omnara 1.0.1 → 1.0.3

package/dist/bin.js

@@ -98,6 +98,8 @@ __export(sdk_gen_exports, {
   listEvents: () => listEvents,
   listIntegrationInstalls: () => listIntegrationInstalls,
   listMachinePools: () => listMachinePools,
+  listMcpServerTools: () => listMcpServerTools,
+  listMcpServers: () => listMcpServers,
   listMemberProjectAccess: () => listMemberProjectAccess,
   listModelProviderConfigs: () => listModelProviderConfigs,
   listOrgApiKeyProjectAccess: () => listOrgApiKeyProjectAccess,
@@ -153,7 +155,8 @@ __export(sdk_gen_exports, {
   updateOrgMember: () => updateOrgMember,
   updateProjectMachinePoolGrant: () => updateProjectMachinePoolGrant,
   updateProjectModelGrant: () => updateProjectModelGrant,
-  updateSecret: () => updateSecret
+  updateSecret: () => updateSecret,
+  uploadDaemonArtifact: () => uploadDaemonArtifact
 });
 
 // ../sdk/src/generated/core/bodySerializer.gen.ts
@@ -210,7 +213,7 @@ function createSseClient({
   ...options
 }) {
   let lastEventId;
-  const sleep2 = sseSleepFn ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep2 = sseSleepFn ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
   const createStream = async function* () {
     let retryDelay = sseDefaultRetryDelay ?? 3e3;
     let attempt = 0;
@@ -1467,6 +1470,102 @@ var zToolCatalog = z.object({
   custom_tool_permissions: zToolPermissionProfile,
   mcp_tool_permissions: zToolPermissionProfile
 });
+var zMcpRegistryHeader = z.object({
+  name: z.string(),
+  description: z.string().optional(),
+  is_required: z.boolean(),
+  is_secret: z.boolean()
+});
+var zMcpRegistryRemote = z.object({
+  type: z.string(),
+  url: z.string(),
+  headers: z.array(zMcpRegistryHeader).optional()
+});
+var zMcpRegistryIcon = z.object({
+  src: z.string(),
+  mime_type: z.string().optional(),
+  sizes: z.array(z.string()).optional(),
+  theme: z.string().optional()
+});
+var zMcpRegistryServer = z.object({
+  name: z.string(),
+  title: z.string().optional(),
+  description: z.string(),
+  version: z.string(),
+  website_url: z.string().optional(),
+  status: z.string(),
+  updated_at: z.iso.datetime({ offset: true }),
+  remotes: z.array(zMcpRegistryRemote),
+  icons: z.array(zMcpRegistryIcon)
+});
+var zListMcpServersResponse = z.object({
+  data: z.array(zMcpRegistryServer),
+  next_cursor: z.string().nullable()
+});
+var zMcpServerAuthNone = z.object({
+  type: z.enum(["none"])
+});
+var zMcpServerAuthBearer = z.object({
+  type: z.enum(["bearer"]),
+  secret_id: zSecretId
+});
+var zMcpServerAuthOAuth = z.object({
+  type: z.enum(["oauth"]),
+  secret_id: zSecretId
+});
+var zMcpServerAuthSigV4 = z.object({
+  type: z.enum(["sigv4"]),
+  secret_id: zSecretId,
+  service: z.string().min(1).max(64),
+  region: z.string().min(1).max(64)
+});
+var zMcpServerAuth = z.discriminatedUnion("type", [
+  zMcpServerAuthNone.extend({ type: z.literal("none") }),
+  zMcpServerAuthBearer.extend({ type: z.literal("bearer") }),
+  zMcpServerAuthOAuth.extend({ type: z.literal("oauth") }),
+  zMcpServerAuthSigV4.extend({ type: z.literal("sigv4") })
+]);
+var zMcpServerToolsRequest = z.object({
+  url: z.url().min(1).max(2048),
+  auth: zMcpServerAuth
+});
+var zMcpServerAuthHint = z.object({
+  type: z.enum(["oauth", "bearer"]),
+  scopes: z.array(z.string()).optional(),
+  authorization_server: z.string().optional()
+});
+var zMcpServerAuthRequiredError = z.object({
+  error: z.string(),
+  code: z.enum(["unprocessable"]),
+  auth: zMcpServerAuthHint
+});
+var zMcpServerInfo = z.object({
+  name: z.string(),
+  version: z.string(),
+  title: z.string().optional(),
+  description: z.string().optional(),
+  website_url: z.string().optional()
+});
+var zMcpServerToolAnnotations = z.object({
+  title: z.string().optional(),
+  read_only_hint: z.boolean().optional(),
+  destructive_hint: z.boolean().optional(),
+  idempotent_hint: z.boolean().optional(),
+  open_world_hint: z.boolean().optional()
+});
+var zMcpServerTool = z.object({
+  name: z.string(),
+  title: z.string().optional(),
+  description: z.string().optional(),
+  input_schema: z.record(z.string(), z.unknown()),
+  output_schema: z.record(z.string(), z.unknown()).optional(),
