pikiloom 0.4.25 → 0.4.27

package/dist/agent/auto-update.js

@@ -1,6 +1,3 @@
-/**
- * Background agent CLI version checking and update prompts.
- */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -17,39 +14,18 @@ function setUpdateState(agent, patch) {
     const current = updateStates.get(agent) || emptyState();
     updateStates.set(agent, { ...current, ...patch });
 }
-/** Returns the cached update state for a specific agent (or null). */
 export function getAgentUpdateState(agent) {
     return updateStates.get(agent) || null;
 }
-/** Returns all cached update states. */
 export function getAllAgentUpdateStates() {
     const result = {};
     for (const [key, value] of updateStates)
         result[key] = value;
     return result;
 }
-// ---------------------------------------------------------------------------
-// Spawn coordination
-//
-// A CLI reinstall (`npm install -g` / `brew upgrade`) briefly tears down and
-// rewrites the bin symlink, so an agent spawn that races it execs into
-// "/bin/sh: <cli>: command not found" (exit 127). The updating process drops a
-// per-agent marker file for the duration of the destructive step; the spawn
-// path waits while it's held. The marker is cross-process (this worker AND the
-// `npx pikiloom@latest` self-bootstrap both update + spawn), and carries the
-// updater's pid so a marker orphaned by a crashed updater is detected via
-// liveness and cleaned up — a spawn never hangs on a stale marker, and a
-// genuinely-missing CLI (no marker) fails fast instead of waiting.
-// ---------------------------------------------------------------------------
-/** Path of the in-flight-reinstall marker for `agent` (one file per agent). */
 export function agentUpdateMarkerPath(agent) {
     return path.join(os.homedir(), STATE_DIR_NAME, `agent-update-${agent}.installing`);
 }
-/**
- * True when a live updater is mid-reinstall of `agent`. Reads the marker's pid
- * and probes liveness with `kill(pid, 0)`; an orphaned marker (writer gone) is
- * removed and reported idle so spawns don't hang on a crashed updater.
- */
 function agentReinstallInFlight(agent) {
     const marker = agentUpdateMarkerPath(agent);
     let raw;
@@ -57,12 +33,12 @@ function agentReinstallInFlight(agent) {
         raw = fs.readFileSync(marker, 'utf8');
     }
     catch {
-        return false; // no marker — nothing updating
+        return false;
     }
     const pid = Number.parseInt(raw.trim(), 10);
     if (Number.isInteger(pid) && pid > 0) {
         try {
-            process.kill(pid, 0); // throws ESRCH if the updater is gone
+            process.kill(pid, 0);
             return true;
         }
         catch {
@@ -73,7 +49,6 @@ function agentReinstallInFlight(agent) {
             return false;
         }
     }
-    // Unreadable pid — fall back to mtime so a corrupt marker still ages out.
     try {
         return Date.now() - fs.statSync(marker).mtimeMs <= AGENT_UPDATE_COMMAND_TIMEOUT_MS;
     }
@@ -81,11 +56,6 @@ function agentReinstallInFlight(agent) {
         return false;
     }
 }
-/**
- * Marks `agent` as mid-reinstall (cross-process) for the duration of
- * `install()` so concurrent spawns can wait it out. Always clears the marker,
- * even when the install throws.
- */
 export async function withAgentUpdateGate(agent, install) {
     const id = String(agent || '').trim();
     if (!id)
@@ -106,11 +76,6 @@ export async function withAgentUpdateGate(agent, install) {
         catch { }
     }
 }
-/**
- * Resolves once no live reinstall of `agent` is in flight, or after
- * `timeoutMs`. No-op (returns immediately) when nothing is updating. Called
- * from the spawn path so we never exec a half-swapped CLI binary.
- */
 export async function awaitAgentUpdateIdle(agent, timeoutMs) {
     const id = String(agent || '').trim();
     if (!id)
@@ -179,10 +144,6 @@ function isNpmPackageOwnedBinary(binPath, pkg, npmRoot) {
         return true;
     return isPathInside(realPackageDir, binPath);
 }
-/**
- * Check if a binary was installed via Homebrew by resolving its real path.
- * Homebrew cask binaries typically symlink through Caskroom or Cellar.
- */
 function isBrewInstalledBinary(binPath) {
     const realPath = realPathOrNull(binPath);
     const target = realPath || binPath;
@@ -196,14 +157,12 @@ export function resolveAgentUpdateStrategy(agent, npmPrefix, npmRoot = null) {
     const binPath = String(agent.path || '').trim();
     if (!binPath)
         return { kind: 'skip', reason: 'no binary path' };
-    // Check for Homebrew install first (binary resolves to Caskroom/Cellar).
     if (isBrewInstalledBinary(binPath)) {
         const cask = getAgentBrewCask(id);
         if (cask)
             return { kind: 'brew', cask };
         return { kind: 'skip', reason: 'brew-installed but no known cask' };
     }
-    // Check for npm global install.
     const npmBinDir = npmPrefix ? path.join(path.resolve(npmPrefix), 'bin') : null;
     const npmManaged = !!(npmBinDir && isPathInside(npmBinDir, binPath));
     if (!npmManaged)
