talentos 1.0.0 → 1.1.0

package/dist/agent-config.js

@@ -0,0 +1,105 @@
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { redactAgentOutput } from "./agent-link.js";
+import { warn } from "./format.js";
+import { homeDir } from "./install.js";
+const AGENT_ID = /^[a-z\d_-]+$/iu;
+export function agentsDir(home = homeDir()) {
+    return join(home, ".talentos", "agents");
+}
+export function agentConfigPath(agentId, home = homeDir()) {
+    if (!AGENT_ID.test(agentId)) {
+        throw new Error("Invalid agent ID.");
+    }
+    return join(agentsDir(home), `${agentId}.json`);
+}
+export function agentWorkDir(agentId, home = homeDir()) {
+    agentConfigPath(agentId, home);
+    return join(agentsDir(home), agentId, "work");
+}
+export function agentLogPath(agentId, home = homeDir()) {
+    agentConfigPath(agentId, home);
+    return join(agentsDir(home), agentId, "gateway.log");
+}
+export async function writePrivateFile(path, content) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    try {
+        if ((await readFile(path, "utf8")) === content) {
+            await chmod(path, 0o600);
+            return false;
+        }
+    }
+    catch (error) {
+        if (!isMissing(error)) {
+            throw error;
+        }
+    }
+    const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporary, content, { mode: 0o600, flag: "wx" });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+    return true;
+}
+export async function storeAgent(config, home = homeDir()) {
+    await mkdir(agentsDir(home), { recursive: true, mode: 0o700 });
+    await chmod(agentsDir(home), 0o700);
+    await writePrivateFile(agentConfigPath(config.agentId, home), `${JSON.stringify(config, null, 2)}\n`);
+    await mkdir(agentWorkDir(config.agentId, home), {
+        recursive: true,
+        mode: 0o700,
+    });
+}
+export async function localAgents(home = homeDir()) {
+    let entries;
+    try {
+        entries = await readdir(agentsDir(home));
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return [];
+        }
+        throw error;
+    }
+    const agents = [];
+    for (const entry of entries.sort()) {
+        if (!entry.startsWith(".") && entry.endsWith(".json")) {
+            try {
+                const parsed = JSON.parse(await readFile(join(agentsDir(home), entry), "utf8"));
+                if (!isLinkedAgent(parsed) || entry !== `${parsed.agentId}.json`) {
+                    throw new Error("Invalid agent configuration.");
+                }
+                agents.push(parsed);
+            }
+            catch {
+                warn(`Skipping unreadable or invalid agent configuration ${redactAgentOutput(JSON.stringify(entry))}. Restore it to manage that agent.`);
+            }
+        }
+    }
+    return agents;
+}
+function isLinkedAgent(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const config = value;
+    return (typeof config.agentId === "string" &&
+        AGENT_ID.test(config.agentId) &&
+        typeof config.apiKey === "string" &&
+        config.apiKey.startsWith("tos_") &&
+        typeof config.apiUrl === "string" &&
+        typeof config.name === "string" &&
+        typeof config.linkHash === "string" &&
+        typeof config.linkedAt === "number" &&
+        (config.provider === "claude_code" || config.provider === "codex"));
+}
+export function isMissing(error) {
+    return (error !== null &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT");
+}