+  annotations: zMcpServerToolAnnotations.optional()
+});
+var zMcpServerToolsResponse = z.object({
+  protocol_version: z.string(),
+  server_info: zMcpServerInfo,
+  tools: z.array(zMcpServerTool)
+});
 var zAgentConfigModel = z.object({
   provider_config: zResourceName,
   name: zResourceName,
@@ -1735,6 +1834,7 @@ var zInlineMediaContentBlock = z.object({
 var zMediaRefContentBlock = z.object({
   type: z.enum(["media_ref"]),
   artifact_id: zArtifactId,
+  exclude_from_model_context: z.boolean().optional(),
   metadata: zContentBlockMetadata.optional()
 });
 var zReasoningContentBlock = z.object({
@@ -1777,6 +1877,7 @@ var zAgentInput = z.object({
   delivery_mode: zAgentInputDeliveryMode,
   input_kind: zAgentInputKind,
   actor_id: zActorId.optional(),
+  input_idempotency_key: z.string().optional(),
   content_blocks: z.array(zAgentInputContentBlock).optional(),
   queued_at: zTimestamp
 });
@@ -2547,7 +2648,13 @@ var zCreateMachineRequest = z.object({
 });
 var zConnectByoMachineRequest = z.object({
   display_name: zResourceName,
-  project_ids: z.array(zProjectId).max(100)
+  description: z.string().optional(),
+  cwd: z.string().optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  secret_env: z.record(z.string(), zSecretId).optional(),
+  metadata: zMachineMetadata.optional(),
+  project_ids: z.array(zProjectId).max(100).optional(),
+  token_name: zResourceName.optional()
 });
 var zUpdateMachineRequest = z.object({
   cwd: z.string().optional(),
@@ -2820,6 +2927,9 @@ var zBootstrapDaemonResponse = z.object({
   installation_id: zInstallationId,
   machine_id: zMachineId
 });
+var zUploadArtifactResponse = z.object({
+  artifact_id: zArtifactId
+});
 var zCreateProjectRequest = z.object({
   name: zResourceName
 });
@@ -3275,6 +3385,18 @@ var zCreateAgentConfigPath = z.object({
 });
 var zCreateAgentConfigResponse = zAgentConfig;
 var zGetToolCatalogResponse = zToolCatalog;
+var zListMcpServersQuery = z.object({
+  q: z.string().max(200).optional(),
+  remote_url: z.string().max(2048).optional(),
+  limit: z.int().gte(1).lte(100).optional().default(50),
+  cursor: z.string().max(1024).optional()
+});
+var zListMcpServersResponse2 = zListMcpServersResponse;
+var zListMcpServerToolsPath = z.object({
+  orgID: zOrganizationId,
+  projectID: zProjectId
+});
+var zListMcpServerToolsResponse = zMcpServerToolsResponse;
 var zGetAgentConfigPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   projectID: z.string().regex(/^proj_[a-z2-7]{26}$/),
@@ -3672,7 +3794,6 @@ var zListVisibleMachinesQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListVisibleMachinesResponse2 = zListVisibleMachinesResponse;
-var zCreateMachineBody = zCreateMachineRequest;
 var zCreateMachineHeaders = z.object({
   "Idempotency-Key": z.string().min(1).max(255).optional()
 });
@@ -3680,6 +3801,7 @@ var zCreateMachinePath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/)
 });
 var zCreateMachineResponse = zMachine;
+var zConnectByoMachineBody = zConnectByoMachineRequest;
 var zConnectByoMachinePath = z.object({
   orgID: zOrganizationId
 });
@@ -3905,6 +4027,14 @@ var zGetDaemonSkillArchiveQuery = z.object({
   download_token: z.string().length(64)
 });
 var zGetDaemonSkillArchiveResponse = z.string();
+var zUploadDaemonArtifactBody = z.string();
+var zUploadDaemonArtifactPath = z.object({
+  toolCallID: zToolCallId
+});
+var zUploadDaemonArtifactQuery = z.object({
+  filename: z.string().min(1).max(255)
+});
+var zUploadDaemonArtifactResponse = zUploadArtifactResponse;
 
 // ../sdk/src/validate-response.ts
 function valueAt(data, path) {
@@ -4865,6 +4995,42 @@ var getToolCatalog = (options) => (options?.client ?? client).get({
   url: "/api/v1/tool-catalog",
   ...options
 });
+var listMcpServers = (options) => (options?.client ?? client).get({
+  responseValidator: async (data) => await validateResponse(zListMcpServersResponse2, data),
+  security: [{
+    key: "bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    in: "cookie",
+    name: "__Host-omnara_session",
+    type: "apiKey"
+  }],
+  url: "/api/v1/mcp-servers",
+  ...options
+});
