omnirush 0.8.5 → 0.9.0

package/src/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// omnirush — launcher for the Omnirush coding agent (pi core).
+// omnirush — launcher for the Omnirush coding agent.
 //
 // The CLI is a thin client of the Omnirush manager (a single public
 // HTTPS origin, real cert — no helper proxy, no custom CA):
@@ -8,15 +8,18 @@
 //                     stored 0600 in ~/.omnirush/auth.json)
 //   omnirush logout   forget the stored tokens
 //   omnirush whoami   show the signed-in device identity
-//   omnirush doctor   check auth (or pending login), manager, pi config
+//   omnirush doctor   check auth (or pending login), manager, agent config
 //   omnirush collect  one-shot workspace snapshot upload
-//   omnirush          run the agent (default; forwards to pi)
+//   omnirush update   update omnirush from npm
+//   omnirush          run the agent (default; forwards to the agent core)
 //
 // Environment:
 //   OMNIRUSH_ORIGIN       manager origin override (default
 //                         https://omnirush.ai/omnirush)
 //   OMNIRUSH_GATEWAY_URL  provider base URL override ({origin}/v1)
 //   OMNIRUSH_DIR          state dir override (default ~/.omnirush)
+//   OMNIRUSH_AGENT_DIR    agent data dir override (default <state dir>/agent;
+//                         OMNIRUSH_PI_AGENT_DIR is the older spelling)
 //   OMNIRUSH_MODEL        model override for plain runs (default
 //                         gpt-6-astra; gpt-6-sol, gpt-5.6-sol and the Muse
 //                         models also available; user
@@ -47,8 +50,11 @@ import {
   withModelDefaults,
   withDefaultThinkingLevel,
   resolveModelDefaults,
+  resolveYolo,
+  yoloBanner,
 } from "./lib.js";
 import { installManagedTools } from "./tools.js";
+import { engineEnvAliases, migrateAgentDir, projectConfigDirName, resolveAgentDir } from "./compat.js";
 import { ensureRuntime, managedBunPath } from "../scripts/postinstall.js";
 import {
   clearAuth,
@@ -60,23 +66,53 @@ import {
   openBrowser,
   pollForToken,
   redactForDisplay,
-  refreshTokens,
   saveAuth,
   savePendingFlow,
   clearPendingFlow,
+  createRefresher,
+  sessionEndedMessage,
 } from "../assets/extensions/omnirush/auth.js";
 
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const OMNI_DIR = omniDir();
-// OMNIRUSH_PI_AGENT_DIR overrides where pi's config/extensions live
-// (tests use it to keep the real ~/.pi untouched).
-const PI_AGENT_DIR = process.env.OMNIRUSH_PI_AGENT_DIR
-  ? path.resolve(process.env.OMNIRUSH_PI_AGENT_DIR)
-  : path.join(os.homedir(), ".pi", "agent");
-const PI_MODELS_JSON = path.join(PI_AGENT_DIR, "models.json");
-const PI_SETTINGS_JSON = path.join(PI_AGENT_DIR, "settings.json");
-const PI_EXT_DIR = path.join(PI_AGENT_DIR, "extensions", "omnirush");
+process.title = "omnirush";
+// The agent core's data (settings, models.json, provider auth, sessions,
+// extensions): <state dir>/agent, or OMNIRUSH_AGENT_DIR. Releases up to
+// 0.8.x used the core's upstream default folder; ensureDirs() copies it
+// over once (src/compat.js) and falls back to it for a run whose copy failed.
+const AGENT = resolveAgentDir(process.env, { stateDir: OMNI_DIR });
+let PI_AGENT_DIR, PI_MODELS_JSON, PI_SETTINGS_JSON, PI_EXT_DIR;
+function useAgentDir(dir) {
+  PI_AGENT_DIR = dir;
+  PI_MODELS_JSON = path.join(dir, "models.json");
+  PI_SETTINGS_JSON = path.join(dir, "settings.json");
+  PI_EXT_DIR = path.join(dir, "extensions", "omnirush");
+}
+useAgentDir(AGENT.dir);
+
+/** One-time copy of the pre-0.9 agent data into the new folder (see src/compat.js). */
+function migrateLegacyAgentData() {
+  if (!AGENT.legacyDir) return;
+  const result = migrateAgentDir({
+    from: AGENT.legacyDir,
+    to: AGENT.dir,
+    onStart: () => console.error(`omnirush: copying your sessions and agent settings to ${AGENT.dir} (one time)...`),
+  });
+  if (result.status === "migrated") {
+    console.error(
+      `omnirush: done (${result.copied} files copied${result.merged ? `, ${result.merged} merged` : ""}; ` +
+        "the previous folder was left as it was).",
+    );
+  } else if (result.status === "failed") {
+    // Never lose data: run on the previous folder and retry next launch.
+    console.error(
+      `omnirush: could not copy your agent data to ${AGENT.dir} (${result.error?.message ?? result.error}); ` +
+        "using the previous folder for this run, retrying next time.",
+    );
+    useAgentDir(AGENT.legacyDir);
+  }
+}
 
