privateer-agent 0.3.6 → 0.4.0

package/src/remote/extensionsControl.ts

@@ -0,0 +1,140 @@
+/**
+ * Extension management for linked terminals.
+ *
+ * A UI-agnostic wrapper over Pi's PackageManager so the app (over the relay) can
+ * see which Pi extensions THIS terminal has installed and add/remove them — the
+ * same way the model picker lets the app switch models. Both the dev REPL
+ * (src/cli/chat.ts) and the shipped TUI (extensions/privateer-gate.ts) build one
+ * of these and route the extensions_* relay frames through it.
+ *
+ * Only the user's OWN packages surface here. The Privateer moat (privateer-*,
+ * pi-privacy, rpiv-web-tools, …) is installed by bin/privateer-tui as shim .ts
+ * files in the agent dir's extensions/ folder — auto-discovered, NOT recorded in
+ * settings.json "packages". listConfiguredPackages() reads only "packages", so the
+ * moat is naturally excluded. We keep a RESERVED name guard as defence in depth in
+ * case a user ever hand-adds one of our package names.
+ *
+ * Framework-agnostic: nothing here imports React or the relay. The caller owns the
+ * frame plumbing and hands us a SettingsManager (the REPL reuses the session's;
+ * the TUI creates a fresh one — both read the same ~/.privateer/agent/settings.json).
+ */
+import { DefaultPackageManager } from "@earendil-works/pi-coding-agent";
+import type { ProgressEvent, SettingsManager } from "@earendil-works/pi-coding-agent";
+
+// One installed extension as surfaced to the app. NON-PII: a package source
+// (npm:/git: spec) plus its scope — no cwd, no absolute paths beyond what Pi
+// already resolved. `installed` reflects whether the package is downloaded on disk
+// yet (a freshly-added one persists to settings before its install completes).
+export interface InstalledExtension {
+  source: string;
+  scope: "user" | "project";
+  filtered: boolean;
+  installed: boolean;
+  installedPath?: string;
+}
+
+export interface ExtensionsControl {
+  // The user's own configured packages (moat excluded). Cheap — reads settings.
+  listInstalled(): InstalledExtension[];
+  // Persist + download an npm:/git:/path package to USER settings. Returns ok:false
+  // with Pi's own message on a bad spec or a failed npm/git fetch.
+  add(source: string): Promise<{ ok: boolean; message?: string }>;
+  // Remove from USER settings + prune the cache. ok:false when nothing matched.
+  remove(source: string): Promise<{ ok: boolean; message?: string }>;
+  // Progress callback for the current add/remove (install/clone/pull steps), so the
+  // caller can relay a busy indicator. Pass undefined to clear.
+  setProgress(cb: ((ev: ProgressEvent) => void) | undefined): void;
+}
+
+// Package names we never manage from the app: the Privateer moat + adopted packs
+// installed as shims by the launcher. A guard only — listConfiguredPackages()
+// already omits them since they aren't settings "packages".
+const RESERVED = new Set([
+  "privateer-brand",
+  "privateer-context",
+  "privateer-gate",
+  "privateer-account",
+  "privateer-posture",
+  "privateer-tools",
+  "privateer-privacy",
+  "pi-privacy",
+  "pi-web-access",
+  "rpiv-web-tools",
+  "@juicesharp/rpiv-web-tools",
+  "pi-mcp-adapter",
+  "pi-hypa",
+  "@hypabolic/pi-hypa",
+  "pi-subagents",
+]);
+
+// The bare package name inside a source spec, for the RESERVED check. Strips the
+// npm:/git: scheme and any @version / #ref suffix; leaves scoped names intact.
+function packageName(source: string): string {
+  let s = source.trim();
+  const scheme = s.indexOf(":");
+  if (scheme > 0 && /^(npm|git)$/i.test(s.slice(0, scheme))) s = s.slice(scheme + 1);
+  // Drop a trailing @version (but not the leading @ of a scope) and a git #ref.