package/dist/agent-http.js

@@ -0,0 +1,176 @@
+import { spawnSync } from "node:child_process";
+import { isSecureUrl, } from "./agent-link.js";
+const REQUEST_TIMEOUT_MS = 10_000;
+const HEARTBEAT_WINDOW_MS = 60_000;
+export class AgentHttpError extends Error {
+    status;
+    retryAfterMs;
+    constructor(operation, response) {
+        super(`${operation} (HTTP ${response.status}). Ask for a fresh setup prompt if this link expired.`);
+        this.status = response.status;
+        const seconds = Number(response.headers.get("Retry-After"));
+        this.retryAfterMs = Number.isFinite(seconds)
+            ? Math.max(0, Math.min(60_000, seconds * 1000))
+            : 0;
+    }
+}
+export function apiOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (!(isSecureUrl(url) && url.pathname === "/" && !url.search && !url.hash)) {
+            throw new Error("Invalid origin");
+        }
+        return url.origin;
+    }
+    catch {
+        throw new Error("Use a secure TalentOS API origin with --api-url.");
+    }
+}
+export async function setupApiOrigin(link, override) {
+    if (override) {
+        return apiOrigin(override);
+    }
+    const response = await safeFetch(link.setupUrl);
+    const apiUrl = response.headers.get("X-TalentOS-Api-Url");
+    if (!(response.ok && apiUrl)) {
+        throw new Error("The setup page is unavailable. Ask for a fresh prompt or supply its API origin with --api-url.");
+    }
+    return apiOrigin(apiUrl);
+}
+export function inspectProvider(provider) {
+    const binary = provider === "claude_code" ? "claude" : "codex";
+    const version = spawnSync(binary, ["--version"], {
+        encoding: "utf8",
+        timeout: REQUEST_TIMEOUT_MS,
+    });
+    if (version.status !== 0 || !version.stdout?.trim()) {
+        throw new Error(`Install the official ${binary} CLI and sign in before linking.`);
+    }
+    const args = provider === "claude_code"
+        ? ["auth", "status", "--json"]
+        : ["login", "status"];
+    const login = spawnSync(binary, args, {
+        encoding: "utf8",
+        timeout: REQUEST_TIMEOUT_MS,
+    });
+    if (login.status !== 0) {
+        throw new Error(`Sign in through the official ${binary} CLI before linking.`);
+    }
+    if (provider === "claude_code") {
+        let loggedIn = false;
+        try {
+            const status = JSON.parse(login.stdout);
+            loggedIn =
+                !!status &&
+                    typeof status === "object" &&
+                    "loggedIn" in status &&
+                    status.loggedIn === true;
+        }
+        catch {
+            loggedIn = false;
+        }
+        if (!loggedIn) {
+            throw new Error("Sign in through the official claude CLI before linking.");
+        }
+    }
+    return version.stdout.trim().split("\n")[0]?.slice(0, 200) ?? "unknown";
+}
+export async function redeemAgent(apiUrl, body) {
+    const response = await safeFetch(`${apiOrigin(apiUrl)}/agent-link/redeem`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw new AgentHttpError("Could not redeem this link", response);
+    }
+    const value = await readJson(response);
+    if (!value ||
+        typeof value !== "object" ||
+        !("agentId" in value && "name" in value) ||
+        typeof value.agentId !== "string" ||
+        typeof value.name !== "string") {
+        throw new Error("TalentOS returned an invalid agent link. Ask for a fresh prompt.");
+    }
+    return { agentId: value.agentId, name: value.name };
+}
+export async function fetchAgentStatus(agent) {
+    const response = await safeFetch(`${apiOrigin(agent.apiUrl)}/agent-link/status`, { headers: { Authorization: `Bearer ${agent.apiKey}` } });
+    if (!response.ok) {
+        throw new AgentHttpError("Could not check the agent", response);
+    }
+    const value = await readJson(response);
+    if (!value || typeof value !== "object") {
+        throw new Error("TalentOS returned an invalid agent status.");
+    }
+    const status = value;
+    if (typeof status.agentId !== "string" ||
+        (agent.agentId !== undefined && status.agentId !== agent.agentId) ||
+        status.provider !== agent.provider ||
+        typeof status.name !== "string" ||
+        !Number.isFinite(status.serverNow) ||
+        !(status.lastSeenAt === null || typeof status.lastSeenAt === "number") ||
+        !["online", "busy", "offline"].includes(String(status.presence))) {
+        throw new Error("TalentOS returned an invalid agent status.");
+    }
+    return status;
+}
+export async function unlinkRemoteAgent(agent) {
+    const response = await safeFetch(`${apiOrigin(agent.apiUrl)}/agent-link/unlink`, { method: "POST", headers: { Authorization: `Bearer ${agent.apiKey}` } });
+    if (response.status === 401) {
+        return false;
+    }
+    if (!response.ok) {
+        throw new AgentHttpError("Could not disconnect the agent", response);
+    }
+    return true;
+}
+export async function waitForHeartbeat(agent, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 10 * 60_000);
+    let serverStartedAt;
+    const wait = options.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    while (Date.now() < deadline) {
+        let delay = 10_000;
+        try {
+            const status = await fetchAgentStatus(agent);
+            serverStartedAt ??= status.serverNow;
+            if (status.lastSeenAt !== null &&
+                status.lastSeenAt > serverStartedAt &&
+                status.lastSeenAt <= status.serverNow &&
+                status.serverNow - status.lastSeenAt < HEARTBEAT_WINDOW_MS &&
+                status.presence !== "offline") {
+                return status;
+            }
+        }
+        catch (error) {
+            if (error instanceof AgentHttpError && error.status === 401) {
+                throw error;
+            }
+            if (error instanceof AgentHttpError) {
+                delay = Math.max(delay, error.retryAfterMs);
+            }
+        }
+        await wait(Math.max(0, Math.min(delay, deadline - Date.now())));
+    }
+    return null;
+}
+async function safeFetch(url, init = {}) {
+    try {
+        return await fetch(url, {
+            ...init,
+            redirect: "error",
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error("Could not reach TalentOS. Check the network and try again.");
+    }
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new Error("TalentOS returned an invalid response.");
+    }
+}