@@ -223,14 +182,6 @@ async function runCommand(cmd, args, opts = {}) {
         let finished = false;
         const child = spawn(cmd, args, {
             stdio: ['ignore', 'pipe', 'pipe'],
-            // HOMEBREW_NO_AUTO_UPDATE=1 skips brew's implicit `brew update` before
-            // each command — we already resolve the latest version via the
-            // formulae.brew.sh API, so the refresh is redundant. NOTE: this does NOT
-            // prevent brew's vendor-install-ruby step, which contends with concurrent
-            // brew processes (Homebrew's launchd autoupdate, a manual brew run, etc.)
-            // on the `vendor-install-ruby` lockf and surfaces as "Failed to upgrade
-            // Homebrew Portable Ruby". Those transient collisions are handled by
-            // `isBrewBusyError` below, which downgrades the failure to a soft skip.
             env: { ...process.env, npm_config_yes: 'true', HOMEBREW_NO_AUTO_UPDATE: '1' },
         });
         const timeoutMs = Math.max(500, opts.timeoutMs ?? AGENT_UPDATE_COMMAND_TIMEOUT_MS);
@@ -274,9 +225,6 @@ async function getNpmGlobalRoot() {
     return result.ok ? result.stdout.trim().split('\n')[0] || null : null;
 }
 async function getLatestPackageVersion(pkg) {
-    // `--prefer-online` bypasses the local npm metadata cache so we always see
-    // the registry's current `latest` tag. Without it, `npm view` can serve a
-    // stale version for several minutes after a release.
     const result = await runCommand('npm', ['view', pkg, 'version', '--json', '--prefer-online'], { timeoutMs: AGENT_UPDATE_TIMEOUTS.npmView });
     if (!result.ok)
         return null;
@@ -322,28 +270,11 @@ async function updateViaNpm(pkg) {
     const result = await runCommand('npm', ['install', '-g', `${pkg}@latest`]);
     return { ok: result.ok, detail: result.ok ? result.stdout.trim() || null : result.error };
 }
-/**
- * Detects the transient brew contention surfaced when another brew process is
- * already running its `vendor-install ruby` step (Homebrew's launchd
- * autoupdate, a manual `brew upgrade`, etc.). We treat these as soft skips
- * rather than failures so the dashboard doesn't shout an error at the user for
- * what is really "try again in a minute".
- */
 function isBrewBusyError(text) {
     if (!text)
         return false;
     return /vendor-install ruby|already locked|Failed to upgrade Homebrew Portable Ruby|is already running/i.test(text);
 }
-// ---------------------------------------------------------------------------
-// Homebrew helpers
-// ---------------------------------------------------------------------------
-/** Get latest available version for a Homebrew cask.
- *
- * Queries Homebrew's public formulae API rather than `brew info`, because the
- * local cask metadata is only refreshed by `brew update` — without it, a
- * just-published cask version can stay invisible for hours/days. The HTTPS API
- * always returns the current cask manifest. Falls back to local `brew info`
- * if the network call fails. */
 async function getLatestBrewCaskVersion(cask) {
     const apiVersion = await fetchBrewCaskVersionFromApi(cask);
     if (apiVersion)
@@ -413,7 +344,6 @@ export function startAgentAutoUpdate(opts) {
                     setUpdateState(id, { status: 'skipped', detail: strategy.reason, checkedAt: Date.now() });
                     continue;
                 }
-                // Use brew version check for brew installs, npm for npm installs.
                 const latestVersion = strategy.kind === 'brew'
                     ? await getLatestBrewCaskVersion(strategy.cask)
                     : await getLatestPackageVersion(pkg);
@@ -456,10 +386,6 @@ export function startAgentAutoUpdate(opts) {
         }
     })();
 }
-// ---------------------------------------------------------------------------
-// On-demand version check (called from dashboard)
-// ---------------------------------------------------------------------------
-/** Check latest version for a single agent. Uses brew or npm depending on install method. */
 export async function checkAgentLatestVersion(agent) {
     const id = String(agent.agent || '').trim();
     const pkg = getAgentPackage(id);
@@ -467,7 +393,6 @@ export async function checkAgentLatestVersion(agent) {
         return { ...emptyState(), status: 'skipped', detail: 'unsupported agent', checkedAt: Date.now() };
     const currentVersion = extractAgentSemver(agent.version);
     setUpdateState(id, { currentVersion, status: 'checking' });
-    // Detect brew install and use brew version check.
     const binPath = String(agent.path || '').trim();
     const brewCask = binPath && isBrewInstalledBinary(binPath) ? getAgentBrewCask(id) : null;
     const latestVersion = brewCask
@@ -490,7 +415,6 @@ export async function checkAgentLatestVersion(agent) {
     setUpdateState(id, state);
     return state;
 }
-/** Manually trigger an update for a specific agent (auto-detects brew vs npm). */
 export async function manualAgentUpdate(agent, log) {
     const id = String(agent.agent || '').trim();
     const pkg = getAgentPackage(id);

