owlmem 0.7.7 → 0.7.9

package/owlmem.mjs

@@ -41,7 +41,7 @@ import { join, dirname, basename, relative, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 
-export const VERSION = "0.7.7";
+export const VERSION = "0.7.9";
 const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
 const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
 const enc = new TextEncoder(), dec = new TextDecoder();
@@ -803,10 +803,13 @@ function nextSteps(items, out) {
 // This computer is identified by its device key (device.json); the pairing is approved in the console, where each AI has an
 // auto-wake switch and the computer can be removed. If OwlMem answers 401 (computer removed, AI disconnected, account gone)
 // the program removes its own autostart entry and exits.
+// The OwlMem tools an unattended wake run may call without asking: answer the task, read its inbox, and send (report the
+// result to its person, hand work on). 0.7.8 added kb_send (站长 10-28).
+export const WAKE_TOOLS = ["kb_task_update", "kb_inbox", "kb_send"];
 export const WAKE_CLIENTS = {
   "claude-code": { name: "Claude Code", bin: "claude",
-    // -p runs one prompt and exits; it may only use the two OwlMem tools it needs to report back, beyond what your own settings allow
-    command: ["claude", "-p", "--allowedTools", "mcp__owlmem__kb_task_update,mcp__owlmem__kb_inbox"], prompt: "stdin" },
+    // -p runs one prompt and exits; it may only use the OwlMem tools in WAKE_TOOLS, beyond what your own settings allow
+    command: ["claude", "-p", "--allowedTools", WAKE_TOOLS.map((n) => "mcp__owlmem__" + n).join(",")], prompt: "stdin" },
   codex: { name: "Codex", bin: "codex", command: ["codex", "exec", "--skip-git-repo-check", "-"], prompt: "stdin" },
   // agy -p takes the prompt as an argument; headless it denies MCP tools unless settings.json allows them (see allowAntigravity)
   antigravity: { name: "Antigravity", bin: "agy", home: [[".gemini", "bin", "agy"]], command: ["agy", "-p"], prompt: "arg" },
@@ -826,21 +829,21 @@ export function wakeBin(c, home_ = home(), exists = existsSync, path = onPath) {
   }
   return null;
 }
-// codex exec runs with approval "never", so an MCP call that needs approval is refused: approve just the two OwlMem
-// tools it needs to report back, as tool tables under the [mcp_servers.owlmem] that install wrote (append only)
+// codex exec runs with approval "never", so an MCP call that needs approval is refused: approve just the OwlMem
+// tools in WAKE_TOOLS, as tool tables under the [mcp_servers.owlmem] that install wrote (append only)
 export function allowCodex(home_ = home()) {
   const f = join(process.env.CODEX_HOME || join(home_, ".codex"), "config.toml");
   let t; try { t = readFileSync(f, "utf8"); } catch { return false; }
   if (!/^\[mcp_servers\.owlmem\]\s*$/m.test(t)) return false;
-  const add = ["kb_task_update", "kb_inbox"].filter((n) => !new RegExp("^\\[mcp_servers\\.owlmem\\.tools\\." + n + "\\]\\s*$", "m").test(t));
+  const add = WAKE_TOOLS.filter((n) => !new RegExp("^\\[mcp_servers\\.owlmem\\.tools\\." + n + "\\]\\s*$", "m").test(t));
   if (!add.length) return false;
-  writeFileSync(f, t.replace(/\n*$/, "\n") + "\n# OwlMem auto-wake: unattended codex exec may call these two OwlMem tools to report back\n" +
+  writeFileSync(f, t.replace(/\n*$/, "\n") + "\n# OwlMem auto-wake: unattended codex exec may call these OwlMem tools to report back\n" +
     add.map((n) => `[mcp_servers.owlmem.tools.${n}]\napproval_mode = "approve"\n`).join("\n"));
   return true;
 }
-// Antigravity's CLI reads ~/.gemini/antigravity-cli/settings.json: add only the two rules it needs to report back
+// Antigravity's CLI reads ~/.gemini/antigravity-cli/settings.json: add only the rules for WAKE_TOOLS
 export function allowAntigravity(home_ = home()) {
-  const f = join(home_, ".gemini", "antigravity-cli", "settings.json"), need = ["mcp(owlmem/kb_task_update)", "mcp(owlmem/kb_inbox)"];
+  const f = join(home_, ".gemini", "antigravity-cli", "settings.json"), need = WAKE_TOOLS.map((n) => "mcp(owlmem/" + n + ")");
   let j = {};
   if (existsSync(f)) { try { j = JSON.parse(readFileSync(f, "utf8")); } catch { throw new Fail("Can't read " + tilde(f) + " (not JSON); fix it or add " + need.join(", ") + " under permissions.allow yourself."); } }
   const allow = Array.isArray(j.permissions?.allow) ? j.permissions.allow : [];
@@ -852,8 +855,8 @@ export function allowAntigravity(home_ = home()) {
   return true;
 }
 // Hermes calls MCP tools without asking unless the server is marked `trust: untrusted` (or an unknown value) under mcp_servers in
-// ~/.hermes/config.yaml; then unattended runs refuse its write tools. Only in that case, add the two OwlMem tools it reports back
-// with to the top-level command_allowlist as mcp:<server>/<tool> (what Hermes itself writes for "Always"). Adds lines only,
+// ~/.hermes/config.yaml; then unattended runs refuse its write tools. Only in that case, add WAKE_TOOLS
+// to the top-level command_allowlist as mcp:<server>/<tool> (what Hermes itself writes for "Always"). Adds lines only,
 // never rewrites what's there; a command_allowlist it can't extend safely (not a plain block list) returns "manual".
 // false: nothing to do (no config, no OwlMem server in it, a trusted one, or the entries are already there).
 export function allowHermes(home_ = home(), env = process.env) {
@@ -879,10 +882,10 @@ export function allowHermes(home_ = home(), env = process.env) {
     break;
   }
   if (!server || trust === "full") return false;
-  const need = ["kb_task_update", "kb_inbox"].map((n) => "mcp:" + server + "/" + n);
+  const need = WAKE_TOOLS.map((n) => "mcp:" + server + "/" + n);
   const at = lines.findIndex((l) => /^command_allowlist:/.test(l));
   if (at < 0) {
-    writeFileSync(f, t.replace(/\n*$/, "\n") + "# OwlMem auto-wake: unattended hermes -z may call these two OwlMem tools to report back\ncommand_allowlist:\n" +
+    writeFileSync(f, t.replace(/\n*$/, "\n") + "# OwlMem auto-wake: unattended hermes -z may call these OwlMem tools to report back\ncommand_allowlist:\n" +
       need.map((r) => "  - " + r + "\n").join(""));
     return true;
   }
@@ -1305,10 +1308,25 @@ function wakeLogger(dir = DIR) {
   };
 }
 