+  s = s.replace(/#.*$/, "");
+  const at = s.lastIndexOf("@");
+  if (at > 0) s = s.slice(0, at);
+  return s;
+}
+
+export function makeExtensionsControl(opts: {
+  cwd: string;
+  agentDir: string;
+  settingsManager: SettingsManager;
+}): ExtensionsControl {
+  const pm = new DefaultPackageManager({
+    cwd: opts.cwd,
+    agentDir: opts.agentDir,
+    settingsManager: opts.settingsManager,
+  });
+
+  return {
+    listInstalled(): InstalledExtension[] {
+      let configured: Array<{ source: string; scope: string; filtered: boolean; installedPath?: string }> = [];
+      try {
+        configured = pm.listConfiguredPackages() as typeof configured;
+      } catch {
+        return [];
+      }
+      return configured
+        .filter((p) => !RESERVED.has(packageName(p.source)))
+        .map((p) => ({
+          source: p.source,
+          scope: p.scope === "project" ? "project" : "user",
+          filtered: !!p.filtered,
+          installed: !!p.installedPath,
+          installedPath: p.installedPath,
+        }));
+    },
+
+    async add(source: string): Promise<{ ok: boolean; message?: string }> {
+      const src = source.trim();
+      if (!src) return { ok: false, message: "No package specified." };
+      if (RESERVED.has(packageName(src))) return { ok: false, message: "That extension is managed by Privateer." };
+      try {
+        await pm.installAndPersist(src, { local: false });
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, message: (e as Error).message };
+      }
+    },
+
+    async remove(source: string): Promise<{ ok: boolean; message?: string }> {
+      const src = source.trim();
+      if (!src) return { ok: false, message: "No package specified." };
+      try {
+        const removed = await pm.removeAndPersist(src, { local: false });
+        return removed ? { ok: true } : { ok: false, message: "Not installed." };
+      } catch (e) {
+        return { ok: false, message: (e as Error).message };
+      }
+    },
+
+    setProgress(cb: ((ev: ProgressEvent) => void) | undefined): void {
+      pm.setProgressCallback(cb);
+    },
+  };
+}

package/src/remote/liveTaskSession.ts

@@ -0,0 +1,218 @@
+// A live, app-drivable agent session spawned on demand by the daemon (task_spawn,
+// mode:"live"). Unlike a headless task (daemon/index.ts runTask → restricted tools +
+// bypass gate + outbox), this stands up a FULL interactive session behind its own relay
+// terminal so the app can attach and drive it in real time: stream tokens, approve each
+// tool, interrupt. It is the same wiring cli/chat.ts uses for `/remote-access`, factored
+// so the daemon can create one without a TTY.
+//
+// SAFETY: the gate runs in "default" mode, so on a driven turn every gated tool relays to
+// the app for allow/deny (bridge.remoteAsk) and fail-closes if the controller is gone —
+// full tools are safe precisely because a human is watching and approving. localAsk denies
+// (there is no terminal to prompt), and remote-unsafe tools (subagents) are blocked.
+import { randomUUID } from "node:crypto";
+import {
+  createAgentSessionServices,
+  createAgentSessionFromServices,
+  SessionManager,
+} from "@earendil-works/pi-coding-agent";
+import { agentDir } from "../config/paths.ts";
+import { agentVersion } from "../config/version.ts";
+import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
+import { makePermissionGate, isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
+import { makePiPrivacyExtension } from "pi-privacy";
+import { makeAccountProvider } from "../providers/account.ts";
+import { RelayClient, type TaskSpec } from "./relayClient.ts";
+import { RemoteBridge } from "./remoteBridge.ts";
+import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
+
+export interface LiveTaskHandle {
+  termId: string;
+  label: string;
+  stop: () => Promise<void>;
+}
+
+export interface LiveTaskDeps {
+  defaultModel: string;
+  parseSpec: (spec: string) => { provider: string; modelId: string };
+  log: (msg: string) => void;
+  onClosed: (termId: string) => void;
+}
+
+// How long to keep a spawned session alive with NO controller ever attaching, and the
+// hard ceiling on any one session's lifetime (a driven session left open is reaped so an
+// abandoned spawn can't run the account meter or hold resources forever).