package/dist/agent/await-resume.js

@@ -1,22 +1,3 @@
-/**
- * await-resume.ts — "waiting for background work" session marker.
- *
- *   <sessionRoot>/awaiting.json — persisted marker
- *
- * A turn runs as a one-shot `claude -p` process that exits at its `result`
- * event. When the agent launches truly detached work (a daemon outliving the
- * harness, e.g. an install that must survive a restart) and ends the turn
- * intending to report back, the process exits and the session reads as plainly
- * "completed" — there is no live process for the background task to wake. This
- * marker lets the agent declare that intent (via the `await_background` MCP
- * tool, which writes the file directly) so the dashboard can show a distinct
- * "waiting" state instead of "completed".
- *
- * The MCP tool (child process) writes the file; the parent only reads and
- * clears it — the same split used by goal.ts / tools/goal.ts. The marker is
- * cleared the next time the session runs (clearAwaitResume in stream.ts), so a
- * resumed turn naturally drops back out of the "waiting" state.
- */
 import fs from 'node:fs';
 import path from 'node:path';
 const AWAIT_FILE = 'awaiting.json';
@@ -45,6 +26,5 @@ export function clearAwaitResume(workdir, agent, sessionId) {
         fs.rmSync(sessionAwaitPath(workdir, agent, sessionId), { force: true });
     }
     catch {
-        /* best-effort */
     }
 }