+// Computers set up before a tool joined WAKE_TOOLS (0.7.8: kb_send) catch up when the program starts after its self-update:
+// Claude Code's --allowedTools in wake.json if it is still one we wrote, and the other apps' own settings (append only).
+// Returns true when wake.json changed.
+export function wakeTools(cfg, home_ = home(), env = process.env) {
+  const ours = ["mcp__owlmem__kb_task_update,mcp__owlmem__kb_inbox"], now = WAKE_TOOLS.map((n) => "mcp__owlmem__" + n).join(",");
+  const cmd = cfg.clients?.["claude-code"]?.command, i = Array.isArray(cmd) ? cmd.indexOf("--allowedTools") : -1;
+  let changed = false;
+  if (i >= 0 && ours.includes(cmd[i + 1])) { cmd[i + 1] = now; changed = true; }
+  if (cfg.clients?.codex) allowCodex(home_);
+  if (cfg.clients?.antigravity) allowAntigravity(home_);
+  if (cfg.clients?.hermes) allowHermes(home_, env);
+  return changed;
+}
+
 async function wakeRun() {
   const cfg = loadWake();
   if (!cfg) throw new Fail("Auto-wake isn't set up on this computer. Run: npx -y owlmem wake enable");
   const log = wakeLogger(), api = wakeApi();
+  try { if (wakeTools(cfg)) { saveWake(DIR, cfg); log("Unattended runs may now also use: " + WAKE_TOOLS.join(", ") + "."); } } catch (e) { log("tools: " + e.message); }
   const report = async (j, res) => {
     log((isReply(j.task) ? "Reply #" : "Task #") + j.id + ": " + res.outcome + (res.code != null ? " (exit code " + res.code + ")" : "") + (res.detail ? " — " + res.detail : ""));
     for (let i = 0; i < 5; i++) {
@@ -1349,12 +1367,12 @@ async function wakeEnable(args = []) {
     throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy, Hermes: hermes). Install one, or add its command to " + wakeFile() + " under \"clients\"." +
       (told ? "\nOwlMem support has been told; you'll hear from us once your AI app is supported." : ""));
   }
-  if (clients.codex && allowCodex()) say("Let Codex report back to OwlMem when nobody is watching (2 tool approvals in ~/.codex/config.toml).");
-  if (clients.antigravity && allowAntigravity()) say("Let Antigravity's command line report back to OwlMem when nobody is watching (2 rules in ~/.gemini/antigravity-cli/settings.json).");
+  if (clients.codex && allowCodex()) say("Let Codex report back to OwlMem when nobody is watching (tool approvals in ~/.codex/config.toml).");
+  if (clients.antigravity && allowAntigravity()) say("Let Antigravity's command line report back to OwlMem when nobody is watching (rules in ~/.gemini/antigravity-cli/settings.json).");
   if (clients.hermes) {
     const h = allowHermes();
-    if (h === true) say("Let Hermes report back to OwlMem when nobody is watching (2 entries under command_allowlist in ~/.hermes/config.yaml).");
-    else if (h === "manual") say("Hermes treats OwlMem as untrusted: add mcp:<server>/kb_task_update and mcp:<server>/kb_inbox to command_allowlist in ~/.hermes/config.yaml, or it can't report back when nobody is watching.");
+    if (h === true) say("Let Hermes report back to OwlMem when nobody is watching (entries under command_allowlist in ~/.hermes/config.yaml).");
+    else if (h === "manual") say("Hermes treats OwlMem as untrusted: add mcp:<server>/kb_task_update, mcp:<server>/kb_inbox and mcp:<server>/kb_send to command_allowlist in ~/.hermes/config.yaml, or it can't report back when nobody is watching.");
   }
   const cfg = { v: 1, ...WAKE_DEFAULTS, ...old, machine: process.env.OWLMEM_DEVICE_NAME || hostname(), clients, ...(max ? { max_parallel: max } : {}), ...(timeout ? { timeout_min: timeout } : {}), boot: boot || !!old.boot };
   // OwlMem knows these app names; a command you add yourself to wake.json goes under "gemini" or "custom"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlmem",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.",
   "type": "module",
   "bin": { "owlmem": "owlmem.mjs" },