owlmem 0.7.6 → 0.7.7

package/README.md

@@ -29,7 +29,7 @@ page, where you sign in and click **Allow**. AI agents can read the setup guide
 
 An AI on your computer normally sees a task only when someone opens it. Auto-wake starts it as soon as it gets one:
 a small background program long-polls OwlMem and runs that AI's command line unattended — Claude Code with
-`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`) — with the task as the prompt. The AI marks the task done or declined as usual.
+`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`) — with the task as the prompt. The AI marks the task done or declined as usual. When a task it gave out is done or declined, it is woken too, to read the result. The program updates itself (from npm, when nothing is running).
 
 When someone turns auto-wake on for an AI in the console and no computer runs it yet, that AI is told so the next time it connects:
 with your OK it runs `npx -y owlmem wake enable` itself and sends you the pairing link to approve.

package/owlmem.mjs

@@ -33,14 +33,15 @@
 // a command (`owlmem run`, vault_run) or is shown (`vault get`, vault_get). A token copied to another machine has no
 // device key there, so standing grants don't apply. Viewing, writing, deleting and exporting always need approval.
 
-import { webcrypto as crypto } from "node:crypto";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, rmSync, statSync, realpathSync, openSync, closeSync, appendFileSync } from "node:fs";
+import { webcrypto as crypto, createHash } from "node:crypto";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, rmSync, statSync, realpathSync, openSync, closeSync, appendFileSync, renameSync } from "node:fs";
+import { gunzipSync } from "node:zlib";
 import { homedir, hostname, userInfo } from "node:os";
 import { join, dirname, basename, relative, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 
-export const VERSION = "0.7.6";
+export const VERSION = "0.7.7";
 const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
 const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
 const enc = new TextEncoder(), dec = new TextDecoder();
@@ -797,7 +798,8 @@ function nextSteps(items, out) {
 // logon task) long-polls OwlMem. When an agent paired with this computer gets a task, it runs that agent's command line
 // unattended (`claude -p`, `codex exec`) with the task as the prompt. The woken AI uses its own OwlMem connection (the one
 // `owlmem install` set up), so it acts as itself. It gets no extra permissions: no --dangerously-* flags; anything that
-// needs a person, it declines with what the person has to do.
+// needs a person, it declines with what the person has to do. When a task the agent gave out is done or declined, it is
+// woken too, to read the result (OwlMem sends those only to 0.7.7 and later).
 // This computer is identified by its device key (device.json); the pairing is approved in the console, where each AI has an
 // auto-wake switch and the computer can be removed. If OwlMem answers 401 (computer removed, AI disconnected, account gone)
 // the program removes its own autostart entry and exits.
@@ -1056,7 +1058,7 @@ export function planWorkdir(task, h = home(), git = gitRun) {
 }
 export function prepareWorkdir(task, plan, dir = DIR, git = gitRun) {
   if (plan.kind === "missing") throw new Fail("the task's directory doesn't exist on this computer: " + plan.dir);
-  if (plan.kind === "scratch") { const cwd = join(wakeDir(dir), "scratch", "task-" + task.id); mkdirSync(cwd, { recursive: true }); return { cwd }; }
+  if (plan.kind === "scratch") { const cwd = join(wakeDir(dir), "scratch", jobName(task)); mkdirSync(cwd, { recursive: true }); return { cwd }; }
   if (plan.kind === "dir") return { cwd: plan.dir };
   const branch = "owlmem/task-" + task.id, wt = join(wakeDir(dir), "worktrees", basename(plan.top) + "-task-" + task.id);
   if (!existsSync(wt)) {
@@ -1069,7 +1071,33 @@ export function prepareWorkdir(task, plan, dir = DIR, git = gitRun) {
   return { cwd: rel ? join(wt, rel) : wt, worktree: wt, branch, repo: plan.top };
 }
 
