nodal-agents 0.1.2 → 0.1.4

package/README.md

@@ -1,81 +1,81 @@
-# Nodal-Agents
-
-Local-first AI agent platform. Self-host on Mac, PC, Linux, VPS, or NAS in 3 commands.
-
-## Install in 30 seconds (Docker)
-
-Works on any host with Docker — Mac, PC, Linux, VPS, Synology / Unraid / TrueNAS NAS, Raspberry Pi.
-
-```bash
-curl -O https://raw.githubusercontent.com/Kwintspiracy/nodal-agents/main/docker-compose.yml
-docker compose up -d
-```
-
-Open <http://localhost:3000> — Nodal-Agents is running. Configure your LLM provider from **Settings → LLM keys** in the dashboard.
-
-Data (config, postgres, logs) lives in the `nodal-data` Docker volume. To wipe everything: `docker compose down -v`.
-
-The image is published to `ghcr.io/kwintspiracy/nodal-agents:latest` (multi-arch: amd64 + arm64). To pin a version, replace `latest` with a release tag (e.g. `v0.1.0`).
-
-### Build the image locally
-
-If you'd rather build from source instead of pulling the published image:
-
-```bash
-git clone https://github.com/Kwintspiracy/nodal-agents.git
-cd nodal-agents
-docker compose build
-docker compose up -d
-```
-
-(Comment the `image:` line and uncomment `build: .` in `docker-compose.yml`.)
-
-## Developer setup (monorepo)
-
-```bash
-pnpm install
-pnpm typecheck
-pnpm lint
-pnpm test
-pnpm --filter nodal-agents dev   # CLI in tsx watch mode
-```
-
-## Monorepo structure
-
-- `apps/web` — Next.js dashboard (UI)
-- `apps/runner` — Agent runtime (HTTP API, job execution, cron ticker)
-- `apps/cli` — `nodal-agents` install + ops command
-- `packages/db` — Drizzle schema + migrations + client (only place that imports postgres)
-- `packages/shared` — Zod types and constants shared across web + runner
-- `packages/llm` — Vercel AI SDK wrapper, multi-provider abstraction
-- `packages/tools` — Tool registration + execution + approval gates
-- `packages/memory` — Agent memory CRUD + embeddings
-- `packages/orchestration` — Router + Planner patterns (delegation, task board)
-- `packages/runner-adapters` — Connectors: notion, drive, gmail, sheets, etc.
-- `packages/delivery` — Telegram, email, future Slack/Discord
-- `packages/auth` — Pluggable auth provider (local-trust default, better-auth opt-in, bearer-token for LAN)
-
-## Architecture rules (enforced by `dependency-cruiser`)
-
-- `apps/*` may import `packages/*`, never the reverse
-- `apps/web` and `apps/runner` cannot import each other (DB or HTTP only)
-- Only `packages/db` may import postgres clients (`pg`, `postgres`, `drizzle-orm`)
-- `packages/runner-adapters/*` may only import from `packages/tools` and `packages/shared`
-- No circular dependencies
-
-Run `pnpm deps:check` locally before pushing.
-
-## Stack
-
-- **Runtime:** Node 22+, TypeScript strict
-- **Monorepo:** pnpm workspaces + Turborepo
-- **DB:** embedded-postgres (local + Docker), Drizzle ORM, pgvector
-- **Validation:** Zod
-- **HTTP server:** Hono (runner)
-- **LLM:** Vercel AI SDK
-- **Auth:** local-trust (single-user loopback) / local-auth (better-auth, multi-user LAN) / bearer-token
-- **Tests:** Vitest (unit), Playwright (e2e), dependency-cruiser (architecture)
-
-## License
-
-TBD.
+# Nodal-Agents
+
+Local-first AI agent platform. Self-host on Mac, PC, Linux, VPS, or NAS in 3 commands.
+
+## Install in 30 seconds (Docker)
+
+Works on any host with Docker — Mac, PC, Linux, VPS, Synology / Unraid / TrueNAS NAS, Raspberry Pi.