 function managerOrigin() {
   return (
@@ -110,11 +146,12 @@ function piPackage() {
 function piEntry() {
   const found = piPackage();
   if (found?.pkg?.bin?.pi) return path.join(found.dir, found.pkg.bin.pi);
-  throw new Error("could not locate the pinned pi CLI (@earendil-works/pi-coding-agent)");
+  throw new Error("could not locate the pinned agent core (broken install). Fix: npm install -g omnirush@latest");
 }
 
 function ensureDirs() {
   fs.mkdirSync(OMNI_DIR, { recursive: true, mode: 0o700 });
+  migrateLegacyAgentData();
   fs.mkdirSync(PI_AGENT_DIR, { recursive: true });
   fs.mkdirSync(PI_EXT_DIR, { recursive: true });
   try {
@@ -162,10 +199,21 @@ async function launchModels(gatewayUrl, accessToken) {
   const base = String(gatewayUrl).replace(/\/+$/, "");
   if (process.env.OMNIRUSH_STATIC_MODELS !== "1" && accessToken) {
     try {
-      const response = await fetch(`${base}/models`, {
-        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+      const get = (token) => fetch(`${base}/models`, {
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
         signal: AbortSignal.timeout(2500),
       });
+      let response = await get(accessToken);
+      if (response.status === 401) {
+        // The stored access token expired (or another process rotated):
+        // refresh now, under the shared lock, so the agent starts with a
+        // working pair on disk.
+        await response.body?.cancel().catch(() => undefined);
+        const outcome = await createRefresher({ dir: OMNI_DIR, origin: managerOrigin() })
+          .recover(accessToken)
+          .catch(() => null);
+        if (outcome?.status === "ok") response = await get(outcome.accessToken);
+      }
       if (response.ok) {
         const payload = await response.json();
         const models = catalogFromGateway(payload);
@@ -221,7 +269,7 @@ function installExtensions() {
     fs.mkdirSync(to, { recursive: true });
     for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
       if (entry.isDirectory()) copy(path.join(from, entry.name), path.join(to, entry.name));
-      else if (entry.name.endsWith(".ts") || entry.name.endsWith(".js")) {
+      else if (entry.name.endsWith(".ts") || entry.name.endsWith(".js") || entry.name.endsWith(".cjs")) {
         fs.copyFileSync(path.join(from, entry.name), path.join(to, entry.name));
       }
     }
@@ -444,15 +492,24 @@ async function cmdLogout() {
   console.log(`Signed out. Credentials removed from ${OMNI_DIR}`);
 }
 
