mindwire 0.1.11 → 0.1.13

package/dist/index.d.ts

@@ -32,3 +32,6 @@ export { catalogProviders, catalogProvider, catalogModels, lookupModel, loadCata
 export type { CatalogOptions } from "./catalog/index.js";
 export { MindwireError, ApiError, RunFailedError, TimeoutError } from "./errors.js";
 export * from "./types.js";
+export { WorkspaceApi, WorkspaceCollection, ProjectOperationsApi } from "./workspace.js";
+export type { ProjectRequest, ProjectAuth, ProjectOperation, ProjectRemoveRequest } from "./workspace.js";
+export type { WorkspaceRecord, WorkspaceAgent, WorkspaceProject, WorkspaceChat, WorkspaceKind, WorkspaceInput, WorkspaceImport, WorkspaceSnapshot } from "./workspace.js";

package/dist/index.js

@@ -286,6 +286,8 @@ async function* readSSE(body, signal) {
     if (payload !== void 0) yield JSON.parse(payload);
   } finally {
     if (signal) signal.removeEventListener("abort", onAbort);
+    await reader.cancel().catch(() => {
+    });
     reader.releaseLock();
   }
 }
@@ -410,9 +412,9 @@ var Run = class _Run {
     });
   }
   /**
-   * Switch the permission mode of the live turn (e.g. `default`, `acceptEdits`, `plan`,
-   * `bypassPermissions`). Only meaningful on a persistent (non-bypass) turn; on a one-shot turn it
-   * is a best-effort no-op. Requires the agent's `setPermissionMode` capability.
+   * Switch the live permission mode using a value from the agent's settings schema.
+   * Resolves after the harness acknowledges the change; rejects if it cannot apply it.
+   * Requires `setPermissionMode`. Codex settings apply on the next turn instead.
    */
   async setPermissionMode(mode) {
     await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/set-permission-mode`, {
@@ -472,8 +474,114 @@ var Run = class _Run {
   }
 };
 
+// src/workspace.ts
+var ProjectOperationsApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  async list(activeOnly = false) {
+    const response = await this.mw.http.request("GET", "/workspace/operations", {
+      query: { active: activeOnly }
+    });
+    return response.operations;
+  }
+  get(id) {
+    return this.mw.http.request("GET", `/workspace/operations/${encodeURIComponent(id)}`);
+  }
+  cancel(id) {
+    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/cancel`);
+  }
+  retry(id, auth) {
+    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/retry`, { body: { auth } });
+  }
+  /** The first event is the current snapshot, then live changes. Reconnecting never replays old
+   * progress. Breaking the loop/aborting detaches the observer; cancel(id) explicitly stops work.
+   */
+  async *watch(id, opts = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    opts.signal?.addEventListener("abort", abort, { once: true });
+    if (opts.signal?.aborted) controller.abort();
+    try {
+      const response = await this.mw.http.open("GET", `/workspace/operations/${encodeURIComponent(id)}/stream`, {
+        signal: controller.signal
+      });
+      let sequence = -1;
+      for await (const operation of readSSE(response.body, controller.signal)) {
+        if (operation.sequence > sequence) {
+          sequence = operation.sequence;
+          yield operation;
+        }
+      }
+    } finally {
+      controller.abort();
+      opts.signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+var WorkspaceCollection = class {
+  constructor(mw, kind) {
+    this.mw = mw;
+    this.kind = kind;
+  }
+  mw;
+  kind;
+  /** Create with a stable client-generated ID. For updates, supply the record's last revision. */
+  put(id, record, expectedRevision) {
+    return this.mw.http.request("PUT", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
+      body: { record, expectedRevision }
+    });
+  }
+  /** Remove membership and dependent chat links. Files and native transcripts are retained.
+   * Use deleteChat() for an explicit transcript purge. Running chats reject removal with 409.
+   */
+  delete(id, revision) {
+    return this.mw.http.request("DELETE", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
+      query: { revision }
+    });
+  }
+};
+var WorkspaceApi = class {
+  constructor(mw) {
+    this.mw = mw;
+    this.operations = new ProjectOperationsApi(mw);
+    this.agents = new WorkspaceCollection(mw, "agents");
+    this.projects = new WorkspaceCollection(mw, "projects");
+    this.chats = new WorkspaceCollection(mw, "chats");
+  }
+  mw;
+  operations;
+  agents;
+  projects;
+  chats;
+  snapshot() {
+    return this.mw.http.request("GET", "/workspace");
+  }
+  /** Start an operation owned by the daemon. The same ID/payload returns the existing operation. */
+  createProject(request) {
+    return this.mw.http.request("POST", "/workspace/projects", { body: request });
+  }
+  /** Permanently remove the confirmed project's directory and membership.
+   * projects.delete() retains files. Native harness transcripts are not purged.
+   */
+  removeProjectFiles(id, request) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(id)}/remove`, { body: request });
+  }
+  /** Incremental reconciliation. Pass the previous identity to detect a replaced/restored workspace.
+   * A 409 requires fetching snapshot() again; never apply a delta to a different registry.
+   */
+  changes(since, workspaceId) {
+    return this.mw.http.request("GET", "/workspace/changes", { query: { since, workspaceId } });
+  }
+  /** Import legacy metadata before replacing a local cache. Safe to repeat after interruption. */
+  import(records) {
+    return this.mw.http.request("POST", "/workspace/import", { body: records });
+  }
+};
+
 // src/version.ts
-var SDK_VERSION = "0.1.11" ;
+var SDK_VERSION = "0.1.13" ;
 