+var listMcpServerTools = (options) => (options.client ?? client).post({
+  responseValidator: async (data) => await validateResponse(zListMcpServerToolsResponse, data),
+  security: [
+    {
+      key: "bearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      in: "cookie",
+      name: "__Host-omnara_session",
+      type: "apiKey"
+    },
+    { name: "X-Omnara-Csrf", type: "apiKey" }
+  ],
+  url: "/api/v1/orgs/{orgID}/projects/{projectID}/mcp-servers/tools",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var getAgentConfig = (options) => (options.client ?? client).get({
   responseValidator: async (data) => await validateResponse(zGetAgentConfigResponse, data),
   security: [{
@@ -5693,11 +5859,19 @@ var createMachine = (options) => (options.client ?? client).post({
 });
 var connectByoMachine = (options) => (options.client ?? client).post({
   responseValidator: async (data) => await validateResponse(zConnectByoMachineResponse2, data),
-  security: [{
-    in: "cookie",
-    name: "__Host-omnara_session",
-    type: "apiKey"
-  }, { name: "X-Omnara-Csrf", type: "apiKey" }],
+  security: [
+    {
+      key: "bearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      in: "cookie",
+      name: "__Host-omnara_session",
+      type: "apiKey"
+    },
+    { name: "X-Omnara-Csrf", type: "apiKey" }
+  ],
   url: "/api/v1/orgs/{orgID}/machines/connect",
   ...options,
   headers: {
@@ -6302,13 +6476,28 @@ var getDaemonSkillArchive = (options) => (options.client ?? client).get({
   url: "/api/v1/daemon/skills/{skillID}/archive",
   ...options
 });
+var uploadDaemonArtifact = (options) => (options.client ?? client).post({
+  bodySerializer: null,
+  responseValidator: async (data) => await validateResponse(zUploadDaemonArtifactResponse, data),
+  security: [{
+    key: "machineDaemonAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/api/v1/daemon/tool-calls/{toolCallID}/artifact",
+  ...options,
+  headers: {
+    "Content-Type": "application/octet-stream",
+    ...options.headers
+  }
+});
 
 // ../sdk/src/auth.ts
 function bearerToken(token) {
-  const resolve2 = typeof token === "function" ? token : () => token;
+  const resolve3 = typeof token === "function" ? token : () => token;
   return {
     async authenticate(request) {
-      const value = await resolve2();
+      const value = await resolve3();
       if (value) request.headers.set("Authorization", `Bearer ${value}`);
     }
   };
@@ -6318,11 +6507,13 @@ function bearerToken(token) {
 var ApiError = class _ApiError extends Error {
   status;
   code;
-  constructor(status, message, code) {
+  body;
+  constructor(status, message, code, body) {
     super(message);
     this.name = "ApiError";
     this.status = status;
     this.code = code;
+    this.body = body;
   }
   static async fromResponse(response) {
     let message = `request failed with status ${response.status}`;
@@ -6341,7 +6532,7 @@ var ApiError = class _ApiError extends Error {
         code = data.code;
       }
     }
-    return new _ApiError(response.status, message, code);
+    return new _ApiError(response.status, message, code, data);
   }
 };
 
@@ -6456,7 +6647,7 @@ async function startDeviceAuth(options) {
   };
 }
 function defaultSleep(seconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, seconds * 1e3));
+  return new Promise((resolve3) => setTimeout(resolve3, seconds * 1e3));
 }
 async function pollDeviceAuthToken(options) {
   const fetchImpl = options.fetch ?? fetch;
@@ -7052,6 +7243,7 @@ function flowOp(spec) {
     type: "flow",
     execute: (input) => run({
       client: input.client,
+      baseUrl: input.baseUrl,
       path: parseWithSchema(spec.path, input.path, "arguments"),
       body: parseWithSchema(spec.body, input.body, "flags"),
       report: createFlowReporter(spec.summary)
@@ -7261,7 +7453,7 @@ function registerOperation(parent, config2, spec) {
         renderResult(data, true);
         return;
       }
-      const formatted = spec.format(data);
+      const formatted = spec.format(data, { baseUrl: config2.baseUrl });
       renderResult(formatted.value, false, { columns: formatted.columns });
