owlmem 0.9.1 → 0.9.3

package/README.md

@@ -29,7 +29,7 @@ page, where you sign in and click **Allow**. AI agents can read the setup guide
 
 An AI on your computer normally sees a task only when someone opens it. Auto-wake starts it as soon as it gets one:
 a small background program long-polls OwlMem and runs that AI's command line unattended — Claude Code with
-`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`) — with the task as the prompt. The AI marks the task done or declined as usual. When a task it gave out is done or declined, it is woken too, to read the result. The program updates itself (from npm, when nothing is running).
+`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z`, DeepSeek Harness with `dsh --profile headless` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`; for DeepSeek Harness, its headless profile gets the model and the OwlMem server copied from the web profile, and its credential store turned back on, in `~/.dsh/profiles/headless/cordis.patch.yml`) — with the task as the prompt. The AI marks the task done or declined as usual. When a task it gave out is done or declined, it is woken too, to read the result. The program updates itself (from npm, when nothing is running).
 
 When someone turns auto-wake on for an AI in the console and no computer runs it yet, that AI is told so the next time it connects:
 with your OK it runs `npx -y owlmem wake enable` itself and sends you the pairing link to approve.

package/owlmem.mjs

@@ -41,7 +41,7 @@ import { join, dirname, basename, relative, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 
-export const VERSION = "0.9.1";
+export const VERSION = "0.9.3";
 const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
 const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
 const enc = new TextEncoder(), dec = new TextDecoder();
@@ -817,8 +817,11 @@ export const WAKE_CLIENTS = {
   // Its installer puts hermes under ~/.hermes/hermes-agent or ~/.local/bin; a system-wide service install under /var/lib/hermes
   hermes: { name: "Hermes", bin: "hermes", command: ["hermes", "-z"], prompt: "arg",
     home: [[".hermes", "hermes-agent", ".hermes", "bin", "hermes"], [".local", "bin", "hermes"], "/var/lib/hermes/hermes-agent/.hermes/bin/hermes"] },
+  // DeepSeek Harness: the headless profile answers one task (from stdin) and exits. Its own profile needs OwlMem and a model,
+  // copied from the web profile (see allowDsh). On NixOS dsh must run on the official Node build: use the dsh wrapper found here.
+  dsh: { name: "DeepSeek Harness", bin: "dsh", command: ["dsh", "--profile", "headless"], prompt: "stdin", home: [[".local", "bin", "dsh"]] },
 };
-export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "hermes", "gemini", "custom"];
+export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "hermes", "dsh", "gemini", "custom"];
 // Where an app's command is: on PATH, or the first of its default install places that exists (path parts under your home
 // folder, or an absolute path), used by full path
 export function wakeBin(c, home_ = home(), exists = existsSync, path = onPath) {
@@ -854,6 +857,40 @@ export function allowAntigravity(home_ = home()) {
   writeFileSync(f, JSON.stringify(j, null, 2) + "\n");
   return true;
 }
+// DeepSeek Harness keeps each profile under ~/.dsh/profiles/<name>/, configured by a patch list (cordis.patch.yml). The headless
+// profile that auto-wake runs starts empty: copy over from the web profile what it needs to work for OwlMem — the default model
+// and its provider (agent-default-model, llm-pi-ai) and the OwlMem MCP server — and turn its credential store back on (headless
+// turns it off, but the web profile keeps the provider's key there). Adds entries only; the file is backed up first.
+// Returns the names of what was added; [] when nothing was missing; "init" when the headless profile isn't there yet (run
+// `dsh --profile headless --help` once); "noweb" when OwlMem isn't in the web profile either, so there's nothing to copy.
+export function allowDsh(home_ = home(), env = process.env, now = new Date()) {
+  const dir = join(env.DSH_HOME || join(home_, ".dsh"), "profiles"), hf = join(dir, "headless", "cordis.patch.yml");
+  if (!existsSync(join(dir, "headless"))) return "init";
+  let h = ""; try { h = readFileSync(hf, "utf8"); } catch { /* an empty profile has no patch file yet */ }
+  let w = ""; try { w = readFileSync(join(dir, "web", "cordis.patch.yml"), "utf8"); } catch { /* no web profile */ }
+  // the top-level entries of a patch list: each starts with "- " at column 0 and runs to the next one
+  const items = (t) => t.split(/\n(?=- )/).map((x) => x.replace(/^[\s\S]*?(?=^- )/m, "")).filter((x) => /^- /.test(x));
+  const has = (t, rx) => items(t).some((x) => rx.test(x));
+  const want = [
+    ["model", /^- id: agent-default-model\b/m], ["provider", /^- id: llm-pi-ai\b/m], ["owlmem", /serverName:\s*["']?owlmem\b/],
+  ];
+  const add = [], names = [];
+  for (const [name, rx] of want) {
+    if (has(h, rx)) continue;
+    const from = items(w).find((x) => rx.test(x));
+    if (from) { add.push(from.replace(/\s+$/, "")); names.push(name); }
+  }
+  if (!has(h, /serverName:\s*["']?owlmem\b/) && !names.includes("owlmem")) return "noweb";
+  if (!/^- id: credentials\s*\n\s+disabled:\s*false\b/m.test(h)) {
+    add.push("# headless turns the credential store off; the web profile keeps the model's key there\n- id: credentials\n  disabled: false");
+    names.push("credentials");
+  }
+  if (!add.length) return [];
+  if (existsSync(hf)) copyFileSync(hf, hf + ".bak-" + now.toISOString().slice(0, 10).replace(/-/g, ""));
+  const base = h.replace(/^\[\]\s*$/m, "").replace(/\s*$/, "");
+  writeFileSync(hf, (base ? base + "\n" : "") + "# Added by OwlMem auto-wake (owlmem wake enable): what the headless profile needs to answer OwlMem tasks\n" + add.join("\n") + "\n");
+  return names;
+}
 // Hermes calls MCP tools without asking unless the server is marked `trust: untrusted` (or an unknown value) under mcp_servers in