+
+```bash
+curl -O https://raw.githubusercontent.com/Kwintspiracy/nodal-agents/main/docker-compose.yml
+docker compose up -d
+```
+
+Open <http://localhost:3000> — Nodal-Agents is running. Configure your LLM provider from **Settings → LLM keys** in the dashboard.
+
+Data (config, postgres, logs) lives in the `nodal-data` Docker volume. To wipe everything: `docker compose down -v`.
+
+The image is published to `ghcr.io/kwintspiracy/nodal-agents:latest` (multi-arch: amd64 + arm64). To pin a version, replace `latest` with a release tag (e.g. `v0.1.0`).
+
+### Build the image locally
+
+If you'd rather build from source instead of pulling the published image:
+
+```bash
+git clone https://github.com/Kwintspiracy/nodal-agents.git
+cd nodal-agents
+docker compose build
+docker compose up -d
+```
+
+(Comment the `image:` line and uncomment `build: .` in `docker-compose.yml`.)
+
+## Developer setup (monorepo)
+
+```bash
+pnpm install
+pnpm typecheck
+pnpm lint
+pnpm test
+pnpm --filter nodal-agents dev   # CLI in tsx watch mode
+```
+
+## Monorepo structure
+
+- `apps/web` — Next.js dashboard (UI)
+- `apps/runner` — Agent runtime (HTTP API, job execution, cron ticker)
+- `apps/cli` — `nodal-agents` install + ops command
+- `packages/db` — Drizzle schema + migrations + client (only place that imports postgres)
+- `packages/shared` — Zod types and constants shared across web + runner
+- `packages/llm` — Vercel AI SDK wrapper, multi-provider abstraction
+- `packages/tools` — Tool registration + execution + approval gates
+- `packages/memory` — Agent memory CRUD + embeddings
+- `packages/orchestration` — Router + Planner patterns (delegation, task board)
+- `packages/runner-adapters` — Connectors: notion, drive, gmail, sheets, etc.
+- `packages/delivery` — Telegram, email, future Slack/Discord
+- `packages/auth` — Pluggable auth provider (local-trust default, better-auth opt-in, bearer-token for LAN)
+
+## Architecture rules (enforced by `dependency-cruiser`)
+
+- `apps/*` may import `packages/*`, never the reverse
+- `apps/web` and `apps/runner` cannot import each other (DB or HTTP only)
+- Only `packages/db` may import postgres clients (`pg`, `postgres`, `drizzle-orm`)
+- `packages/runner-adapters/*` may only import from `packages/tools` and `packages/shared`
+- No circular dependencies
+
+Run `pnpm deps:check` locally before pushing.
+
+## Stack
+
+- **Runtime:** Node 22+, TypeScript strict
+- **Monorepo:** pnpm workspaces + Turborepo
+- **DB:** embedded-postgres (local + Docker), Drizzle ORM, pgvector
+- **Validation:** Zod
+- **HTTP server:** Hono (runner)
+- **LLM:** Vercel AI SDK
+- **Auth:** local-trust (single-user loopback) / local-auth (better-auth, multi-user LAN) / bearer-token
+- **Tests:** Vitest (unit), Playwright (e2e), dependency-cruiser (architecture)
+
+## License
+
+TBD.

package/cli.js

@@ -12323,6 +12323,16 @@ var init_agents = __esm({
         avatarUrl: text("avatar_url"),
         systemAgent: boolean("system_agent").default(false),
         maxTokensPerJob: integer("max_tokens_per_job").default(0).notNull(),
+        // Cap on characters of agent_memory injected into the system prompt per job
+        // (Memory Sprint 2). Pure char budget — token estimation done at call site
+        // (length/4). 1500 chars ≈ ~375 tokens, similar to Hermes' 2200+1375 split.
+        memoryTokenBudget: integer("memory_token_budget").default(1500).notNull(),
+        // Absolute filesystem path the agent's file_* tools are scoped to. NULL =
+        // file tools fail loud (`workspace_not_configured`). Per-agent so each
+        // agent in an entity can have its own scope (e.g. one agent on Obsidian
+        // vault, another on a code repo). Resolution at tool-call time runs
+        // through realpath + boundary check (see file-ops/workspace.ts).