     });
   });
@@ -7277,6 +7469,7 @@ function registerFlow(parent, config2, spec) {
       const options = command.opts();
       await spec.execute({
         client: config2.client,
+        baseUrl: config2.baseUrl,
         path: await resolvePathValues(plan, args, options, config2),
         body: collectFlagValues(bodyFlags, options)
       });
@@ -7479,7 +7672,7 @@ function registerLoginCommand(program2, cli) {
 }
 
 // src/manifest.ts
-import * as z13 from "zod";
+import * as z14 from "zod";
 
 // src/config-attachment.ts
 import { readFileSync as readFileSync2 } from "node:fs";
@@ -7574,18 +7767,332 @@ function formatVoid(message = "ok") {
   return () => ({ value: message });
 }
 
+// src/machine-setup.ts
+import { spawn as spawn2, spawnSync } from "node:child_process";
+import { accessSync, constants, existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+import * as z9 from "zod";
+var zMachineSetupBody = zConnectByoMachineRequest;
+async function connectMachine(context) {
+  const { client: client2, path, body, report } = context;
+  report.start("Creating machine with a daemon token");
+  try {
+    const { data } = await sdk_gen_exports.connectByoMachine({ client: client2, path, body });
+    report.stop(`Machine created: ${data.machine.id}`);
+    if (data.project_grants.length > 0) {
+      report.info(`Granted to ${data.project_grants.length} project(s)`);
+    }
+    return data;
+  } catch (error) {
+    report.fail("Machine could not be created");
+    throw error;
+  }
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function installCommand(baseUrl) {
+  return `curl -fsSL ${shellQuote(`${baseUrl}/install/omnarad.sh`)} | sh`;
+}
+var formatMachineSetup = (response, { baseUrl }) => ({
+  value: {
+    ...response,
+    install_command: installCommand(baseUrl),
+    install_note: "Run install_command on the target machine and paste the token when prompted."
+  }
+});
+var daemonConfigFileName = "daemon.json";
+var installLockFileName = "install.lock";
+var daemonLockFileName = "daemon.lock";
+var daemonLockPollMs = 250;
+var zDaemonConfigFile = z9.looseObject({
+  machine_id: z9.string().optional(),
+  api_url: z9.string().optional()
+});
+function daemonHome() {
+  const override = process.env.OMNARA_HOME;
+  if (override !== void 0 && override !== "") {
+    if (!isAbsolute(override) || resolve(override) !== override) {
+      throw new CliInputError("OMNARA_HOME must be an absolute clean path");
+    }
+    if (dirname2(override) === override) {
+      throw new CliInputError("OMNARA_HOME cannot be a filesystem root");
+    }
+    return override;
+  }
+  const userHome = homedir2();
+  if (userHome === "" || !isAbsolute(userHome) || userHome.trim() !== userHome) {
+    throw new CliInputError("HOME must be an absolute path so omnarad can install under ~/.omnarad");
+  }
+  return join2(userHome, ".omnarad");
+}
+var supportedPlatforms = /* @__PURE__ */ new Set(["darwin", "linux"]);
+var supportedArchitectures = /* @__PURE__ */ new Set(["x64", "arm64"]);
+function ensureSupportedPlatform(platform, architecture) {
+  if (!supportedPlatforms.has(platform)) {
+    throw new CliInputError(`omnarad supports macOS and Linux; this machine reports ${platform}`);
+  }
+  if (!supportedArchitectures.has(architecture)) {
+    throw new CliInputError(
+      `omnarad supports amd64 and arm64; this machine reports ${architecture}`
+    );
+  }
+}
+function isLoopbackHost(hostname2) {
+  if (hostname2 === "localhost" || hostname2 === "[::1]" || hostname2 === "::1") return true;
+  const octets = hostname2.split(".");
+  return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d{1,3}$/.test(octet));
+}
+function ensureDaemonApiUrl(raw) {
+  const trimmed = raw.trim();
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new CliInputError(`omnarad rejects the API URL ${raw}: it must be an absolute URL`);
+  }
+  const reject = (reason) => {
+    throw new CliInputError(`omnarad rejects the API URL ${raw}: ${reason}`);
+  };
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    reject("the scheme must be https or loopback http");
+  }