 // src/daemon-binary.ts
 function supported(platform, arch) {
@@ -731,6 +839,8 @@ function remote(baseUrl, opts = {}) {
 // src/client.ts
 var handleByTransport = /* @__PURE__ */ new WeakMap();
 var Mindwire = class _Mindwire {
+  /** Workspace registry: saved agent profiles, projects and chat relationships. */
+  workspace;
   http;
   /** The default agent type applied to agent-scoped calls, if set. */
   defaultAgent;
@@ -764,6 +874,7 @@ var Mindwire = class _Mindwire {
       }
     });
     this.defaultAgent = opts.agent;
+    this.workspace = new WorkspaceApi(this);
     this.auth = new AuthApi(this);
     this.prompts = new PromptsApi(this);
     this.mcp = new McpApi(this);
@@ -784,6 +895,7 @@ var Mindwire = class _Mindwire {
     const clone = Object.create(_Mindwire.prototype);
     clone.http = this.http;
     clone.defaultAgent = agent;
+    clone.workspace = new WorkspaceApi(clone);
     clone.auth = new AuthApi(clone);
     clone.prompts = new PromptsApi(clone);
     clone.mcp = new McpApi(clone);
@@ -1306,17 +1418,24 @@ function makeEmit(cfg) {
     }
   };
 }
-var DAEMON_DIR = "/root/.mindwire";
-var BIN = `${DAEMON_DIR}/mindwired`;
-var BIN_NEW = `${BIN}.new`;
-var STATE = `${DAEMON_DIR}/agent-state.json`;
-var LOG = `${DAEMON_DIR}/daemon.log`;
+async function daemonDirectory(host) {
+  const result = await host.exec(["sh", "-lc", 'printf "<<MW_HOME>>%s<<MW_HOME>>" "$HOME"'], { timeoutSeconds: 15 });
+  const runtimeHome = result.stdout?.match(/<<MW_HOME>>([\s\S]*?)<<MW_HOME>>/)?.[1];
+  if (!runtimeHome?.startsWith("/") || runtimeHome.length > 4096 || /[\x00-\x1f\x7f]/.test(runtimeHome)) {
+    throw new MindwireError("mindwire: cannot resolve the runtime user's home directory");
+  }
+  return runtimeHome.replace(/\/+$/, "") + "/.mindwire";
+}
 async function ensureDaemon(host, cfg) {
   const emit2 = makeEmit(cfg);
-  const token = cfg.token ?? (await import('crypto')).randomBytes(32).toString("hex");
+  let token = cfg.token ?? (await import('crypto')).randomBytes(32).toString("hex");
   try {
     await waitHostReady(host);
     emit2({ phase: "connect", message: "runtime ready" });
+    const directory = await daemonDirectory(host);
+    if (!cfg.token) {
+      token = await readWorkspaceToken(host, directory) ?? token;
+    }
     const desired = cfg.desiredVersion ?? SDK_VERSION;
     const health = await probeHealth(host, cfg.port, token);
     if (health.reachable) {
@@ -1337,22 +1456,35 @@ async function ensureDaemon(host, cfg) {
     } else {
       emit2({ phase: "probe", message: "no daemon reachable; deploying" });
     }
-    await deploy(host, cfg, emit2, token);
+    await deploy(host, cfg, emit2, token, directory);
+    if (!cfg.token) token = await readWorkspaceToken(host, directory) ?? token;
     return token;
   } catch (err) {
     emit2({ phase: "error", message: "ensure failed", error: err instanceof Error ? err.message : String(err) });
     throw err;
   }
 }
-async function deploy(host, cfg, emit2, token) {
+async function readWorkspaceToken(host, directory) {
