "gemini",
+    "login_argv": ["gemini", "auth", "login"],
+    "auth_status_argv": ["gemini", "--version"],
+    "ide_lock_env_var": "GEMINI_IDE_LOCK",
+    "ide_lockfile_dir": "<tmpdir>/gemini/ide",
+    "default_model": "gemini-2.5-pro",
+    "supports": [
+      "session_id",
+      "resume",
+      "sandbox",
+      "mcp_runtime",
+      "ide_lockfile"
+    ]
+  }
+}