+  if (parsed.hostname === "") reject("a host is required");
+  if (parsed.username !== "" || parsed.password !== "") reject("it must not contain user info");
+  if (trimmed.includes("?") || trimmed.includes("#")) {
+    reject("it must not contain a query or fragment");
+  }
+  const hostname2 = parsed.hostname.toLowerCase();
+  if (parsed.protocol === "http:" && hostname2 !== "host.docker.internal" && !isLoopbackHost(hostname2)) {
+    reject("it must use https unless the host is local");
+  }
+}
+function describeDaemonConfig(configPath) {
+  try {
+    const config2 = zDaemonConfigFile.parse(JSON.parse(readFileSync3(configPath, "utf8")));
+    const details = [
+      ...config2.machine_id === void 0 ? [] : [`machine ${config2.machine_id}`],
+      ...config2.api_url === void 0 ? [] : [`API ${config2.api_url}`]
+    ];
+    return details.length === 0 ? configPath : `${configPath} (${details.join(", ")})`;
+  } catch {
+    return configPath;
+  }
+}
+function describeExistingInstallation(home) {
+  const configPath = join2(home, daemonConfigFileName);
+  if (existsSync2(configPath)) return describeDaemonConfig(configPath);
+  if (!existsSync2(home)) return void 0;
+  const leftovers = readdirSync(home).filter((name) => name !== installLockFileName);
+  return leftovers.length === 0 ? void 0 : `${home} already contains ${leftovers.join(", ")}`;
+}
+function nearestExistingAncestor(path) {
+  const parent = dirname2(path);
+  return existsSync2(path) || parent === path ? path : nearestExistingAncestor(parent);
+}
+function ensureDaemonHomeWritable(home) {
+  const target = nearestExistingAncestor(home);
+  try {
+    accessSync(target, constants.W_OK);
+  } catch {
+    throw new CliInputError(`omnarad cannot be installed because ${target} is not writable`);
+  }
+}
+var DaemonExitError = class extends Error {
+};
+async function runMachineCreateLocal(context) {
+  const { report, baseUrl } = context;
+  ensureSupportedPlatform(process.platform, process.arch);
+  ensureDaemonApiUrl(baseUrl);
+  const home = daemonHome();
+  const existing = describeExistingInstallation(home);
+  if (existing !== void 0) {
+    report.warn(`omnarad is already installed on this computer: ${existing}`);
+    report.info(
+      [
+        "Nothing was created. Check the daemon with: omnarad status, or start it with: omnarad restart",
+        "To connect this computer as a new machine, run: omnarad uninstall, then re-run this command"
+      ].join("\n")
+    );
+    throw new CliInputError("omnarad is already installed on this machine");
+  }
+  ensureDaemonHomeWritable(home);
+  const { machine, token } = await connectMachine(context);
+  report.info(`Machine ID: ${machine.id}`);
+  report.start("Installing omnarad on this machine");
+  try {
+    await runInstaller(report, baseUrl, token, machine.id, home);
+  } catch (error) {
+    if (error instanceof DaemonExitError) {
+      report.fail("omnarad exited after it was installed");
+      report.info(
+        [
+          `omnarad is installed and registered as machine ${machine.id}; nothing needs to be reinstalled.`,
+          "Check the daemon with: omnarad status, or launch it again with: omnarad start"
+        ].join("\n")
+      );
+      throw error;
+    }
+    report.fail("omnarad installation failed");
+    report.info(`Machine daemon token (shown only once):
+${token}`);
+    report.url(
+      "Finish setup by running this, then paste the machine token when prompted",
+      installCommand(baseUrl)
+    );
+    throw error;
+  }
+  report.done();
+}
+function daemonGuidance(machineId) {
+  return [
+    "omnarad is connected to Omnara as this machine.",
+    "Manage the daemon with: omnarad status | stop | restart | uninstall",
+    `Let agents in a project use this machine with: omnara grant machines add --machine-id ${machineId}`,
+    "Learn more: https://docs.omnara.com/machines/connect"
+  ].join("\n");
+}
+var foregroundGuidance = [
+  "No launchd/systemd user service manager is available, so omnarad is running in the foreground.",
+  "Its logs stream below; press Ctrl-C to stop the daemon, and run omnarad start to launch it again."