+const ATTACH_GRACE_MS = 180_000; // 3 min to attach after spawn
+const MAX_LIFETIME_MS = 30 * 60_000; // 30 min absolute cap
+
+export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps): Promise<LiveTaskHandle> {
+  const cwd = spec.cwd && spec.cwd.trim() ? spec.cwd : process.cwd();
+  const modelSpec = spec.model && spec.model.trim() ? spec.model : deps.defaultModel;
+  const title = spec.title && spec.title.trim() ? spec.title.trim() : "";
+  const termId = `task-${randomUUID()}`;
+  const label = title ? `Task: ${title}`.slice(0, 60) : "Privateer Task";
+
+  let relay: RelayClient | undefined;
+  let session: any;
+  let turnActive = false;
+  let attached = false;
+  let initialPromptSent = false;
+  let stopped = false;
+  let spawnedAccount = false;
+  let servicesRef: { authStorage?: { remove?: (p: string) => void } } | null = null;
+
+  let attachTimer: ReturnType<typeof setTimeout> | undefined;
+  let lifeTimer: ReturnType<typeof setTimeout> | undefined;
+
+  const stop = async (): Promise<void> => {
+    if (stopped) return;
+    stopped = true;
+    if (attachTimer) clearTimeout(attachTimer);
+    if (lifeTimer) clearTimeout(lifeTimer);
+    try { relay?.stop(); } catch { /* already stopped */ }
+    // Revoke ONLY this session's account inference session so it doesn't linger in the
+    // app's Linked Devices; the daemon's own child session stays alive. Best-effort.
+    if (spawnedAccount) {
+      try { await revokeAccountSession(); } catch { /* server TTL is the fallback */ }
+      try { servicesRef?.authStorage?.remove?.("privateer"); } catch { /* nothing persisted */ }
+    }
+    deps.onClosed(termId);
+    deps.log(`live task ${termId} closed`);
+  };
+
+  const runTurn = async (text: string): Promise<void> => {
+    if (turnActive || stopped) return;
+    turnActive = true;
+    try {
+      await session.prompt(text);
+    } catch (e) {
+      deps.log(`live task ${termId} turn error: ${(e as Error).message}`);
+    } finally {
+      turnActive = false;
+      bridge.settleTurn();
+    }
+  };
+
+  const bridge = new RemoteBridge({
+    onPrompt: (text) => void runTurn(text),
+    onInterrupt: () => void session?.abort?.(),
+    // Slash commands from the app composer fall through to the turn loop (Pi executes
+    // extension/skill commands via prompt). No local dispatcher here — this is headless.
+    onCommand: (text) => void runTurn(text),
+    onControllerAttached: () => {
+      attached = true;
+      if (attachTimer) { clearTimeout(attachTimer); attachTimer = undefined; }
+      relay?.sendSnapshot([]);
+      relay?.sendContext({ model: modelSpec, version: agentVersion() });
+      relay?.sendCommands([]);
+      // Deliver the spawn's initial prompt exactly once, THROUGH the bridge's own prompt
+      // path so it counts as a driven turn (remote=true → tools relay to the app).
+      if (!initialPromptSent && spec.prompt && spec.prompt.trim()) {
+        initialPromptSent = true;
+        bridge.callbacks.onPrompt(spec.prompt);
+      }
+    },
+    onTerminate: () => void stop(),
+    onStatus: (t) => deps.log(`live task ${termId}: ${t}`),
+  });
+
+  const gate: GateController = {
+    getMode: () => "default",
+    setMode: () => {},
+    allowlist: [],
+    allowedOutsideRoots: [],
+    cwd,
+    confineToCwd: true,
+    // No terminal to ask — a LOCAL turn can't happen here, but fail closed if one ever
+    // reaches this path.
