mindwire 0.1.1 → 0.1.3

package/README.md

@@ -1,7 +1,7 @@
 # mindwire
 
 A typed TypeScript client for the **mindwire daemon** — one SDK for every coding-agent harness
-(Claude Code, Codex, Copilot CLI, opencode). The daemon normalizes each agent to a single
+(Claude Code, Codex, Grok Build, opencode). The daemon normalizes each agent to a single
 protocol; this package is a thin, dependency-free client over its REST + SSE surface.
 
 - **Embedded by default.** On a server runtime (Node/Bun/Deno) the SDK auto-spawns the bundled
@@ -107,11 +107,9 @@ const mw = new Mindwire({
 await mw.ensure(); // resolves once the daemon is healthy; then turns stream as usual
 ```
 
-Binary discovery for the `local` daemon, in order: the `bin` option → `$MINDWIRE_DAEMON` →
-the matching prebuilt package (`mindwire-daemon-<platform>-<arch>`, installed automatically as an
-optional dependency) → a binary bundled next to the SDK (`bin/mindwired-<platform>-<arch>`) →
-`mindwired` on `PATH`. For local dev without the prebuilt package, set `$MINDWIRE_DAEMON` to a
-`go build`-produced binary.
+Binary discovery for the `local` daemon, in order: the `bin` option → `$MINDWIRE_DAEMON` → a
+verified SDK-matched binary downloaded from the GitHub Release → `mindwired` on `PATH`. For local
+development, set `$MINDWIRE_DAEMON` to a `go build`-produced binary.
 
 `ssh` / `docker` / `oblien` require an optional peer (`ssh2` / `dockerode` / `oblien`) — install only
 the one you use. Importing `mindwire` never loads them.
@@ -180,12 +178,6 @@ bun install
 bun run build          # tsup → dist (ESM + CJS + .d.ts)
 bun run typecheck      # tsc --noEmit
 bun test               # client + SSE parser tests (mocked fetch)
-bun run build:daemon   # cross-compile mindwired → npm/mindwire-daemon-<platform>-<arch>/ (needs Go)
 ```
 
-`build:daemon` produces the per-platform daemon packages and syncs the main package's
-`optionalDependencies`. **Release order:** publish every `npm/mindwire-daemon-*` package first,
-then publish `mindwire` — its optional dependencies must already exist on the registry at the
-same version.
-
 License: Apache-2.0.

package/dist/client.d.ts

@@ -102,7 +102,7 @@ export declare class Mindwire {
      * call before the target has connected (nothing to reap yet).
      */
     close(): Promise<void>;
-    /** `GET /healthz` — public liveness check. Resolves with the daemon's health payload when it is up. */
+    /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
     health(): Promise<Health>;
     /**
      * `GET /stats` — the daemon **process's** resource snapshot (heap in use, memory reserved from the

package/dist/index.cjs

@@ -469,7 +469,7 @@ var Run = class _Run {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.1.1" ;
+var SDK_VERSION = "0.1.3" ;
 