+// A job from OwlMem is a task given to this AI (type "task"), or the result of a task this AI gave someone else (type "reply":
+// the automatic note sent when that task was done or declined). Older OwlMem servers send no type: a task.
+const isReply = (t) => t?.type === "reply";
+const jobName = (t) => (isReply(t) ? "reply-" : "task-") + t.id;
+const shortName = (who) => { who = String(who || ""); return who.startsWith("user:") ? who.slice(5) : who.includes("/") ? who.split("/").slice(1).join("/") : who; };
+
+// Woken for a reply: read it (kb_inbox marks it read; that's how OwlMem knows it was handled), act on it only if needed.
+export function replyPrompt(r, o = {}) {
+  const by = shortName(r.by), done = r.result === "done", note = String(r.note || "").trim(), mins = o.timeout_min || WAKE_DEFAULTS.timeout_min;
+  if (r.zh) return `奥麦自动唤醒在 ${o.machine || "这台电脑"} 上启动了你（${r.agent}）。没有人在看这个会话，也没人能回答问题。
+
+你派的任务 #${r.task_id}「${r.task_title || ""}」有了结果：${by} ${done ? "完成" : "拒绝"}了，${done ? "结果" : "原因"}：${note || "（没写）"}
+
+先用 kb_inbox 看这封回信（#${r.id}，会标成已读）；需要接着做（换人派、把结果告诉站长、自己补做）就做；没有要做的就直接结束，不要发任何消息。
+不要把密码、令牌、密钥写进任何消息。你有 ${mins} 分钟。
+`;
+  return `OwlMem auto-wake started you (${r.agent}) on ${o.machine || "this computer"}. Nobody is watching this session and nobody can answer questions.
+
+The task you gave out, #${r.task_id} "${r.task_title || ""}", has a result: ${by} ${done ? "finished it" : "declined it"}. ${done ? "Result" : "Reason"}: ${note || "(none given)"}
+
+First read this reply with kb_inbox (#${r.id}; that marks it read). If something needs doing next (hand it to someone else, tell your user the result, do it yourself), do it. If nothing does, just end here and don't send any message.
+Never put passwords, tokens, keys or other secrets in any message. You have ${mins} minutes.
+`;
+}
+
 export function wakePrompt(task, place, o = {}) {
+  if (isReply(task)) return replyPrompt(task, o);
   const id = task.id, mins = o.timeout_min || WAKE_DEFAULTS.timeout_min;
   const where = place.worktree
     ? `Work in ${place.cwd}. It is a separate git worktree of ${place.repo} on the branch ${place.branch}, made for this task so it doesn't collide with other work. Commit your changes on this branch only. Don't merge, rebase or push other branches, and don't touch ${place.repo} itself. Put the branch name in your result so a person can review and merge it.`
@@ -1102,7 +1130,7 @@ export async function runTask(task, cfg, o = {}) {
   const prompt = wakePrompt(task, place, { machine: cfg.machine, timeout_min: cfg.timeout_min });
   const argv = [...cl.command, ...(cl.prompt === "arg" ? [prompt] : [])];
   mkdirSync(join(wakeDir(dir), "logs"), { recursive: true });
-  const logPath = join(wakeDir(dir), "logs", "task-" + task.id + ".log");
+  const logPath = join(wakeDir(dir), "logs", jobName(task) + ".log");
   const fd = openSync(logPath, "a");
   const win = (o.platform || platform()) === "win32";
   const ms = o.timeoutMs ?? (cfg.timeout_min || WAKE_DEFAULTS.timeout_min) * 60000;
@@ -1111,7 +1139,7 @@ export async function runTask(task, cfg, o = {}) {
       let ch, timedOut = false, killer = null;
       try {
         ch = spawn(argv[0], argv.slice(1), { cwd: place.cwd, stdio: ["pipe", fd, fd], detached: !win, shell: win, windowsHide: true,
-          env: { ...process.env, OWLMEM_NO_BROWSER: "1", OWLMEM_WAKE_TASK: String(task.id) } });
+          env: { ...process.env, OWLMEM_NO_BROWSER: "1", [isReply(task) ? "OWLMEM_WAKE_REPLY" : "OWLMEM_WAKE_TASK"]: String(task.id) } });
       } catch (e) { res({ outcome: "error", detail: "couldn't start " + argv[0] + ": " + e.message }); return; }
       const kill = (sig) => { try { if (win) spawnSync("taskkill", ["/T", "/F", "/PID", String(ch.pid)]); else process.kill(-ch.pid, sig); } catch { try { ch.kill(sig); } catch {} } };
       const timer = setTimeout(() => { timedOut = true; kill("SIGTERM"); killer = setTimeout(() => kill("SIGKILL"), 10000); }, ms);
@@ -1168,15 +1196,93 @@ export async function wakeLoop(o) {
     }
     backoff = 0;
     for (const t of r.data.tasks || []) {
-      const plan = o.plan ? o.plan(t) : planWorkdir(t);
-      log("Task #" + t.id + " for " + t.agent + ": starting " + t.client + (plan.dir ? " in " + plan.dir : "") + ".");
+      const plan = isReply(t) ? { kind: "scratch" } : o.plan ? o.plan(t) : planWorkdir(t);      // a reply is read in an empty folder
+      log((isReply(t) ? "Reply #" + t.id + " (task #" + t.task_id + ")" : "Task #" + t.id) + " for " + t.agent + ": starting " + t.client + (plan.dir ? " in " + plan.dir : "") + ".");
       sched.add({ id: t.id, agent: t.agent, lock: plan.lock || null, task: t, plan });
     }
+    // OwlMem says a newer version is out: update only while nothing runs or waits (no task is cut off), then restart
+    if (o.update && newer(r.data.latest, VERSION) && !(r.data.tasks || []).length && sched.size === 0) {
+      if ((await o.update(r.data.latest)) === "restart") return "updated";
+    }
     if (once) return r.data.status;
     if (Date.now() - t0 < 1000 && !(r.data.tasks || []).length) await sleep(1000);       // never spin
   }
 }
 