+    async localAsk() {
+      return "deny";
+    },
+    getRemote: bridge.getRemote,
+    getNoQuarter: bridge.getNoQuarter,
+    remoteAsk: bridge.remoteAsk,
+    blockedWhenRemote: isRemoteUnsafeTool,
+    onRemoteBlocked: (toolName) => bridge.sendNotice(`${toolName} is disabled while driving remotely — its prompts can't reach the app.`),
+  };
+
+  const services = await createAgentSessionServices({
+    cwd,
+    agentDir: agentDir(),
+    resourceLoaderOptions: {
+      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+    },
+  });
+  servicesRef = services as any;
+
+  const { provider, modelId } = deps.parseSpec(modelSpec);
+  if (provider === "privateer") {
+    try {
+      const creds = await spawnAccountCredentials();
+      (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+      spawnedAccount = true;
+    } catch (e) {
+      deps.log(`live task ${termId} account channel unavailable: ${(e as Error).message}`);
+    }
+  }
+
+  // From here on any failure MUST tear down (stop() revokes the account child session we
+  // just spawned + closes the relay), or a throw would leak an orphaned account "device"
+  // until its token TTL. Everything post-account-spawn runs under one guard.
+  try {
+  const model = (services.modelRegistry as any).find(provider, modelId);
+  if (!model) {
+    throw new Error(`model ${provider}/${modelId} not found`);
+  }
+
+  ({ session } = await createAgentSessionFromServices({
+    services,
+    sessionManager: SessionManager.inMemory(cwd),
+    model,
+    // No `tools` restriction: a live session gets Pi's full toolset, made safe by the
+    // per-tool relay-to-app approval above.
+  } as any));
+
+  // Relay the extension mid-turn UI (select/confirm/input) to the app when driven, so an
+  // extension asking a question doesn't silently cancel. Mirrors cli/chat.ts's uiContext.
+  const driven = (): boolean => bridge.getRemote() && bridge.isConnected();
+  const uiContext = {
+    async select(t: string, options: string[], opts?: { signal?: AbortSignal }): Promise<string | undefined> {
+      if (!options.length) return undefined;
+      if (!driven()) return undefined;
+      const choice = await bridge.selectRemote({ title: t, options: options.map((o) => ({ value: o, label: o })) }, opts?.signal);
+      return choice ?? undefined;
+    },
+    async confirm(t: string, message: string, opts?: { signal?: AbortSignal }): Promise<boolean> {
+      if (!driven()) return false;
+      const choice = await bridge.selectRemote({ title: t || message, options: [{ value: "yes", label: "Yes" }, { value: "no", label: "No" }] }, opts?.signal);
+      return choice === "yes";
+    },
+    async input(t: string, placeholder?: string, opts?: { signal?: AbortSignal }): Promise<string | undefined> {
+      if (!driven()) return undefined;
+      const value = await bridge.inputRemote({ title: t, placeholder }, opts?.signal);
+      return value ?? undefined;
+    },
+    notify(message: string): void {
+      if (driven()) bridge.sendNotice(message);
+    },
+  };
+  await (session as any).bindExtensions({ uiContext });
+
+  const adapter = createEngineEventAdapter();
+  session.subscribe((ev: any) => {
+    for (const ee of adapter.toEngineEvents(ev)) bridge.forwardEvent(ee);
+  });
+
+  relay = new RelayClient(bridge.callbacks, { termId, label });
+  bridge.attachRelay(relay);
+  await relay.start();
+
+  // Reap if nobody ever attaches, and cap the absolute lifetime regardless.
+  attachTimer = setTimeout(() => { if (!attached) void stop(); }, ATTACH_GRACE_MS);
+  lifeTimer = setTimeout(() => void stop(), MAX_LIFETIME_MS);
+  } catch (err) {
+    await stop(); // revoke the account child session + close the relay before propagating
+    throw err;
+  }
+
+  return { termId, label, stop };
+}