 // src/daemon-binary.ts
 function supported(platform, arch) {
@@ -580,17 +580,19 @@ async function spawnDaemon(opts) {
   const { spawn } = await import('child_process');
   const net = await import('net');
   const proc = serverRuntime().process;
+  const { randomBytes } = await import('crypto');
   const resolved = await resolveBinary(opts.bin);
   const bin = resolved.bin;
   const port = await freePort(net);
   const baseUrl = `http://127.0.0.1:${port}`;
+  const token = randomBytes(32).toString("hex");
   const child = spawn(bin, [], {
     env: {
       ...proc.env,
       ADDR: `127.0.0.1:${port}`,
       AGENT_CWD: opts.cwd ?? proc.cwd(),
       STATE_PATH: opts.statePath ?? ".mindwire-state.json",
-      DAEMON_TOKEN: ""
+      DAEMON_TOKEN: token
     },
     stdio: "ignore"
   });
@@ -609,8 +611,8 @@ async function spawnDaemon(opts) {
     stop();
     proc.exit?.(130);
   });
-  await waitHealthy(baseUrl, () => spawnError, resolved);
-  return { baseUrl, stop };
+  await waitHealthy(baseUrl, token, () => spawnError, resolved);
+  return { baseUrl, token, stop };
 }
 async function resolveBinary(explicit) {
   const fs = await import('fs');
@@ -645,7 +647,7 @@ function daemonStartError(resolved, cause) {
       "  \u2022 check GitHub Release access so the SDK can download its matching daemon binary; or",
       "  \u2022 set MINDWIRE_DAEMON to a `mindwired` binary; or",
       "  \u2022 pass { baseUrl } to connect to a daemon you run yourself.",
-      "  \u2022 Working inside the mindwire monorepo? Run `bun run build:daemon` from the repo root to build it.",
+      "  \u2022 Working inside the mindwire monorepo? Run `go build -o /tmp/mindwired ./daemon/cmd/daemon` and set MINDWIRE_DAEMON.",
       `(underlying error: ${cause.message})`
     ].join("\n");
   }
@@ -662,7 +664,7 @@ function freePort(net) {
     });
   });
 }
-async function waitHealthy(baseUrl, getError, resolved, timeoutMs = 15e3) {
+async function waitHealthy(baseUrl, token, getError, resolved, timeoutMs = 15e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     const err = getError();
@@ -670,7 +672,7 @@ async function waitHealthy(baseUrl, getError, resolved, timeoutMs = 15e3) {
       throw new MindwireError(daemonStartError(resolved, err), { cause: err });
     }
     try {
-      const res = await fetch(`${baseUrl}/healthz`);
+      const res = await fetch(`${baseUrl}/healthz`, { headers: { Authorization: `Bearer ${token}` } });
       if (res.ok) return;
     } catch {
     }
@@ -805,7 +807,7 @@ var Mindwire = class _Mindwire {
     if (h) await h.stop();
   }
   // ---- health & catalog ----------------------------------------------------
-  /** `GET /healthz` — public liveness check. Resolves with the daemon's health payload when it is up. */
+  /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
   health() {
     return this.http.request("GET", "/healthz");
   }
@@ -1307,11 +1309,12 @@ var STATE = `${DAEMON_DIR}/agent-state.json`;
 var LOG = `${DAEMON_DIR}/daemon.log`;
 async function ensureDaemon(host, cfg) {
   const emit2 = makeEmit(cfg);
+  const token = cfg.token ?? (await import('crypto')).randomBytes(32).toString("hex");
   try {
     await waitHostReady(host);
     emit2({ phase: "connect", message: "runtime ready" });
     const desired = cfg.desiredVersion ?? SDK_VERSION;
-    const health = await probeHealth(host, cfg.port);
+    const health = await probeHealth(host, cfg.port, token);
     if (health.reachable) {
       emit2({
         phase: "probe",
@@ -1319,31 +1322,32 @@ async function ensureDaemon(host, cfg) {
         version: health.version
       });
       const upToDate = health.version !== void 0 && health.version === desired;
-      if (upToDate || !cfg.autoUpdate) {
+      if (!cfg.forceDeploy && (upToDate || !cfg.autoUpdate)) {
         emit2({
           phase: "skip",
           message: upToDate ? `daemon already at v${desired}` : "keeping the running daemon",