+].join("\n");
+var serviceManagerCommands = /* @__PURE__ */ new Set(["launchd", "systemd"]);
+function parentProcess(pid) {
+  if (process.platform === "linux") {
+    try {
+      const stat = readFileSync3(`/proc/${pid}/stat`, "utf8");
+      const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const ppid2 = Number(fields[1]);
+      const parentStat = readFileSync3(`/proc/${ppid2}/stat`, "utf8");
+      const command = parentStat.slice(parentStat.indexOf("(") + 1, parentStat.lastIndexOf(")"));
+      return Number.isInteger(ppid2) && ppid2 > 0 ? { pid: ppid2, command } : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  const result = spawnSync("ps", ["-o", "ppid=", "-p", String(pid)], { encoding: "utf8" });
+  const ppid = Number(result.stdout.trim());
+  if (result.status !== 0 || !Number.isInteger(ppid) || ppid <= 0) return void 0;
+  const parent = spawnSync("ps", ["-o", "comm=", "-p", String(ppid)], { encoding: "utf8" });
+  return { pid: ppid, command: basename(parent.stdout.trim()) };
+}
+function classifyDaemonSupervision(daemonPid, installerPid, lookupParent) {
+  let current = daemonPid;
+  for (let depth = 0; depth < 16; depth += 1) {
+    const parent = lookupParent(current);
+    if (parent === void 0) return void 0;
+    if (parent.pid === installerPid) return "foreground";
+    if (parent.pid === 1 || serviceManagerCommands.has(parent.command)) return "service";
+    current = parent.pid;
+  }
+  return void 0;
+}
+function readDaemonLockPid(home) {
+  try {
+    const pid = Number(readFileSync3(join2(home, daemonLockFileName), "utf8").trim());
+    return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function installerScript(baseUrl) {
+  return [
+    "installer=$(mktemp)",
+    `trap 'rm -f "$installer"' EXIT`,
+    `curl -qfsSL --connect-timeout 10 -m 60 --max-redirs 5 --max-filesize 1048576 --proto '=http,https' --proto-redir '=https' -o "$installer" ${shellQuote(`${baseUrl}/install/omnarad.sh`)}`,
+    'sh "$installer"'
+  ].join(" && ");
+}
+function installerFailure(code, signal, log3) {
+  const reason = signal === null ? `exit code ${code}` : `signal ${signal}`;
+  return new Error(`omnarad installer failed (${reason})${log3 === "" ? "" : `
+${log3}`}`);
+}
+function runInstaller(report, baseUrl, token, machineId, home) {
+  return new Promise((resolve3, reject) => {
+    const child = spawn2("/bin/sh", ["-c", installerScript(baseUrl)], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, OMNARA_API_URL: baseUrl, OMNARA_MACHINE_TOKEN: token }
+    });
+    const relay = (signal) => {
+      child.kill(signal);
+    };
+    process.on("SIGINT", relay);
+    process.on("SIGTERM", relay);
+    const buffered = [];
+    let transcript = "";
+    let supervision;
+    const enterForeground = () => {
+      supervision = "foreground";
+      report.stop("omnarad installed");
+      report.info(daemonGuidance(machineId));
+      report.info(foregroundGuidance);
+      for (const [target, data] of buffered) target.write(data);
+    };
+    const lockWatch = setInterval(() => {
+      if (supervision !== void 0 || child.pid === void 0) return;
+      const daemonPid = readDaemonLockPid(home);
+      if (daemonPid === void 0) return;
+      const detected = classifyDaemonSupervision(daemonPid, child.pid, parentProcess);
+      if (detected === "foreground") enterForeground();
+      else if (detected === "service") supervision = "service";
+    }, daemonLockPollMs);
+    const settle = (outcome) => {
+      clearInterval(lockWatch);
+      process.off("SIGINT", relay);
+      process.off("SIGTERM", relay);
+      outcome();
+    };
+    const consume = (stream) => (chunk) => {
+      if (supervision === "foreground") {
+        stream.write(chunk);
+        return;
+      }
+      buffered.push([stream, chunk]);
+      transcript += chunk.toString();
+    };
+    child.stdout.on("data", consume(process.stdout));
+    child.stderr.on("data", consume(process.stderr));
+    child.on("error", (error) => {
+      settle(() => {
+        reject(new Error(`could not run the omnarad installer: ${error.message}`));
+      });
+    });
+    child.on("close", (code, signal) => {
+      settle(() => {
+        const foreground = supervision === "foreground";
+        if (foreground && (code === 0 || signal === "SIGINT")) {
+          report.info("omnarad stopped");
+          resolve3();
+        } else if (foreground) {
+          const reason = signal === null ? `exit code ${code}` : `signal ${signal}`;
+          reject(new DaemonExitError(`omnarad exited while running in the foreground (${reason})`));
+        } else if (code === 0) {
+          report.stop("omnarad installed and started as a background service");
+          for (const [target, data] of buffered) target.write(data);
+          report.info(daemonGuidance(machineId));