+// ── auto-wake updates itself ──
+// The program runs its own copy (wake/owlmem.mjs). When OwlMem's poll answer names a newer version (latest), and nothing is
+// running: download that version's package from the npm registry, check it against the registry's sha512, take owlmem.mjs
+// out of it, check that it runs and says it is that version, then swap it in (rename in the same folder, so it's all or
+// nothing) and restart. If anything fails the old copy keeps running, and that version isn't tried again for 24 hours.
+// Restart: on Linux and macOS the program exits with WAKE_RESTART_CODE; the systemd unit (Restart=on-failure) and the
+// LaunchAgent (KeepAlive unless the exit was successful) start it again 30 s later. On Windows nothing watches it, so it
+// starts the new copy itself (detached, like the logon launcher) and then exits.
+export const WAKE_RESTART_CODE = 75;
+const UPDATE_RETRY = 24 * 3600 * 1000;
+const REGISTRY = () => String(process.env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
+export function newer(a, b) {
+  const p = (v) => (/^\d+\.\d+\.\d+$/.test(String(v || "")) ? String(v).split(".").map(Number) : null);
+  const x = p(a), y = p(b);
+  if (!x || !y) return false;
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i];
+  return false;
+}
+// The one file we need from an npm package (.tgz): plain ustar, read in memory.
+export function tarFile(tgz, want = "package/owlmem.mjs") {
+  const t = gunzipSync(tgz);
+  for (let off = 0; off + 512 <= t.length;) {
+    const h = t.subarray(off, off + 512);
+    if (h.every((b) => b === 0)) break;
+    const str = (a, b) => h.subarray(a, b).toString("utf8").replace(/\0.*$/s, "");
+    const name = (str(345, 500) ? str(345, 500) + "/" : "") + str(0, 100), size = parseInt(str(124, 136).trim() || "0", 8), type = str(156, 157);
+    if ((type === "0" || type === "") && name === want) return t.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+// → "restart" (new copy in place) | "skip" (tried that version less than 24 h ago) | "failed" (old copy stays)
+export async function wakeUpdate(latest, o = {}) {
+  const dir = o.dir || DIR, log = o.log || (() => {}), now = o.now || Date.now, get = o.fetch || fetch;
+  const wd = wakeDir(dir), state = join(wd, "update.json"), target = join(wd, "owlmem.mjs"), tmpFile = join(wd, "owlmem.update.mjs");
+  let st = {}; try { st = JSON.parse(readFileSync(state, "utf8")); } catch {}
+  if (st.version === latest && now() - (st.at || 0) < UPDATE_RETRY) return "skip";
+  try { mkdirSync(wd, { recursive: true }); writeFileSync(state, JSON.stringify({ version: latest, at: now() }) + "\n"); } catch {}
+  log("Updating auto-wake from " + VERSION + " to " + latest + ".");
+  try {
+    const meta = await get(REGISTRY() + "/owlmem/" + encodeURIComponent(latest), { signal: AbortSignal.timeout(60000) });
+    if (!meta.ok) throw new Error("registry answered HTTP " + meta.status);
+    const dist = (await meta.json())?.dist || {};
+    const m = /^sha512-(.+)$/.exec(String(dist.integrity || ""));
+    if (!dist.tarball || !m) throw new Error("the registry gave no package or checksum");
+    const res = await get(dist.tarball, { signal: AbortSignal.timeout(120000) });
+    if (!res.ok) throw new Error("download answered HTTP " + res.status);
+    const tgz = Buffer.from(await res.arrayBuffer());
+    if (createHash("sha512").update(tgz).digest("base64") !== m[1]) throw new Error("the download doesn't match the registry's checksum");