-async function fetchMeWithRefresh(auth) {
+/**
+ * GET /device/me with the current on-disk token; a 401 adopts a pair
+ * another process already rotated, or refreshes under the shared refresh
+ * lock (never a bare refresh that could race a running agent). Resolves
+ * {me} or {me: null, outcome} with the recover() verdict.
+ */
+async function fetchMeWithRefresh() {
   const origin = managerOrigin();
-  let me = await deviceMe(origin, { accessToken: auth.accessToken, fetchImpl: globalThis.fetch });
-  if (me !== null) return { me, auth };
-  // 401: single-flight refresh (rotate both), retry once.
-  const next = await refreshTokens(origin, { refreshToken: auth.refreshToken, fetchImpl: globalThis.fetch });
-  saveAuth(OMNI_DIR, next);
-  me = await deviceMe(origin, { accessToken: next.accessToken, fetchImpl: globalThis.fetch });
-  return { me, auth: next };
+  const refresher = createRefresher({ dir: OMNI_DIR, origin });
+  let token = refresher.accessToken();
+  for (let round = 0; round < 3; round++) {
+    const me = await deviceMe(origin, { accessToken: token, fetchImpl: globalThis.fetch });
+    if (me !== null) return { me };
+    const outcome = await refresher.recover(token);
+    if (outcome.status !== "ok") return { me: null, outcome };
+    token = outcome.accessToken;
+  }
+  return { me: null, outcome: { status: "dead", reason: "session", detail: "access token refused after refresh" } };
 }
 
 async function cmdWhoami() {
@@ -461,9 +518,13 @@ async function cmdWhoami() {
     console.error("Omnirush: not signed in. Run `omnirush login` first.");
     process.exit(1);
   }
-  const { me } = await fetchMeWithRefresh(auth);
+  const { me, outcome } = await fetchMeWithRefresh();
   if (!me) {
-    console.error("Omnirush: credentials rejected — run `omnirush login` again.");
+    console.error(
+      outcome?.status === "transient"
+        ? `Omnirush: cannot reach the manager to verify the session (${outcome.error}) — try again shortly.`
+        : sessionEndedMessage(outcome),
+    );
     process.exit(1);
   }
   console.log(JSON.stringify(redactForDisplay(me), null, 2));
@@ -491,21 +552,19 @@ async function cmdDoctor() {
   const auth = loadAuth(OMNI_DIR);
   if (auth) {
     try {
-      const { me } = await fetchMeWithRefresh(auth);
+      const { me, outcome } = await fetchMeWithRefresh();
       if (me) {
         const label =
           (me && typeof me === "object" && (me.device_name || me.email || me.user_id || me.id)) ||
           "device recognized";
         ok("auth", true, `signed in (${label})`);
+      } else if (outcome?.status === "transient") {
+        ok("auth", false, `cannot verify session (${outcome.error})`);
       } else {
-        ok("auth", false, "credentials rejected — run `omnirush login` again");
+        ok("auth", false, sessionEndedMessage(outcome).replace(/^Omnirush: /, ""));
       }
     } catch (e) {
-      if (e?.name === "RefreshRejectedError") {
-        ok("auth", false, "session expired — run `omnirush login` again");
-      } else {
-        ok("auth", false, `cannot verify session (${e.message})`);
-      }
+      ok("auth", false, `cannot verify session (${e.message})`);
     }
   } else {
     const pending = loadPendingFlow(OMNI_DIR);
@@ -706,21 +765,33 @@ function childEnv(auth) {
   const origin = (process.env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "") ||
     gateway.replace(/\/+$/, "").replace(/\/v1$/, ""); // provider base -> manager origin
   return {
+    // OMNIRUSH_* spellings of the core's own settings (PI_* still work).
+    ...engineEnvAliases(process.env),
+    // Bootstrap values only: the agent (and every sub-agent it spawns)
+    // re-reads the shared auth file in OMNIRUSH_DIR for each request, so
+    // these never go stale in a way that matters.
     OMNIRUSH_TOKEN: auth.accessToken,
     OMNIRUSH_ACCESS_TOKEN: auth.accessToken,
     OMNIRUSH_ORIGIN: origin,
     OMNIRUSH_GATEWAY_URL: gateway,
     OMNIRUSH_DIR: OMNI_DIR,
     // /status shows the CLI version; extensions have no package.json of
-    // their own in ~/.pi, so the launcher hands it over.
+    // their own in the agent dir, so the launcher hands it over.
     OMNIRUSH_VERSION: ownVersion(),
     // The collector reports it as the environment's engine_version.
     OMNIRUSH_ENGINE_VERSION: engineVersion(),
+    // Where this package lives: extensions (copied to the agent dir) load optional
+    // native dependencies from here (voice: @picovoice/pvrecorder-node).
+    OMNIRUSH_PACKAGE_ROOT: path.resolve(__dirname, ".."),
     // The agent resolves its config dir from <APP>_CODING_AGENT_DIR. The
     // branding patch renames the app to omnirush, so set the omnirush
     // spelling; the pi spelling stays for unpatched cores.
     OMNIRUSH_CODING_AGENT_DIR: PI_AGENT_DIR,
     PI_CODING_AGENT_DIR: PI_AGENT_DIR,
+    // Project settings live in <project>/.omnirush; a project that only
+    // has the pre-0.9 folder keeps using that one (the branding patch
+    // makes the core read this variable).
+    OMNIRUSH_PROJECT_CONFIG_DIR: projectConfigDirName(process.cwd()),
     // The agent core is a fork/rebrand: never phone home to pi.dev.
     // PI_OFFLINE kills startup update checks (the "Update Available —
     // pi.dev/changelog" banner), package updates, and install/update
@@ -778,6 +849,32 @@ function spawnAgent(cmd, args, opts) {
   return child;
 }
 