+  const saved = await host.exec(["sh", "-lc", `cat ${shellQuote(directory + "/daemon.token")} 2>/dev/null || true`], { timeoutSeconds: 15 });
+  const candidate = saved.stdout?.trim();
+  return candidate && candidate.length <= 4096 && /^[\x21-\x7e]+$/.test(candidate) ? candidate : void 0;
+}
+async function deploy(host, cfg, emit2, token, directory) {
+  const newPath = directory + "/mindwired.new";
+  const BIN = shellQuote(directory + "/mindwired"), BIN_NEW = shellQuote(newPath);
+  const STATE = shellQuote(directory + "/agent-state.json"), LOG = shellQuote(directory + "/daemon.log");
+  const TOKEN = shellQuote(directory + "/daemon.token");
   const arch = await probeArch(host);
   const desired = cfg.desiredVersion ?? SDK_VERSION;
   let acquire = "";
+  let stagedUpload;
   if (cfg.daemonBin) {
     const binPath = await resolveLinuxDaemon(cfg.daemonBin, arch);
     const bytes = await readBytes(binPath);
     emit2({ phase: "upload", message: `uploading daemon (${arch}, ${formatMiB(bytes.length)})`, arch, bytes: bytes.length });
-    await host.putFile(BIN_NEW, bytes, { mode: "0755" });
+    stagedUpload = `${newPath}-${(await import('crypto')).randomUUID()}`;
+    await host.putFile(stagedUpload, bytes, { mode: "0755" });
+    acquire = `mv -f ${shellQuote(stagedUpload)} ${BIN_NEW}`;
   } else {
     if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(desired)) {
       throw new MindwireError(`mindwire: cannot download daemon for non-release SDK version ${desired}`);
@@ -1383,25 +1515,46 @@ async function deploy(host, cfg, emit2, token) {
   }
   const script = [
     "set -e",
-    `mkdir -p ${DAEMON_DIR}`,
+    `mkdir -p ${shellQuote(directory)}`,
+    // iOS takes this same workspace lock. Unique staging also protects concurrent local uploads.
+    stagedUpload ? `trap ${shellQuote(`rm -f ${shellQuote(stagedUpload)}`)} EXIT` : "",
+    'command -v flock >/dev/null 2>&1 || { echo "MINDWIRE_FAIL flock is required to lock daemon updates"; exit 1; }',
+    `exec 9>${shellQuote(directory + "/daemon-install.lock")}`,
+    'flock -w 360 9 || { echo "MINDWIRE_FAIL another daemon update is still running"; exit 1; }',
+    `mw_token=${shellQuote(token)}`,
+    !cfg.token ? `if [ -s ${TOKEN} ]; then mw_token=$(cat ${TOKEN}); fi` : "",
+    !cfg.forceDeploy ? [
+      `mw_health=$(curl -fsS --max-time 3 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz 2>/dev/null || true)`,
+      `mw_version=$(printf '%s' "$mw_health" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\\([^" ]*\\)".*/\\1/p')`,
+      `if [ -n "$mw_health" ] && ${cfg.autoUpdate ? `[ "$mw_version" = ${shellQuote(desired)} ]` : "true"}; then echo MINDWIRE_READY; exit 0; fi`
+    ].join("\n") : "",
     acquire,
     // Stop a prior daemon by exact process NAME, never `pkill -f <path>`: this whole script (which
     // contains `${BIN}` several times) is the argv of the `bash -lc` shell running it, so a full-cmdline
     // match would SIGTERM our own deploying shell before the daemon ever launches. `-x mindwired` matches