+    const file = tarFile(tgz);
+    if (!file) throw new Error("owlmem.mjs isn't in the package");
+    writeFileSync(tmpFile, file);
+    const check = (o.check || ((f) => { const r = spawnSync(process.execPath, [f, "--version"], { encoding: "utf8", timeout: 30000, env: { ...process.env, OWLMEM_NO_BROWSER: "1" } }); return (r.stdout || "").trim(); }))(tmpFile);
+    if (check !== latest) throw new Error("the new copy says it is " + JSON.stringify(check) + ", not " + latest);
+    renameSync(tmpFile, target);
+  } catch (e) {
+    rmSync(tmpFile, { force: true });
+    log("Update to " + latest + " failed (" + (e?.message || e) + "); keeping " + VERSION + " and not trying " + latest + " again for 24 hours.");
+    return "failed";
+  }
+  log("Updated auto-wake to " + latest + "; restarting.");
+  return "restart";
+}
+// After an update: come back as the new copy (see above).
+export function wakeRestart(o = {}) {
+  const p = o.platform || platform(), exit = o.exit || ((c) => process.exit(c));
+  if (p === "win32") {
+    const run = o.spawn || ((argv) => spawn(argv[0], argv.slice(1), { stdio: "ignore", detached: true, windowsHide: true, env: process.env }).on("error", () => {}).unref());
+    run([process.execPath, join(wakeDir(o.dir || DIR), "owlmem.mjs"), "wake", "run"]);
+    return exit(0);
+  }
+  return exit(WAKE_RESTART_CODE);
+}
+
 function wakeApi() {
   return async (sub, body) => {
     const url = BASE + "/v1/wake/" + sub;
@@ -1204,7 +1310,7 @@ async function wakeRun() {
   if (!cfg) throw new Fail("Auto-wake isn't set up on this computer. Run: npx -y owlmem wake enable");
   const log = wakeLogger(), api = wakeApi();
   const report = async (j, res) => {
-    log("Task #" + j.id + ": " + res.outcome + (res.code != null ? " (exit code " + res.code + ")" : "") + (res.detail ? " — " + res.detail : ""));
+    log((isReply(j.task) ? "Reply #" : "Task #") + j.id + ": " + res.outcome + (res.code != null ? " (exit code " + res.code + ")" : "") + (res.detail ? " — " + res.detail : ""));
     for (let i = 0; i < 5; i++) {
       const r = await api("report", { id: j.id, outcome: res.outcome, code: res.code ?? null, detail: res.detail || "" });
       if (r.status === 200 || r.status === 404 || r.status === 401) return;
@@ -1213,8 +1319,10 @@ async function wakeRun() {
   };
   const sched = new Scheduler({ max: cfg.max_parallel || WAKE_DEFAULTS.max_parallel, start: (j) => runTask(j.task, cfg, { plan: j.plan }), onDone: (j, res) => { report(j, res); } });
   log("OwlMem auto-wake " + VERSION + " running on " + (cfg.machine || hostname()) + ".");
-  const out = await wakeLoop({ cfg, api, sched, log, cleanup: () => { try { wakeUninstall(autostartOpts(), wakeRunCmd, true); } catch (e) { log("cleanup: " + e.message); } } });
+  const out = await wakeLoop({ cfg, api, sched, log, update: (v) => wakeUpdate(v, { log }),
+    cleanup: () => { try { wakeUninstall(autostartOpts(), wakeRunCmd, true); } catch (e) { log("cleanup: " + e.message); } } });
   if (out === "revoked") process.exit(0);
+  if (out === "updated") wakeRestart();
 }
 
 // No command line auto-wake can start: tell OwlMem support which AI apps this computer has, so it can add them. Only the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlmem",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.",
   "type": "module",
   "bin": { "owlmem": "owlmem.mjs" },