package/dist/agent/cli/auth.js

@@ -1,19 +1,3 @@
-/**
- * CLI auth + install runner.
- *
- * Two flows share a single streaming-child-session core:
- *
- *   - oauth-web: spawn `loginArgv`, stream stdout/stderr to the UI, poll
- *     `statusArgv` in the background, and settle when the CLI reports ready.
- *     Used by CLIs that print a device code / one-time-code non-interactively
- *     (gh, wrangler, supabase, …). CLIs whose sign-in needs a real TTY use
- *     `manualLoginCommands` instead and never reach this runner.
- *   - install: spawn the `npm install -g <pkg>` argv, stream output, re-detect
- *     once the child exits.
- *
- * Token CLIs (aws, mocli) skip this entirely — credentials come in via a plain
- * POST and are applied synchronously by `applyCliToken`.
- */
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
@@ -24,9 +8,6 @@ const MAX_SESSION_AGE_MS = 15 * 60 * 1000;
 const POLL_INTERVAL_MS = 2_000;
 const POLL_TIMEOUT_MS = 10 * 60 * 1000;
 const BACKLOG_LINES = 200;
-// ---------------------------------------------------------------------------
-// Session lifecycle
-// ---------------------------------------------------------------------------
 function reapExpiredSessions() {
     const now = Date.now();
     for (const [id, s] of SESSIONS) {
@@ -49,7 +30,6 @@ function startStreamingSession(opts) {
     const { cli, argv, env, shell, pollUntilReady, computeOk } = opts;
     const sessionId = randomUUID();
     const events = new EventEmitter();
-    // Unlimited listeners — SSE clients may resubscribe multiple times.
     events.setMaxListeners(0);
     const session = {
         sessionId,
@@ -95,7 +75,7 @@ function startStreamingSession(opts) {
         try {
             finalStatus = await detectCli(cli);
         }
-        catch { /* best-effort */ }
+        catch { }
         if (finalStatus) {
             events.emit('event', { type: 'status', status: finalStatus });
         }
@@ -124,15 +104,12 @@ function startStreamingSession(opts) {
                     void settle(child.exitCode);
                 }
             }
-            catch { /* ignore polling errors */ }
+            catch { }
         }, POLL_INTERVAL_MS);
     }
     child.on('close', (code) => { void settle(code); });
     return { ok: true, sessionId };
 }
-// ---------------------------------------------------------------------------
-// oauth-web login
-// ---------------------------------------------------------------------------
 export async function startCliAuthSession(cliId) {
     const cli = getRecommendedCli(cliId);
     if (!cli)
@@ -140,8 +117,6 @@ export async function startCliAuthSession(cliId) {
     if (cli.auth.type !== 'oauth-web' || !cli.auth.loginArgv) {
         return { ok: false, error: `cli ${cliId} does not support oauth-web sign-in` };
     }
-    // CLIs configured for manual login should never spawn here — guard so a
-    // misbehaving client can't end-run the documented terminal flow.
     if (cli.auth.manualLoginCommands && cli.auth.manualLoginCommands.length > 0) {
         return { ok: false, error: `cli ${cliId} uses manual sign-in (run the commands in your own terminal)` };
     }
@@ -155,12 +130,6 @@ export async function startCliAuthSession(cliId) {
 }
 const NPM_GLOBAL_INSTALL_RE = /^npm\s+(?:install|i)\s+(?:-g|--global)\s+(\S.*)$/;
 const SHELL_METACHAR_RE = /[|;&`$()<>]/;
-/**
- * Inspect a CLI's install spec for the current platform and return a single
- * argv that's safe to spawn without user-side approvals. Returns null when no
- * such command exists (brew/apt/dnf/winget/scoop/curl-pipe-sh entries are all
- * rejected on purpose — those require sudo or interactive confirmation).
- */
 export function resolveAutoInstallSpec(cli, platform) {
     const commands = cli.install[platform] || [];
     for (const c of commands) {
@@ -190,24 +159,14 @@ export async function startCliInstallSession(cliId) {
         cli,
         argv: spec.argv,
         env: { ...process.env, NO_COLOR: '1', TERM: 'dumb', CI: '1' },
-        // npm on Windows is npm.cmd — needs shell resolution. spawn() args are
-        // still passed argv-style; we don't concat into a shell string.
         shell: process.platform === 'win32',
         pollUntilReady: false,
         computeOk: (exit, status) => exit === 0 && (status ? status.state !== 'not_installed' : true),
     });
 }
-// ---------------------------------------------------------------------------
-// Token auth — apply-credentials flow
-// ---------------------------------------------------------------------------
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-/**
- * Apply a set of credentials for a `token`-auth CLI and verify. Each CLI gets a
- * tailored write path because there's no universal convention — we only do this
- * for CLIs we explicitly support.
- */
 export async function applyCliToken(cliId, values) {
     const cli = getRecommendedCli(cliId);
     if (!cli)
@@ -232,8 +191,6 @@ export async function applyCliToken(cliId, values) {
             }
         }
         else if (cli.id === 'mocli') {
-            // mocli stores its key via `mocli auth init --apik <KEY>` — let the CLI
-            // own its storage path so future schema changes upstream don't break us.
             const key = (values.MOWEN_API_KEY || '').trim();
             if (!key)
                 return { ok: false, error: 'Mowen API Key is required' };
@@ -262,16 +219,12 @@ export async function applyCliToken(cliId, values) {
         return { ok: false, error: e?.message || 'failed to apply token' };
     }
 }
-/**
- * Merge a `[section]` block into an INI-style file, replacing any existing
- * block with the same name. Idempotent; preserves other sections and comments.
- */
 function mergeIniSection(filePath, section, block) {
     let current = '';
     try {
         current = fs.readFileSync(filePath, 'utf-8');
     }
-    catch { /* new file */ }
+    catch { }
     const header = `[${section}]`;
     const lines = current.split(/\r?\n/);
     const out = [];
@@ -287,7 +240,6 @@ function mergeIniSection(filePath, section, block) {
                 inTarget = false;
                 out.push(line);
             }
-            // else: drop old line
         }
         else {
             out.push(line);