 // ~/.hermes/config.yaml; then unattended runs refuse its write tools. Only in that case, add WAKE_TOOLS
 // to the top-level command_allowlist as mcp:<server>/<tool> (what Hermes itself writes for "Always"). Adds lines only,
@@ -1237,6 +1274,7 @@ export async function wakeLoop(o) {
       await sleep(backoff); continue;
     }
     backoff = 0;
+    if (Array.isArray(r.data.agents)) cfg.live = r.data.agents;       // which AIs the owner lets us read Claude quota for (read_quota)
     for (const t of r.data.tasks || []) {
       const plan = isReply(t) ? { kind: "scratch" } : o.plan ? o.plan(t) : planWorkdir(t);      // a reply is read in an empty folder
       log((isReply(t) ? "Reply #" + t.id + " (task #" + t.task_id + ")" : jobLabel(t)) + " for " + t.agent + ": starting " + t.client + (plan.dir ? " in " + plan.dir : "") + ".");
@@ -1420,7 +1458,9 @@ export function usageLine(client, line, f) {
   const rl = j?.payload?.type === "token_count" ? j.payload.rate_limits : null;
   if (rl && at >= (f.st?.limit_at || 0)) {   // Codex says how much of its plan's window is used and when it resets
     const w = [rl.primary, rl.secondary].filter((x) => x && typeof x.used_percent === "number").sort((a, b) => b.used_percent - a.used_percent)[0];
-    f.st = { ...f.st, limit_at: at, ok_at: at, used_percent: w?.used_percent, resets_at: w?.resets_at, window_minutes: w?.window_minutes,
+    const windows = [rl.primary, rl.secondary].filter((x) => x && typeof x.used_percent === "number")
+      .map((x) => ({ minutes: x.window_minutes, used_percent: x.used_percent, resets_at: x.resets_at }));
+    f.st = { ...f.st, limit_at: at, ok_at: at, used_percent: w?.used_percent, resets_at: w?.resets_at, window_minutes: w?.window_minutes, windows,
              ...(rl.rate_limit_reached_type ? { block: "limit", block_at: at } : {}) };
   }
   const info = j?.payload?.type === "token_count" ? j.payload.info : null, last = info?.last_token_usage, d = usageDay(j?.timestamp);
@@ -1479,10 +1519,39 @@ export function usageStatus(state, clients) {
     const o = out[f.client] || (out[f.client] = {});
     if ((f.st.ok_at || 0) > (o.ok_at || 0)) o.ok_at = f.st.ok_at;
     if ((f.st.block_at || 0) > (o.block_at || 0)) Object.assign(o, { block: f.st.block, block_at: f.st.block_at, resets_at: f.st.resets_at ?? o.resets_at });
-    if ((f.st.limit_at || 0) > (o.limit_at || 0)) Object.assign(o, { limit_at: f.st.limit_at, used_percent: f.st.used_percent, window_minutes: f.st.window_minutes, resets_at: f.st.resets_at });
+    if ((f.st.limit_at || 0) > (o.limit_at || 0)) Object.assign(o, { limit_at: f.st.limit_at, used_percent: f.st.used_percent, window_minutes: f.st.window_minutes, resets_at: f.st.resets_at, windows: f.st.windows });
   }
   return out;
 }
+// Claude Code's own quota (0.9.2, only when the AI's owner turned "Read Claude quota" on in the console): ask Anthropic's
+// usage endpoint with the sign-in Claude Code keeps on this computer, the same one its /usage screen uses. The sign-in is
+// only sent to api.anthropic.com and never leaves this computer otherwise; OwlMem gets the percentages and reset times.
+// An expired sign-in isn't refreshed here (Claude Code does that itself): no quota this round.
+export function claudeToken(h = home(), env = process.env, plat = process.platform, now = Date.now()) {
+  let raw = null;
+  try { raw = readFileSync(join(env.CLAUDE_CONFIG_DIR || join(h, ".claude"), ".credentials.json"), "utf8"); } catch {}
+  if (!raw && plat === "darwin") {
+    const r = spawnSync("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { encoding: "utf8", timeout: 10000 });
+    if (r.status === 0) raw = r.stdout;
+  }
+  let o; try { o = JSON.parse(raw || "null")?.claudeAiOauth; } catch { return null; }
+  if (!o?.accessToken || (o.expiresAt && o.expiresAt < now + 60000)) return null;
+  return o.accessToken;
+}
+export function claudeWindows(j) {
+  const sec = (v) => { const t = Date.parse(v); return isNaN(t) ? undefined : Math.floor(t / 1000); };
+  return [["five_hour", 300], ["seven_day", 10080]].filter(([k]) => typeof j?.[k]?.utilization === "number")
+    .map(([k, minutes]) => ({ minutes, used_percent: j[k].utilization, resets_at: sec(j[k].resets_at) }));
+}
+async function claudeQuota(fetchImpl = fetch) {
+  const tok = claudeToken();
+  if (!tok) return null;
+  const r = await fetchImpl("https://api.anthropic.com/api/oauth/usage", { headers: { Authorization: "Bearer " + tok, "anthropic-beta": "oauth-2025-04-20", "User-Agent": "owlmem-cli/" + VERSION },
+                                                                          signal: AbortSignal.timeout(15000) });
+  if (!r.ok) return null;
+  const w = claudeWindows(await r.json());
+  return w.length ? w : null;
+}
 async function usageTick(cfg, api, log, dir = DIR) {
   const file = join(wakeDir(dir), "usage.json");
   let state = {}; try { state = JSON.parse(readFileSync(file, "utf8")); } catch {}
@@ -1491,7 +1560,12 @@ async function usageTick(cfg, api, log, dir = DIR) {
   if (!clients.length) return;
   scanUsage(state, Object.fromEntries(Object.entries(usageRoots()).filter(([c]) => clients.includes(c))));
   try { writeFileSync(file + ".tmp", JSON.stringify(state)); renameSync(file + ".tmp", file); } catch (e) { log("usage: " + e.message); }
-  const r = await api("usage", { days: usageReport(state, clients), status: usageStatus(state, clients) });
+  const status = usageStatus(state, clients);
+  if (clients.includes("claude-code") && (cfg.live || []).some((a) => a.client === "claude-code" && a.read_quota)) {
+    const w = await claudeQuota().catch(() => null);
+    if (w) status["claude-code"] = { ...status["claude-code"], windows: w, limit_at: Math.floor(Date.now() / 1000) };
+  }
+  const r = await api("usage", { days: usageReport(state, clients), status });
   if (r.status !== 200 && r.status !== 404) log("usage: OwlMem answered " + (r.data?.detail || "HTTP " + r.status));
 }
 