     // only the daemon's comm (`bash`/`pkill` never match), leaving this shell alive.
-    `pkill -x mindwired 2>/dev/null || true`,
+    "if command -v pkill >/dev/null 2>&1; then",
+    "  pkill -x mindwired 2>/dev/null || true",
+    "else",
+    "  for mw_proc in /proc/[0-9]*/comm; do",
+    '    IFS= read -r mw_name 2>/dev/null < "$mw_proc" || continue',
+    '    [ "$mw_name" = mindwired ] || continue',
+    "    mw_pid=${mw_proc#/proc/}; mw_pid=${mw_pid%/comm}",
+    '    kill "$mw_pid" 2>/dev/null || true',
+    "  done",
+    "fi",
     "sleep 0.3",
     `mv -f ${BIN_NEW} ${BIN}`,
     `chmod +x ${BIN}`,
     // Detach so the daemon survives this exec's shell exiting. ADDR=":<port>" binds 0.0.0.0.
-    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE="${cfg.agent}" AGENT_CWD="${cfg.agentCwd}" STATE_PATH="${STATE}" DAEMON_TOKEN=${shellQuote(token)} ${BIN} > ${LOG} 2>&1 < /dev/null &`,
+    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE=${shellQuote(cfg.agent)} AGENT_CWD=${shellQuote(cfg.agentCwd)} STATE_PATH=${STATE} DAEMON_TOKEN="$mw_token" ${BIN} > ${LOG} 2>&1 < /dev/null 9>&- &`,
     // Health-poll from inside the VM (loopback) and emit a marker — exit codes are unreliable here.
-    `for i in $(seq 1 60); do curl -fsS --max-time 2 -H ${shellQuote(`Authorization: Bearer ${token}`)} http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
+    `for i in $(seq 1 60); do curl -fsS --max-time 2 -H "Authorization: Bearer $mw_token" http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
     "echo MINDWIRE_FAIL",
     `tail -n 40 ${LOG} 2>/dev/null || true`
   ].join("\n");
   emit2({ phase: "launch", message: "launching daemon" });
-  const res = await host.exec(["bash", "-lc", script], { timeoutSeconds: 45 });
+  const res = await host.exec(["bash", "-lc", script], { timeoutSeconds: 420 });
   const out = res.stdout ?? "";
   if (!out.includes("MINDWIRE_READY")) {
     throw new MindwireError(
@@ -2306,6 +2459,6 @@ function clearCatalogCache() {
   inflight = null;
 }
 
-export { ApiError, AuthApi, ContainerHost, Http, MODELS_DEV_URL, McpApi, Mindwire, MindwireError, NotifyApi, PromptsApi, ProvidersApi, Run, RunFailedError, SDK_VERSION, TimeoutError, catalogModels, catalogProvider, catalogProviders, clearCatalogCache, docker, ensureDaemon, ensureDaemonBinary, loadCatalog, local, lookupModel, oblien, provisionContainer, provisionDocker, provisionOblien, provisionSsh, provisionSshContainer, remote, resolveLinuxDaemon, ssh, startEmbedded };
+export { ApiError, AuthApi, ContainerHost, Http, MODELS_DEV_URL, McpApi, Mindwire, MindwireError, NotifyApi, ProjectOperationsApi, PromptsApi, ProvidersApi, Run, RunFailedError, SDK_VERSION, TimeoutError, WorkspaceApi, WorkspaceCollection, catalogModels, catalogProvider, catalogProviders, clearCatalogCache, docker, ensureDaemon, ensureDaemonBinary, loadCatalog, local, lookupModel, oblien, provisionContainer, provisionDocker, provisionOblien, provisionSsh, provisionSshContainer, remote, resolveLinuxDaemon, ssh, startEmbedded };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map