package/dist/agent/cli/catalog.js

@@ -1,6 +1,3 @@
-/**
- * CLI catalog — merges the recommended registry with live detection status.
- */
 import { getRecommendedClis } from './registry.js';
 import { detectCli, getCachedCliStatus, currentPlatform } from './detector.js';
 import { resolveAutoInstallSpec } from './auth.js';

package/dist/agent/cli/detector.js

@@ -1,18 +1,9 @@
-/**
- * CLI detector — checks whether a CLI binary is on PATH, what version it is,
- * and whether the user is already signed in.
- *
- * Results are cached with a short TTL so catalog rendering stays snappy.
- */
 import { execFile } from 'node:child_process';
 import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs';
 const DETECT_TTL_MS = 30_000;
 const cache = new Map();
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
 function runArgv(argv, timeoutMs) {
     return new Promise((resolve) => {
         const [cmd, ...rest] = argv;
@@ -48,7 +39,7 @@ function which(binary) {
                 if (stat.isFile())
                     return candidate;
             }
-            catch { /* next */ }
+            catch { }
         }
     }
     return null;
@@ -58,7 +49,6 @@ function extractVersion(stdout, stderr) {
     if (!text)
         return undefined;
     const firstLine = text.split(/\r?\n/, 1)[0].trim();
-    // Common patterns: "gh version 2.56.0 (...)" / "1.2.3" / "aws-cli/2.x ..."
     const m = firstLine.match(/\b(\d+\.\d+(?:\.\d+)?(?:[-.+][0-9A-Za-z.]+)?)\b/);
     return m ? m[1] : firstLine.slice(0, 80);
 }
@@ -69,9 +59,6 @@ function trimDetail(s) {
     const first = text.split(/\r?\n/, 1)[0].trim();
     return first.slice(0, 200);
 }
-// ---------------------------------------------------------------------------
-// Public
-// ---------------------------------------------------------------------------
 export function getCachedCliStatus(id) {
     const cached = cache.get(id);
     if (!cached)
@@ -95,7 +82,6 @@ export async function detectCli(cli) {
         cache.set(cli.id, status);
         return status;
     }
-    // Installed — read version, best-effort.
     let version;
     if (cli.versionArgv && cli.versionArgv.length) {
         const v = await runArgv(cli.versionArgv, 5_000);
@@ -109,8 +95,6 @@ export async function detectCli(cli) {
         return status;
     }
     const result = await runArgv(cli.auth.statusArgv, 6_000);
-    // Some CLIs (gcloud) report success via exit 0 but emit empty output when no
-    // account is configured — fall back to a content check when declared.
     const patternOk = !cli.auth.statusReadyPattern
         || new RegExp(cli.auth.statusReadyPattern).test(result.stdout);
     const state = (result.ok && patternOk) ? 'ready' : 'installed_not_auth';
@@ -122,7 +106,6 @@ export async function detectCli(cli) {
     cache.set(cli.id, status);
     return status;
 }
-/** Best-effort platform key for picking install commands. */
 export function currentPlatform() {
     if (process.platform === 'darwin')
         return 'darwin';
@@ -130,7 +113,6 @@ export function currentPlatform() {
         return 'win';
     return 'linux';
 }
-/** Where AWS credentials go for the `token` auth flow. */
 export function awsCredentialsPath() {
     return path.join(os.homedir(), '.aws', 'credentials');
 }