package/dist/agent-link.js

@@ -0,0 +1,49 @@
+const INVALID_LINK = "Get a new setup prompt from TalentOS and pass its complete URL with --url.";
+const SETUP_PATH = /^\/agent-setup\/(claude_code|codex)\/?$/;
+const FRAGMENT_TOKEN = /((?:#|%23)token(?:=|%3d))[^\s"'<>]+/giu;
+const RAW_KEY = /\btos_[a-z\d_-]+/giu;
+const BEARER = /\bBearer\s+\S+/giu;
+const TOKEN_WHITESPACE = /\s/u;
+export function parseAgentLink(value) {
+    try {
+        const url = new URL(value);
+        const provider = SETUP_PATH.exec(url.pathname)?.[1];
+        const fragment = new URLSearchParams(url.hash.slice(1));
+        const tokens = fragment.getAll("token");
+        const token = tokens[0];
+        if (!(isSecureUrl(url) &&
+            (provider === "claude_code" || provider === "codex") &&
+            !url.search &&
+            fragment.size === 1 &&
+            tokens.length === 1 &&
+            token &&
+            token.length <= 200 &&
+            !TOKEN_WHITESPACE.test(token))) {
+            throw new Error(INVALID_LINK);
+        }
+        url.hash = "";
+        return { provider, setupUrl: url.href, token };
+    }
+    catch {
+        throw new Error(INVALID_LINK);
+    }
+}
+export function isSecureUrl(url) {
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    return (!(url.username || url.password) &&
+        (url.protocol === "https:" || (url.protocol === "http:" && loopback)));
+}
+export function redactAgentOutput(value, secrets = []) {
+    let safe = value;
+    for (const secret of secrets) {
+        if (secret) {
+            safe = safe
+                .replaceAll(secret, "[redacted]")
+                .replaceAll(encodeURIComponent(secret), "[redacted]");
+        }
+    }
+    return safe
+        .replace(FRAGMENT_TOKEN, "$1[redacted]")
+        .replace(RAW_KEY, "[redacted key]")
+        .replace(BEARER, "Bearer [redacted]");
+}

package/dist/agent-service.js

@@ -0,0 +1,145 @@
+import { spawnSync } from "node:child_process";
+import { chmod, mkdir, open, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { agentLogPath, agentWorkDir, writePrivateFile, } from "./agent-config.js";
+import { homeDir } from "./install.js";
+export function runCommand(command, args) {
+    return (spawnSync(command, args, { stdio: "ignore", timeout: 15_000 }).status ?? 1);
+}
+export async function installAgentService(agent, options = {}) {
+    const home = options.home ?? homeDir();
+    const platform = options.platform ?? process.platform;
+    const run = options.run ?? runCommand;
+    const name = serviceName(agent.agentId);
+    const path = servicePath(agent.agentId, platform, home);
+    const logPath = agentLogPath(agent.agentId, home);
+    await mkdir(agentWorkDir(agent.agentId, home), {
+        recursive: true,
+        mode: 0o700,
+    });
+    const log = await open(logPath, "a", 0o600);
+    await log.close();
+    await chmod(logPath, 0o600);
+    if (!path) {
+        return { path: "", started: false };
+    }
+    const args = [
+        options.nodePath ?? process.execPath,
+        options.cliPath ?? fileURLToPath(new URL("./index.js", import.meta.url)),
+        "agent",
+        "serve",
+        "--agent",
+        agent.agentId,
+    ];
+    const workDir = agentWorkDir(agent.agentId, home);
+    const content = platform === "darwin"
+        ? launchdUnit(name, args, workDir, logPath)
+        : systemdUnit(args, workDir, logPath);
+    const changed = await writePrivateFile(path, content);
+    if (platform === "darwin") {
+        const domain = `gui/${options.uid ?? process.getuid?.() ?? 0}`;
+        const loaded = run("launchctl", ["print", `${domain}/${name}`]) === 0;
+        if (loaded && !changed) {
+            return { path, started: true };
+        }
+        if (loaded) {
+            run("launchctl", ["bootout", domain, path]);
+        }
+        return {
+            path,
+            started: run("launchctl", ["bootstrap", domain, path]) === 0,
+        };
+    }
+    if (changed && run("systemctl", ["--user", "daemon-reload"]) !== 0) {
+        return { path, started: false };
+    }
+    return {
+        path,
+        started: run("systemctl", [
+            "--user",
+            "enable",
+            "--now",
+            `talentos-agent@${agent.agentId}.service`,
+        ]) === 0,
+    };
+}
+export async function uninstallAgentService(agent, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const path = servicePath(agent.agentId, platform, options.home ?? homeDir());
+    if (!path) {
+        return;
+    }
+    const run = options.run ?? runCommand;
+    if (platform === "darwin") {
+        run("launchctl", [
+            "bootout",
+            `gui/${options.uid ?? process.getuid?.() ?? 0}`,
+            path,
+        ]);
+    }
+    else {
+        run("systemctl", [
+            "--user",
+            "disable",
+            "--now",
+            `talentos-agent@${agent.agentId}.service`,
+        ]);
+    }
+    await rm(path, { force: true });
+    if (platform === "linux") {
+        run("systemctl", ["--user", "daemon-reload"]);
+    }
+}
+function serviceName(agentId) {
+    return `so.talentos.agent.${agentId}`;
+}
+function servicePath(agentId, platform, home) {
+    agentWorkDir(agentId, home);
+    if (platform === "darwin") {
+        return join(home, "Library", "LaunchAgents", `${serviceName(agentId)}.plist`);
+    }
+    return platform === "linux"
+        ? join(home, ".config", "systemd", "user", `talentos-agent@${agentId}.service`)
+        : "";
+}
+function launchdUnit(name, args, workDir, logPath) {
+    const xml = (value) => value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${xml(name)}</string>
+<key>ProgramArguments</key><array>${args.map((arg) => `<string>${xml(arg)}</string>`).join("")}</array>
+<key>WorkingDirectory</key><string>${xml(workDir)}</string>
+<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin")}</string></dict>
+<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
+<key>StandardOutPath</key><string>${xml(logPath)}</string>
+<key>StandardErrorPath</key><string>${xml(logPath)}</string>
+</dict></plist>
+`;
+}
+function systemdUnit(args, workDir, logPath) {
+    const quote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("\n", "\\n").replaceAll("\r", "\\r")}"`;
+    return `[Unit]
+Description=TalentOS agent gateway
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${args.map(quote).join(" ")}
+WorkingDirectory=${quote(workDir)}
+Environment=${quote(`PATH=${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}`)}
+Restart=always
+RestartSec=5
+StandardOutput=${quote(`append:${logPath}`)}
+StandardError=${quote(`append:${logPath}`)}
+
+[Install]
+WantedBy=default.target
+`;
+}