+        workspaceRootPath: text("workspace_root_path"),
         createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
       },
@@ -12387,7 +12397,7 @@ var init_jobs = __esm({
       {
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
-        agentId: uuid("agent_id").references(() => agents.id),
+        agentId: uuid("agent_id").references(() => agents.id, { onDelete: "cascade" }),
         status: text("status").default("pending"),
         channel: text("channel").notNull(),
         task: text("task").notNull(),
@@ -12407,6 +12417,21 @@ var init_jobs = __esm({
         inputTokens: integer("input_tokens").default(0),
         outputTokens: integer("output_tokens").default(0),
         delegationDepth: integer("delegation_depth").default(0),
+        /**
+         * The slug of the last delegated child that failed on this parent job.
+         * Set by `resumeDelegated` when a child returns `{status:'failed'}`, cleared
+         * when any subsequent delegation succeeds. The runner uses this to block
+         * NAIVE retries (parent re-emitting `assign_<sameSlug>` immediately after a
+         * failure) while still allowing FALLBACK strategies (parent emitting
+         * `assign_<differentSlug>` after a failure, e.g. note-taker as a fallback
+         * after summarizer timeout).
+         *
+         * Replaces the earlier `failed_delegations_count` global counter from
+         * commit `b76d449`, which was too coarse — it blocked ALL further
+         * delegations after one failure, including legitimate fallbacks to a
+         * different specialist (live regression: job `7767a3c1`, 2026-05-19).
+         */
+        lastFailedDelegationSlug: text("last_failed_delegation_slug"),
         pendingDelegation: jsonb("pending_delegation"),
         completedAt: timestamp("completed_at", { withTimezone: true }),
         createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
@@ -12458,8 +12483,12 @@ var init_tasks = __esm({
         priority: text("priority").notNull().default("medium"),
         jobId: uuid("job_id").references(() => agentJobs.id, { onDelete: "set null" }),
         result: text("result"),
-        createdByAgentId: uuid("created_by_agent_id").references(() => agents.id),
-        assignedAgentId: uuid("assigned_agent_id").references(() => agents.id),
+        createdByAgentId: uuid("created_by_agent_id").references(() => agents.id, {
+          onDelete: "cascade"
+        }),
+        assignedAgentId: uuid("assigned_agent_id").references(() => agents.id, {
+          onDelete: "cascade"
+        }),
         inputTokens: integer("input_tokens").default(0),
         outputTokens: integer("output_tokens").default(0),
         costUsd: numeric("cost_usd", { precision: 10, scale: 6 }).default("0"),
@@ -12562,8 +12591,10 @@ var init_connectors = __esm({
         check(
           "connectors_auth_type_check",
           sql`${table.authType} IN ('api_key','oauth2','bearer','basic','none')`
-        ),
-        unique("connectors_entity_slug_unique").on(table.entityId, table.slug)
+        )
+        // Multi-instance brique (migration 0016): the (entity_id, slug) UNIQUE
+        // constraint was dropped to allow multiple instances of the same connector
+        // type per entity (e.g. several Gmail accounts).