+/** The saved /yolo setting ("yolo": true in <state dir>/settings.json). */
+function yoloSetting() {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(OMNI_DIR, "settings.json"), "utf8"))?.yolo === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Yolo mode for an agent launch: strips --yolo/--no-yolo, adds the core's
+ * --approve (project trusted for the run) and hands the state to the
+ * extensions (OMNIRUSH_YOLO). Non-interactive runs get the banner on
+ * stderr here; the TUI shows it itself (yolo.ts).
+ */
+function launchYolo(args) {
+  const resolved = resolveYolo(args, { env: process.env, setting: yoloSetting() });
+  const env = { OMNIRUSH_YOLO: resolved.yolo ? "1" : "0", OMNIRUSH_YOLO_SOURCE: resolved.source };
+  if (resolved.yolo) {
+    env.OMNIRUSH_YOLO_TRUSTED = resolved.trusted ? "1" : "0";
+    const headless = resolved.args.some((a) => a === "-p" || a === "--print" || a === "--mode") || !process.stdout.isTTY;
+    if (headless) console.error(`omnirush: ${yoloBanner(resolved)}`);
+  }
+  return { args: resolved.args, env };
+}
+
 async function cmdRun() {
   ensureDirs();
   const auth = requireAuth();
@@ -787,10 +884,13 @@ async function cmdRun() {
   const { cmd, args } = await runtimeFor(entry);
   // Plain `omnirush` always runs the SOTA model (charter rule 1); user
   // flags win when present.
-  const piArgs = withModelDefaults([], resolveModelDefaults(process.env));
+  // `omnirush run` takes no other arguments; only yolo's --approve passes.
+  const yolo = launchYolo(process.argv.slice(3).filter((a) => a === "--yolo" || a === "--no-yolo"));
+  const piArgs = withModelDefaults(yolo.args, resolveModelDefaults(process.env));
   spawnAgent(cmd, [...args, ...piArgs], {
     stdio: "inherit",
-    env: { ...process.env, ...childEnv(auth) },
+    // The pair may have rotated during launch (model catalog refresh).
+    env: { ...process.env, ...childEnv(loadAuth(OMNI_DIR) ?? auth), ...yolo.env },
   });
 }
 