+          resolve3();
+        } else {
+          reject(installerFailure(code, signal, transcript.trim()));
+        }
+      });
+    });
+  });
+}
+
 // src/mcp-add.ts
 import { isMap, isScalar as isScalar2, parseDocument } from "yaml";
-import * as z10 from "zod";
+import * as z11 from "zod";
 
 // src/mcp-oauth.ts
-import * as z9 from "zod";
+import * as z10 from "zod";
 
 // src/poll.ts
 var POLL_INTERVAL_SECONDS = 2;
 var MAX_CONSECUTIVE_POLL_FAILURES = 3;
 function sleep(seconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, seconds * 1e3));
+  return new Promise((resolve3) => setTimeout(resolve3, seconds * 1e3));
 }
 async function pollUntilDeadline(options) {
   const deadline = Date.parse(options.expiresAt);
@@ -7627,7 +8134,7 @@ async function authorizeMcpOAuthSecret(options) {
     }
   });
 }
-var zBrowserFlag = z9.boolean().default(true).describe("open the authorization URL in a browser");
+var zBrowserFlag = z10.boolean().default(true).describe("open the authorization URL in a browser");
 function openAuthorizationUrl(report, title, url3, browser) {
   report.url(title, url3);
   if (browser) {
@@ -7663,7 +8170,7 @@ async function runMcpOAuth(context) {
 // src/mcp-add.ts
 var SERVER_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9-]{0,31}$/;
 var zMcpAddBody = zMcpoAuthStartRequest.omit({ owner: true, name: true }).extend({
-  server_name: z10.string().regex(
+  server_name: z11.string().regex(
     SERVER_KEY_PATTERN,
     "must start with a letter and contain at most 32 letters, digits, or hyphens"
   ).describe("MCP server key used in the agent config"),
@@ -7676,7 +8183,7 @@ function targetLabel(target) {
 function serverEntry(url3, secretId) {
   return { url: url3, auth: { type: "oauth", secret_id: secretId } };
 }
-var zJsonRecord = z10.record(z10.string(), z10.json());
+var zJsonRecord = z11.record(z11.string(), z11.json());
 function prepareJsonConfig(config2, serverName, mcpUrl) {
   let parsedJson;
   try {
@@ -7840,18 +8347,18 @@ function runProfileMcpAdd(context) {
 }
 
 // src/skill-archive.ts
-import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
-import { basename, dirname as dirname2, join as join2, resolve } from "node:path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "node:fs";
+import { basename as basename2, dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
 import * as tar from "tar";
-import * as z11 from "zod";
-var zCreateSkillCliBody = z11.object({
+import * as z12 from "zod";
+var zCreateSkillCliBody = z12.object({
   owner: zSkillOwnerInput,
-  archive: z11.string().min(1).describe("path to a skill directory (packed automatically) or a .zip/.tar.gz archive")
+  archive: z12.string().min(1).describe("path to a skill directory (packed automatically) or a .zip/.tar.gz archive")
 });
 var ARCHIVE_SUFFIXES = [".zip", ".tar.gz", ".tgz"];
 function assertPackable(dir) {
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = join2(dir, entry.name);
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const fullPath = join3(dir, entry.name);
     if (entry.isSymbolicLink()) {
       throw new CliInputError(`cannot pack ${fullPath}: symlinks are not allowed in skill archives`);
     }
@@ -7860,9 +8367,9 @@ function assertPackable(dir) {
   }
 }
 async function packDirectory(dir) {
-  const root = resolve(dir);
+  const root = resolve2(dir);
   assertPackable(root);
-  const stream = tar.create({ cwd: dirname2(root), gzip: true, portable: true }, [basename(root)]);
+  const stream = tar.create({ cwd: dirname3(root), gzip: true, portable: true }, [basename2(root)]);
   const chunks = [];
   for await (const chunk of stream) chunks.push(chunk);
   return Buffer.concat(chunks);
@@ -7876,28 +8383,28 @@ async function loadSkillArchive(archivePath) {
   }
   if (isDirectory) {
     const buffer = await packDirectory(archivePath);
-    return new File([new Uint8Array(buffer)], `${basename(resolve(archivePath))}.tar.gz`);
+    return new File([new Uint8Array(buffer)], `${basename2(resolve2(archivePath))}.tar.gz`);
   }
-  const filename = basename(archivePath);
+  const filename = basename2(archivePath);
   if (!ARCHIVE_SUFFIXES.some((suffix) => filename.toLowerCase().endsWith(suffix))) {
     throw new CliInputError(
       `archive must be a directory or a ${ARCHIVE_SUFFIXES.join("/")} file: ${archivePath}`
     );
   }
-  return new File([new Uint8Array(readFileSync3(archivePath))], filename);
+  return new File([new Uint8Array(readFileSync4(archivePath))], filename);
 }
 
 // src/slack-integration.ts
-import * as z12 from "zod";
-var zSlackBody = z12.object({
-  app_name: z12.string().optional().describe("name for a new Slack app"),
-  app_configuration_token: z12.string().optional().describe("Slack app configuration token for a new app"),