       ]
     );
   }
@@ -12617,7 +12648,7 @@ var init_approvals = __esm({
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
         jobId: uuid("job_id").notNull().references(() => agentJobs.id, { onDelete: "cascade" }),
-        agentId: uuid("agent_id").references(() => agents.id),
+        agentId: uuid("agent_id").references(() => agents.id, { onDelete: "cascade" }),
         toolName: text("tool_name").notNull(),
         toolInput: jsonb("tool_input").notNull(),
         status: text("status").default("pending"),
@@ -12689,7 +12720,7 @@ var init_memory2 = __esm({
       {
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
-        agentId: uuid("agent_id").references(() => agents.id),
+        agentId: uuid("agent_id").references(() => agents.id, { onDelete: "cascade" }),
         fact: text("fact").notNull(),
         category: text("category").default("context"),
         importance: integer("importance").default(3),
@@ -12892,7 +12923,7 @@ var init_runs = __esm({
       {
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
-        agentId: uuid("agent_id").references(() => agents.id),
+        agentId: uuid("agent_id").references(() => agents.id, { onDelete: "cascade" }),
         task: text("task").notNull(),
         result: text("result"),
         success: boolean("success").default(true),
@@ -12939,12 +12970,32 @@ var init_mcp = __esm({
         command: text("command"),
         args: text("args").array().default(sql`'{}'::text[]`),
         envVars: jsonb("env_vars").default(sql`'{}'::jsonb`),
+        // Encrypted (enc:v1: blob) credential for HTTP MCP servers — same pattern
+        // as connectors.api_key. NULL for servers that need no auth.
+        apiKey: text("api_key"),
+        // Plaintext last 4 chars of the key for masked UI display only.
+        apiKeyLast4: text("api_key_last4"),
+        // How the API key is injected into the HTTP request: 'header' (a request
+        // header named by auth_param_name) or 'query' (a URL query param). NULL =
+        // no auth.
+        authScheme: text("auth_scheme"),
+        // The literal header name or query param name (e.g. 'x-api-key', 'api_key').
+        authParamName: text("auth_param_name"),
         active: boolean("active").default(true),
         availableTools: jsonb("available_tools"),
         createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
       },
-      (table) => [check("mcp_servers_transport_check", sql`${table.transport} IN ('http','stdio')`)]
+      (table) => [
+        check("mcp_servers_transport_check", sql`${table.transport} IN ('http','stdio')`),
+        check(
+          "mcp_servers_auth_scheme_check",
+          sql`${table.authScheme} IN ('header','query') OR ${table.authScheme} IS NULL`
+        )
+        // Multi-instance brique (migration 0017): the (entity_id, slug) UNIQUE
+        // index was dropped to allow multiple instances of the same MCP server
+        // type per entity (e.g. two Cogni Cortex accounts).
+      ]
     );
     agentMcpServers = pgTable(
       "agent_mcp_servers",
@@ -12959,7 +13010,10 @@ var init_mcp = __esm({
       },
       (table) => [
         index("idx_agent_mcp_servers_agent").on(table.agentId),
-        index("idx_agent_mcp_servers_entity").on(table.entityId)
+        index("idx_agent_mcp_servers_entity").on(table.entityId),
+        // Backs the assign/unassign UPSERT (onConflictDoUpdate) — one assignment
+        // row per (agent, server).
+        uniqueIndex("agent_mcp_servers_agent_server_unique").on(table.agentId, table.mcpServerId)
       ]
     );
     mcpConnections = pgTable(
@@ -13787,16 +13841,19 @@ async function runUp(opts = {}) {
     await pg.stop();
     throw err;
   }
-  const seedSpinner = ora2("Seeding default user and agent\u2026").start();
-  try {
-    const { db, close } = createClient(databaseUrl, { max: 5 });
-    await seedDefaultUserEntityAgent(db, config.llm?.model ?? null);
-    await close();
-    seedSpinner.succeed(chalk2.green("Seed complete"));
-  } catch (err) {
-    seedSpinner.fail("Seed failed");
-    await pg.stop();
-    throw err;
+  const authMode = resolveAuthMode(config);
+  if (authMode === "local-trust") {
+    const seedSpinner = ora2("Seeding default user and agent\u2026").start();
+    try {
+      const { db, close } = createClient(databaseUrl, { max: 5 });
+      await seedDefaultUserEntityAgent(db, config.llm?.model ?? null);
+      await close();
+      seedSpinner.succeed(chalk2.green("Seed complete"));
+    } catch (err) {
+      seedSpinner.fail("Seed failed");
+      await pg.stop();
+      throw err;
+    }
   }
   const runnerEnv = buildEnvForRunner(config, databaseUrl);
   const runnerSpinner = ora2("Starting runner\u2026").start();