package/dist/args.js

@@ -19,9 +19,12 @@ const CLI_OPTIONS = {
     global: { type: "boolean" },
     apply: { type: "boolean" },
     "no-pull": { type: "boolean" },
+    url: { type: "string" },
+    yes: { type: "boolean" },
+    agent: { type: "string" },
 };
 /** Groups whose first positional is a sub-command rather than an argument. */
-const ACTION_GROUPS = new Set(["mcp", "skills", "memory", "routines"]);
+const ACTION_GROUPS = new Set(["agent", "mcp", "skills", "memory", "routines"]);
 export function parseArgv(argv) {
     const { values, positionals } = parse(argv);
     const group = positionals[0];

package/dist/commands/agent-serve.js

@@ -0,0 +1,42 @@
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { childEnvironment, verifyClaudeCode } from "../agent/adapters.js";
+import { serveAgent } from "../agent/serve.js";
+import { agentWorkDir, localAgents } from "../agent-config.js";
+export async function runAgentServe(parsed) {
+    const id = parsed.options.agent;
+    const agents = await localAgents();
+    let config = agents.find((agent) => agent.agentId === id);
+    if (!id && agents.length === 1) {
+        config = agents[0];
+    }
+    if (!config) {
+        throw new Error("Choose a linked agent with `talentos agent serve --agent <id>`.");
+    }
+    if (config.provider === "claude_code") {
+        await verifyClaudeCode();
+    }
+    const stop = new AbortController();
+    const abort = () => stop.abort();
+    process.once("SIGTERM", abort);
+    process.once("SIGINT", abort);
+    const version = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+    try {
+        const updated = await serveAgent(config, dirname(agentWorkDir(config.agentId)), version, stop.signal);
+        if (updated && !stop.signal.aborted) {
+            await new Promise((resolve, reject) => {
+                const child = spawn(process.execPath, [updated, "agent", "serve", "--agent", config.agentId], { env: childEnvironment(), stdio: "inherit", signal: stop.signal });
+                child.once("error", () => reject(new Error("Updated gateway could not start.")));
+                child.once("close", (code) => {
+                    process.exitCode = code ?? 1;
+                    resolve();
+                });
+            });
+        }
+    }
+    finally {
+        process.removeListener("SIGTERM", abort);
+        process.removeListener("SIGINT", abort);
+    }
+}