-  icon_filename: z12.string().optional().describe("filename for the new Slack app icon"),
-  icon_data_base64: z12.string().optional().describe("base64-encoded Slack app icon"),
-  client_id: z12.string().optional().describe("existing Slack app client ID"),
-  client_secret: z12.string().optional().describe("existing Slack app client secret"),
-  signing_secret: z12.string().optional().describe("existing Slack app signing secret"),
-  return_to: z12.string().optional().describe("console-relative path opened after authorization"),
+import * as z13 from "zod";
+var zSlackBody = z13.object({
+  app_name: z13.string().optional().describe("name for a new Slack app"),
+  app_configuration_token: z13.string().optional().describe("Slack app configuration token for a new app"),
+  icon_filename: z13.string().optional().describe("filename for the new Slack app icon"),
+  icon_data_base64: z13.string().optional().describe("base64-encoded Slack app icon"),
+  client_id: z13.string().optional().describe("existing Slack app client ID"),
+  client_secret: z13.string().optional().describe("existing Slack app client secret"),
+  signing_secret: z13.string().optional().describe("existing Slack app signing secret"),
+  return_to: z13.string().optional().describe("console-relative path opened after authorization"),
   browser: zBrowserFlag
 });
 function parseRequest(body) {
@@ -7926,7 +8433,7 @@ function parseRequest(body) {
     if (!result2.success) {
       throw new CliInputError(
         `invalid existing Slack app parameters:
-${z12.prettifyError(result2.error)}`
+${z13.prettifyError(result2.error)}`
       );
     }
     return { kind: "existing-app", body: result2.data };
@@ -7948,7 +8455,7 @@ ${z12.prettifyError(result2.error)}`
   if (!result.success) {
     throw new CliInputError(
       `invalid Slack app parameters:
-${z12.prettifyError(result.error)}
+${z13.prettifyError(result.error)}
 Pass --app-name and --app-configuration-token, or existing app credentials.`
     );
   }
@@ -8043,7 +8550,7 @@ var commandGroups = [
         body: zConfigAttachment.extend({
           profile: zAgentProfileId.optional(),
           name: zAgentName.optional(),
-          message: z13.string().optional()
+          message: z14.string().optional()
         }),
         transformBody: async ({ profile, name, message, ...attachment }, { client: client2, path }) => ({
           profile,
@@ -8084,7 +8591,7 @@ var commandGroups = [
       flowOp({
         verb: "mcp-add",
         summary: "Create an OAuth secret and add an MCP server to an agent",
-        path: z13.object({
+        path: z14.object({
           orgID: zOrganizationId,
           projectID: zProjectId,
           agentID: zAgentId
@@ -8329,11 +8836,18 @@ var commandGroups = [
       }),
       op({
         verb: "create",
-        summary: "Create a machine",
-        fn: sdk_gen_exports.createMachine,
-        format: formatRecord(),
-        path: zCreateMachinePath,
-        body: zCreateMachineBody
+        summary: "Create a machine with a daemon token and show how to install omnarad",
+        fn: sdk_gen_exports.connectByoMachine,
+        format: formatMachineSetup,
+        path: zConnectByoMachinePath,
+        body: zConnectByoMachineBody
+      }),
+      flowOp({
+        verb: "create-local",
+        summary: "Create a machine and install omnarad on this machine",
+        path: zConnectByoMachinePath,
+        body: zMachineSetupBody,
+        run: runMachineCreateLocal
       }),
       op({
         verb: "update",
@@ -8546,7 +9060,7 @@ var commandGroups = [
       flowOp({
         verb: "mcp-oauth",
         summary: "Create a secret through an MCP server OAuth flow",
-        path: z13.object({ orgID: zOrganizationId }),
+        path: z14.object({ orgID: zOrganizationId }),
         body: zMcpOAuthBody,
         run: runMcpOAuth
       })
@@ -8660,7 +9174,7 @@ var commandGroups = [
       flowOp({
         verb: "mcp-add",
         summary: "Create an OAuth secret and add an MCP server to an agent profile",
-        path: z13.object({
+        path: z14.object({
           orgID: zOrganizationId,
           projectID: zProjectId,
           agentProfileID: zAgentProfileId
@@ -8672,7 +9186,7 @@ var commandGroups = [
         verb: "slack",
         aliases: ["slack-setup"],
         summary: "Connect Slack to an agent profile through OAuth",
-        path: z13.object({
+        path: z14.object({
           orgID: zOrganizationId,
           projectID: zProjectId,
           agentProfileID: zAgentProfileId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnara",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Command-line interface for Omnara: launch and manage agents, organizations, integrations, and MCP servers",
   "license": "Apache-2.0",
   "homepage": "https://omnara.com",