@@ -1539,11 +1613,17 @@ async function wakeEnable(args = []) {
   }
   if (!Object.keys(clients).length) {
     const told = await wakeNoClients(wakeApi()).catch(() => false);
-    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy, Hermes: hermes). Install one, or add its command to " + wakeFile() + " under \"clients\"." +
+    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy, Hermes: hermes, DeepSeek Harness: dsh). Install one, or add its command to " + wakeFile() + " under \"clients\"." +
       (told ? "\nOwlMem support has been told; you'll hear from us once your AI app is supported." : ""));
   }
   if (clients.codex && allowCodex()) say("Let Codex report back to OwlMem when nobody is watching (tool approvals in ~/.codex/config.toml).");
   if (clients.antigravity && allowAntigravity()) say("Let Antigravity's command line report back to OwlMem when nobody is watching (rules in ~/.gemini/antigravity-cli/settings.json).");
+  if (clients.dsh) {
+    const d = allowDsh();
+    if (d === "init") say("DeepSeek Harness: run `dsh --profile headless --help` once to create its headless profile, then run this again.");
+    else if (d === "noweb") say("DeepSeek Harness: OwlMem isn't set up in its web profile, so the headless profile can't be set up from it. Connect OwlMem in DeepSeek Harness first, then run this again.");
+    else if (d.length) say("Set up DeepSeek Harness's headless profile for auto-wake (" + d.join(", ") + " in ~/.dsh/profiles/headless/cordis.patch.yml, copied from the web profile; the old file is backed up next to it).");
+  }
   if (clients.hermes) {
     const h = allowHermes();
     if (h === true) say("Let Hermes report back to OwlMem when nobody is watching (entries under command_allowlist in ~/.hermes/config.yaml).");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlmem",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.",
   "type": "module",
   "bin": { "owlmem": "owlmem.mjs" },