           version: health.version
         });
-        return;
+        return token;
       }
     } else {
       emit2({ phase: "probe", message: "no daemon reachable; deploying" });
     }
-    await deploy(host, cfg, emit2);
+    await deploy(host, cfg, emit2, token);
+    return token;
   } catch (err) {
     emit2({ phase: "error", message: "ensure failed", error: err instanceof Error ? err.message : String(err) });
     throw err;
   }
 }
-async function deploy(host, cfg, emit2) {
+async function deploy(host, cfg, emit2, token) {
   const arch = await probeArch(host);
   const desired = cfg.desiredVersion ?? SDK_VERSION;
   let acquire = "";
   if (cfg.daemonBin) {
     const binPath = await resolveLinuxDaemon(cfg.daemonBin, arch);
     const bytes = await readBytes(binPath);
-    emit2({ phase: "upload", message: `uploading daemon (${arch}, ${bytes.length} bytes)`, arch, bytes: bytes.length });
+    emit2({ phase: "upload", message: `uploading daemon (${arch}, ${formatMiB(bytes.length)})`, arch, bytes: bytes.length });
     await host.putFile(BIN_NEW, bytes, { mode: "0755" });
   } else {
     if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(desired)) {
@@ -1386,9 +1390,9 @@ async function deploy(host, cfg, emit2) {
     `mv -f ${BIN_NEW} ${BIN}`,
     `chmod +x ${BIN}`,
     // Detach so the daemon survives this exec's shell exiting. ADDR=":<port>" binds 0.0.0.0.
-    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE="${cfg.agent}" AGENT_CWD="${cfg.agentCwd}" STATE_PATH="${STATE}" DAEMON_TOKEN="" ${BIN} > ${LOG} 2>&1 < /dev/null &`,
+    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE="${cfg.agent}" AGENT_CWD="${cfg.agentCwd}" STATE_PATH="${STATE}" DAEMON_TOKEN=${shellQuote(token)} ${BIN} > ${LOG} 2>&1 < /dev/null &`,
     // Health-poll from inside the VM (loopback) and emit a marker — exit codes are unreliable here.
-    `for i in $(seq 1 60); do curl -fsS --max-time 2 http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
+    `for i in $(seq 1 60); do curl -fsS --max-time 2 -H ${shellQuote(`Authorization: Bearer ${token}`)} http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
     "echo MINDWIRE_FAIL",
     `tail -n 40 ${LOG} 2>/dev/null || true`
   ].join("\n");
@@ -1402,8 +1406,8 @@ async function deploy(host, cfg, emit2) {
   }
   emit2({ phase: "ready", message: "daemon deployed and healthy" });
 }
-async function probeHealth(host, port) {
-  const script = `out=$(curl -fsS --max-time 3 http://127.0.0.1:${port}/healthz 2>/dev/null) && printf '<<MW_H>>%s<<MW_H>>' "$out" || printf '<<MW_H>><<MW_H>>'`;
+async function probeHealth(host, port, token) {
+  const script = `out=$(curl -fsS --max-time 3 -H ${shellQuote(`Authorization: Bearer ${token}`)} http://127.0.0.1:${port}/healthz 2>/dev/null) && printf '<<MW_H>>%s<<MW_H>>' "$out" || printf '<<MW_H>><<MW_H>>'`;
   const res = await host.exec(["bash", "-lc", script], { timeoutSeconds: 15 });
   const body = ((res.stdout ?? "").match(/<<MW_H>>([\s\S]*?)<<MW_H>>/)?.[1] ?? "").trim();
   if (!body) return { reachable: false };
@@ -1439,10 +1443,11 @@ async function waitHostReady(host, timeoutMs = 6e4) {
 async function resolveLinuxDaemon(explicit, arch) {
   const fs = await import('fs');
   if (explicit) {
-    if (!fs.existsSync(explicit)) {
-      throw new MindwireError(`mindwire: sandbox daemonBin not found at ${explicit}`);
+    const resolved = explicit.replaceAll("{arch}", arch);
+    if (!fs.existsSync(resolved)) {
+      throw new MindwireError(`mindwire: sandbox daemonBin not found at ${resolved}`);
     }
-    return explicit;
+    return resolved;
   }
   return ensureDaemonBinary({ platform: "linux", arch: arch === "arm64" ? "arm64" : "x64" });
 }
@@ -1456,6 +1461,9 @@ function sleep(ms) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function formatMiB(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
 