@@ -827,8 +927,18 @@ Options:
                                     gpt-5.6-sol, meta-muse-spark, muse-spark-1.1;
                                     effort: minimal..max)
   --thinking <level>                reasoning effort override
+  --subagent-model <id|same>        model the sub-agents run on for this run
+                                    (one of your account's models; default: the
+                                    one picked with /subagents, else the main model)
+  --subagent-effort <level|same>    sub-agent effort for this run (limited to
+                                    that model's levels)
   --strict-sota                     exit non-zero if the served model is not
                                     the requested SOTA model
+  --yolo                            yolo mode for this run: nothing asks, the
+                                    project folder is trusted, every command is
+                                    allowed (default: guarded mode, where git
+                                    writes, destructive commands and sudo ask
+                                    first; --no-yolo turns a saved /yolo on off)
   --session <file> | --continue     session options (forwarded to the agent)
   -p, --print "<prompt>"            print-mode: answer once and exit
   -h, --help                        show this help
@@ -838,6 +948,15 @@ Session commands (inside the agent):
   /usage   detailed usage from the manager (counters + devices)
   /status  session status (identity, model, grant, collector)
   /mcp     MCP server state (/mcp reconnect [server])
+  /subagents  model and effort of the sub-agents (/subagents model <id|same>,
+              /subagents effort <level|same>; saved for the next runs)
+  /agents  sub-agents of this session (/agents cancel <id|all>)
+  /jobs    background shell commands (/jobs kill <id|all>)
+  /voice   dictate prompts: hold Space to talk (/voice hold|tap|off|status)
+  /mode    approval mode: guarded (asks before git writes and destructive
+           commands) or yolo (/mode guarded|yolo; saved); /approvals reset
+           forgets this session's "allow for this session" answers
+  /yolo    yolo mode: no prompts, project trusted (/yolo on|off; saved)
   /verify  model attestation (arrives with the gateway lane)
 
 Environment:
@@ -845,11 +964,106 @@ Environment:
   OMNIRUSH_MODEL         default model override (e.g. gpt-6-sol)
   OMNIRUSH_STATIC_MODELS=1  use the shipped model list (no GET /v1/models)
   OMNIRUSH_DIR           state dir override (default ~/.omnirush)
+  OMNIRUSH_AGENT_DIR     agent data dir override (default ~/.omnirush/agent)
   OMNIRUSH_DEBUG=1       verbose diagnostics (raw gateway errors on failure)
+  OMNIRUSH_SUBAGENT_MODEL / OMNIRUSH_SUBAGENT_EFFORT
+                         sub-agent model / effort for this run (as the flags)
+  OMNIRUSH_YOLO=1        yolo mode (as --yolo; OMNIRUSH_YOLO=0 turns it off)
+  OMNIRUSH_BASH_FOREGROUND_SECONDS
+                         how long a shell command runs in the foreground before
+                         it continues in the background (default 300)
+  OMNIRUSH_<SETTING>     the agent core's own settings (e.g. OMNIRUSH_CACHE_RETENTION;
+                         the older PI_<SETTING> names still work)
 