package/dist/agent/cli/index.js

@@ -1,6 +1,3 @@
-/**
- * Barrel entry for the CLI extension module.
- */
 export { getRecommendedClis, getRecommendedCli, } from './registry.js';
 export { detectCli, getCachedCliStatus, invalidateCliStatus, currentPlatform, } from './detector.js';
 export { getCliCatalog, refreshCliStatus, } from './catalog.js';

package/dist/agent/cli/registry.js

@@ -1,30 +1,5 @@
-/**
- * CLI tool registry — curated command-line tools agents commonly need.
- *
- * Each entry declares how to install the binary on each OS, how to detect the
- * install / auth state, and (optionally) how to drive the sign-in flow.
- *
- * Two auth types are supported today:
- *   - oauth-web: the CLI has a first-party `<cli> auth login --web` flavor that
- *     prints a device code and opens the browser. We spawn it, stream output,
- *     and poll the status command to know when the user finished in the browser.
- *   - token: the user pastes an API key; we set it via the CLI's config command
- *     (or via env var for CLIs that only read from env).
- *
- * Keep this list opinionated and small — better to nail the common case than to
- * ship a wall of half-working entries.
- */
-// ---------------------------------------------------------------------------
-// Recommended CLI tools — data lives in src/catalog/
-//
-// This module owns the *types* and helper functions. Edit
-// `src/catalog/cli-tools.ts` to add or hide a CLI tool entry.
-// ---------------------------------------------------------------------------
 import { CLI_TOOLS } from '../../catalog/index.js';
 const RECOMMENDED_CLIS = CLI_TOOLS;
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
 export function getRecommendedClis() {
     return RECOMMENDED_CLIS;
 }

package/dist/agent/driver.js

@@ -1,12 +1,3 @@
-/**
- * agent-driver.ts — Agent driver interface and registry.
- *
- * Each CLI agent (claude, codex, gemini, ...) implements AgentDriver.
- * Register with `registerDriver()`, look up with `getDriver()`.
- */
-// ---------------------------------------------------------------------------
-// Registry
-// ---------------------------------------------------------------------------
 const drivers = new Map();
 export function registerDriver(d) { drivers.set(d.id, d); }
 export function getDriver(id) {
@@ -29,11 +20,6 @@ export function getDriverCapabilities(id) {
         return DEFAULT_CAPABILITIES;
     return { ...DEFAULT_CAPABILITIES, ...d.capabilities };
 }
-/**
- * Provider kinds this driver can route through. Empty array means the driver
- * declared no compatibility (so no Profiles will be listed for it). Callers
- * should treat this as the filter for cross-provider model offerings.
- */
 export function getAcceptedProviderKinds(id) {
     return drivers.get(id)?.acceptedProviderKinds ?? [];
 }