 // src/target/container.ts
 async function provisionContainer(host, cfg, onLog) {
@@ -1469,7 +1477,7 @@ async function provisionContainer(host, cfg, onLog) {
   };
   await ensureDockerReady(host, cfg.install ?? "never", emit2);
   const { containerId, hostPort, created } = await runContainer(host, cfg, emit2);
-  await ensureDaemon(new ContainerHost(host, containerId), {
+  const token = await ensureDaemon(new ContainerHost(host, containerId), {
     port: cfg.daemonPort,
     agent: cfg.agent,
     agentCwd: cfg.agentCwd,
@@ -1488,7 +1496,7 @@ async function provisionContainer(host, cfg, onLog) {
     } catch {
     }
   };
-  return { containerId, hostPort, stop };
+  return { containerId, hostPort, token, stop };
 }
 var ContainerHost = class {
   constructor(base, containerId) {
@@ -1724,7 +1732,7 @@ async function connectSsh(opts, spec) {
   });
 }
 async function provisionSsh(client, makeTunnel, cfg) {
-  await ensureDaemon(new SshHost(client), {
+  const token = await ensureDaemon(new SshHost(client), {
     port: cfg.daemonPort,
     agent: cfg.agent,
     agentCwd: cfg.agentCwd,
@@ -1747,7 +1755,7 @@ async function provisionSsh(client, makeTunnel, cfg) {
       }
     }
   };
-  return { id: cfg.id, baseUrl: tunnel.baseUrl, stop };
+  return { id: cfg.id, baseUrl: tunnel.baseUrl, token, stop };
 }
 async function provisionSshContainer(client, makeTunnel, cfg) {
   const container = await provisionContainer(
@@ -1784,7 +1792,7 @@ async function provisionSshContainer(client, makeTunnel, cfg) {
       }
     }
   };
-  return { id: cfg.id, baseUrl: tunnel.baseUrl, stop };
+  return { id: cfg.id, baseUrl: tunnel.baseUrl, token: container.token, stop };
 }
 async function openConnection(mod, opts) {
   const auth = await buildAuth(opts);
@@ -1917,6 +1925,7 @@ function docker(config = {}) {
 var DEFAULT_PORT2 = 8790;
 var DEFAULT_AGENT2 = "claude-code";
 var DEFAULT_AGENT_CWD2 = "/root";
+var DEFAULT_RUNTIME_IMAGE = `ghcr.io/oblien/mindwire-runtime:${SDK_VERSION}`;
 var DockerHost = class {
   constructor(container) {
     this.container = container;
@@ -1971,15 +1980,14 @@ async function provisionDocker(docker2, config = {}, onLog) {
   if (config.container !== void 0) {
     container = docker2.getContainer(config.container);
   } else {
-    if (!config.image) {
-      throw new MindwireError(
-        "mindwire: the Docker adapter needs an image or a container \u2014 pass docker({ image }) to create one, or docker({ container }) to attach to an existing one."
-      );
-    }
+    const image = config.image ?? DEFAULT_RUNTIME_IMAGE;
+    await ensureImage(docker2, image, config.pull ?? "missing", onLog);
     const portKey = `${port}/tcp`;
     container = await docker2.createContainer({
-      Image: config.image,
-      Cmd: ["sleep", "infinity"],
+      // The runtime image starts mindwired itself. Do not replace its command: doing so turns the
+      // image ENTRYPOINT into `mindwired sleep infinity` and prevents the runtime from starting.
+      Image: image,
+      Env: [`ADDR=:${port}`, `AGENT_TYPE=${agent}`, `AGENT_CWD=${agentCwd}`],
       Tty: false,
       ExposedPorts: { [portKey]: {} },
       HostConfig: { PortBindings: { [portKey]: [{ HostPort: "0" }] } },
@@ -1996,7 +2004,7 @@ async function provisionDocker(docker2, config = {}, onLog) {
       `mindwire: the Docker container does not publish a host port for ${port}/tcp. ` + (created ? "This is unexpected for a container mindwire created." : "Attach to a container started with that port published (e.g. `-p 0:" + port + "`).")
     );
   }
-  await ensureDaemon(new DockerHost(container), {
+  const token = await ensureDaemon(new DockerHost(container), {
     port,
     agent,
     agentCwd,
@@ -2015,7 +2023,37 @@ async function provisionDocker(docker2, config = {}, onLog) {
     } catch {
     }
   };
-  return { id: container.id, baseUrl: `http://127.0.0.1:${hostPort}`, stop };
+  return { id: container.id, baseUrl: `http://127.0.0.1:${hostPort}`, token, stop };
+}
+async function ensureImage(docker2, image, policy, onLog) {
+  const emit2 = (message, error) => {
+    try {
+      onLog?.({ phase: "pull", target: "docker", message, ...error ? { error } : {} });
+    } catch {
+    }
+  };
+  if (policy === "never") return;
+  if (policy === "missing") {
+    try {
+      await docker2.getImage(image).inspect();
+      return;
+    } catch {
+    }
+  }
+  emit2(`pulling runtime image ${image}`);
+  try {
+    const stream = await docker2.pull(image);
+    await new Promise((resolve, reject) => {
+      stream.on("end", () => resolve());
+      stream.on("close", () => resolve());
+      stream.on("error", (error) => reject(error));
+    });
+    emit2(`runtime image ready: ${image}`);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    emit2(`failed to pull runtime image ${image}`, detail);
+    throw new MindwireError(`mindwire: failed to pull Docker image ${image}: ${detail}`, { cause: error });
+  }
 }
 function tarSingleFile(name, data, mode) {
   const header = Buffer.alloc(512, 0);
@@ -2122,26 +2160,31 @@ async function provisionOblien(client, config = {}, onLog) {
     const ws = await client.workspaces.create(params);
     workspaceId = ws.id;
   }
+  await config.onWorkspace?.(workspaceId);
   const handle = client.workspace(workspaceId);
   await handle.start().catch(() => {
   });
   let rt = await handle.runtime();
-  await ensureDaemon(new OblienHost(rt), {
+  const token = await ensureDaemon(new OblienHost(rt), {
     port,
     agent,
     agentCwd,
     daemonBin: config.daemonBin,
     autoUpdate: config.autoUpdate,
+    forceDeploy: config.forceDeploy,
     target: "oblien",
     onLog
   });
   const fetchImpl = async (url, init) => {
     const { pathname, search } = new URL(url);
     const path = pathname + search;
-    let res = await rt.proxy(port).fetch(path, init);
+    const headers = new Headers(init?.headers);
+    headers.set("X-Mindwire-Token", token);
+    headers.delete("Authorization");
+    let res = await rt.proxy(port).fetch(path, { ...init, headers });
     if (res.status === 401) {
       rt = await handle.runtime({ force: true });
-      res = await rt.proxy(port).fetch(path, init);
+      res = await rt.proxy(port).fetch(path, { ...init, headers });
     }
     return res;
   };
@@ -2152,7 +2195,7 @@ async function provisionOblien(client, config = {}, onLog) {
     } catch {
     }
   };
-  return { id: workspaceId, workspaceId, baseUrl: SENTINEL_BASE, fetch: fetchImpl, stop };
+  return { id: workspaceId, workspaceId, baseUrl: SENTINEL_BASE, token, fetch: fetchImpl, stop };
 }
 async function importOblien() {
   const spec = "oblien";