 Docs: https://omnirush.ai/omnirush — state is stored 0600 in ~/.omnirush`);
 }
 
+/**
+ * `omnirush update` updates omnirush itself from npm. The agent core's own
+ * self-update would install its stock upstream package instead, so only
+ * package and model-catalog updates (--extensions, --extension <source>,
+ * --models, a package source) are handed to the core; --all does both.
+ */
+async function cmdUpdate(args) {
+  if (args.includes("-h") || args.includes("--help")) return runCore(["update", ...args]);
+  const coreArgs = [];
+  let self = false;
+  let coreTarget = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    // "pi" is the core's own alias for self: never let it reach the core.
+    if (arg === "--self" || arg === "self" || arg === "omnirush" || arg === "pi") self = true;
+    else if (arg === "--all") {
+      self = true;
+      coreTarget = true;
+      coreArgs.push("--extensions");
+    } else if (arg === "--force") continue;
+    else {
+      if (arg === "--extensions" || arg === "--models" || arg === "--extension" || !arg.startsWith("-")) coreTarget = true;
+      coreArgs.push(arg);
+      if (arg === "--extension" && i + 1 < args.length) coreArgs.push(args[++i]);
+    }
+  }
+  if (!coreTarget) self = true;
+  if (self) {
+    const status = selfUpdate();
+    if (status !== 0) process.exit(status);
+  }
+  if (coreTarget) await runCore(["update", ...coreArgs]);
+}
+
+function selfUpdate() {
+  const { spawnSync } = require("node:child_process");
+  const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+  const packageRoot = path.resolve(__dirname, "..");
+  let globalRoot = "";
+  try {
+    globalRoot = String(
+      spawnSync(npm, ["root", "-g"], { encoding: "utf8", shell: process.platform === "win32", timeout: 30_000 }).stdout || "",
+    ).trim();
+  } catch {
+    /* npm missing: handled below */
+  }
+  const npmManaged =
+    !!globalRoot && path.relative(path.resolve(globalRoot), packageRoot) === "omnirush";
+  if (!npmManaged) {
+    console.error(
+      `omnirush: this copy (${packageRoot}) was not installed with \`npm install -g omnirush\`. ` +
+        "Update it the way you installed it, or switch to the npm package: npm install -g omnirush@latest",
+    );
+    return 1;
+  }
+  console.log(`Updating omnirush ${ownVersion()}: npm install -g omnirush@latest`);
+  const result = spawnSync(npm, ["install", "-g", "omnirush@latest"], {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+  });
+  if (result.status !== 0) {
+    console.error("omnirush update failed. Run it yourself: npm install -g omnirush@latest");
+    return result.status || 1;
+  }
+  return 0;
+}
+
+// Forward everything else (including argv[0] — e.g. `-p prompt`,
+// `--provider x`, package subcommands) to the agent core, defaulting the
+// model the same way `omnirush run` does; user-specified --provider/--model
+// are never duplicated and core subcommands pass through untouched.
+async function runCore(args) {
+  ensureDirs();
+  const auth = requireAuth();
+  installModelsJson(agentGatewayUrl(auth), await launchModels(agentGatewayUrl(auth), auth.accessToken));
+  installExtensions();
+  const entry = piEntry();
+  const { cmd: bin, args: runtimeArgs } = await runtimeFor(entry);
+  const yolo = launchYolo(args);
+  const piArgs = withModelDefaults(yolo.args, resolveModelDefaults(process.env));
+  spawnAgent(bin, [...runtimeArgs, ...piArgs], {
+    stdio: "inherit",
+    env: { ...process.env, ...childEnv(auth), ...yolo.env },
+  });
+}
+
 const [, , ...argv] = process.argv;
 const cmd = argv[0];
 if (cmd === "-h" || cmd === "--help" || cmd === "help") printHelp();
@@ -860,20 +1074,5 @@ else if (cmd === "doctor") await cmdDoctor();
 else if (cmd === "--version" || cmd === "-v") console.log(`omnirush ${ownVersion()}`);
 else if (cmd === "collect") await cmdCollect(argv.slice(1));
 else if (cmd === undefined || cmd === "run") await cmdRun();
-else {
-  // Forward everything (including argv[0] — e.g. `--help`, `-p prompt`,
-  // `--provider x`) to pi, defaulting the model the same way
-  // `omnirush run` does; user-specified --provider/--model are never
-  // duplicated and pi admin subcommands pass through untouched.
-  ensureDirs();
-  const auth = requireAuth();
-  installModelsJson(agentGatewayUrl(auth), await launchModels(agentGatewayUrl(auth), auth.accessToken));
-  installExtensions();
-  const entry = piEntry();
-  const { cmd: bin, args } = await runtimeFor(entry);
-  const piArgs = withModelDefaults(argv, resolveModelDefaults(process.env));
-  spawnAgent(bin, [...args, ...piArgs], {
-    stdio: "inherit",
-    env: { ...process.env, ...childEnv(auth) },
-  });
-}
+else if (cmd === "update") await cmdUpdate(argv.slice(1));
+else await runCore(argv);