talentos 1.0.0 → 1.1.1

package/dist/gateway-install.js

@@ -0,0 +1,343 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { cp, link, mkdir, readdir, readFile, readlink, realpath, rename, rm, stat, symlink, } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { writePrivateFile } from "./agent-config.js";
+import { compareGatewayVersions } from "./gateway-version.js";
+import { homeDir } from "./install.js";
+const exec = promisify(execFile);
+const TRANSIENT_BIN = /(?:\/_npx\/|node_modules\/\.bin|node-gyp-bin|\/Cellar\/|\/\.nvm\/versions\/)/;
+const NPM_ENV = new Set([
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "LANG",
+    "LC_ALL",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "SystemRoot",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+]);
+export function gatewayLauncherPath(home = homeDir()) {
+    return join(home, ".talentos", "bin", "talentos-gateway");
+}
+export function servicePathEnv(home = homeDir()) {
+    return [
+        ...new Set([
+            ...(process.env.PATH ?? "")
+                .split(":")
+                .filter((entry) => entry.startsWith("/") && !TRANSIENT_BIN.test(entry)),
+            join(home, ".local/bin"),
+            join(home, ".npm-global/bin"),
+            "/opt/homebrew/bin",
+            "/usr/local/bin",
+            "/usr/bin",
+            "/bin",
+        ]),
+    ].join(":");
+}
+// No user paths are interpolated into executable shell text. The Node hint is data.
+const LAUNCHER = `#!/bin/sh
+set -f
+root="\${0%/*}/.."
+agent=
+next_agent=
+for argument in "$@"; do
+  if [ "$next_agent" = yes ]; then agent=$argument; break; fi
+  if [ "$argument" = --agent ]; then next_agent=yes; fi
+done
+node_missing=
+case "$agent" in
+  ''|*[!a-zA-Z0-9_-]*) ;;
+  *) node_missing="$root/agents/$agent/.node-missing" ;;
+esac
+qualifies() {
+  [ -n "$1" ] && [ -x "$1" ] && "$1" -e 'process.exit(Number(process.versions.node.split(".")[0]) >= 20 ? 0 : 1)' >/dev/null 2>&1
+}
+start() {
+  if [ -n "$node_missing" ]; then /bin/rm -f "$node_missing"; fi
+  node=$1
+  shift
+  PATH="\${node%/*}:\${PATH:-/usr/bin:/bin}"
+  export PATH
+  exec "$node" "$root/cli/current/node_modules/talentos/dist/index.js" "$@"
+}
+node_hint=
+IFS= read -r node_hint < "$root/cli/node-path" || :
+if qualifies "\${TALENTOS_NODE:-}"; then
+  start "$TALENTOS_NODE" "$@"
+fi
+if qualifies "$node_hint"; then
+  start "$node_hint" "$@"
+fi
+old_ifs=$IFS
+IFS=:
+for dir in \${PATH:-}; do
+  IFS=$old_ifs
+  if qualifies "$dir/node"; then
+    start "$dir/node" "$@"
+  fi
+  IFS=:
+done
+IFS=$old_ifs
+for candidate in /opt/homebrew/bin/node /usr/local/bin/node; do
+  if qualifies "$candidate"; then
+    start "$candidate" "$@"
+  fi
+done
+# nvm has no stable system bin; discover surviving installations at startup.
+set +f
+for candidate in "$root"/../.nvm/versions/node/*/bin/node; do
+  if qualifies "$candidate"; then start "$candidate" "$@"; fi
+done
+message='TalentOS gateway requires Node.js 20 or newer. Install Node, then run talentos agent repair.'
+if [ -z "$node_missing" ]; then
+  echo "$message" >&2
+elif (set -C; : > "$node_missing") 2>/dev/null; then
+  echo "$message" >> "$root/agents/$agent/gateway.log"
+fi
+exit 78
+`;
+async function manifestVersion(root) {
+    return JSON.parse(await readFile(join(root, "package.json"), "utf8")).version;
+}
+async function copyPackage(source, destination) {
+    await mkdir(destination, { recursive: true, mode: 0o700 });
+    for (const name of ["package.json", "dist", "node_modules"]) {
+        try {
+            await cp(join(source, name), join(destination, name), {
+                recursive: true,
+                dereference: true,
+                force: true,
+            });
+        }
+        catch (error) {
+            if (name !== "node_modules" ||
+                error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+}
+async function installed(root, version) {
+    try {
+        if ((await manifestVersion(root)) !== version ||
+            !(await readFile(join(root, "dist/index.js"))).length) {
+            return false;
+        }
+        const { dependencies = {} } = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+        // The SDK has no root entrypoint. Load the same exports the CLI uses;
+        // imports also catch missing transitive dependencies in partial installs.
+        const imports = Object.keys(dependencies).flatMap((name) => name === "@modelcontextprotocol/sdk"
+            ? [
+                `${name}/client/index.js`,
+                `${name}/server/index.js`,
+                `${name}/types.js`,
+            ]
+            : [name]);
+        if (imports.length) {
+            await exec(process.execPath, [
+                "--input-type=module",
+                "--eval",
+                `await Promise.all(${JSON.stringify(imports)}.map(name => import(name)))`,
+            ], { cwd: root, timeout: 15_000 });
+        }
+        return true;
+    }
+    catch (error) {
+        if (error.killed) {
+            throw new Error("Gateway dependency check timed out. Keeping the current version; retry agent repair shortly.");
+        }
+        return false;
+    }
+}
+async function installLock(root, signal) {
+    const path = join(root, ".install-lock");
+    const pending = join(root, `.lock-${randomUUID()}`);
+    const contents = `${process.pid}\n${randomUUID()}`;
+    // Publish a populated lock atomically so a second installer never sees an
+    // empty new lock and mistakes it for one left behind by a crash.
+    await writePrivateFile(pending, contents);
+    try {
+        for (let attempt = 0; attempt < 600; attempt++) {
+            signal?.throwIfAborted();
+            try {
+                await link(pending, path);
+                return async () => {
+                    if ((await readFile(path, "utf8").catch(() => "")) === contents) {
+                        await rm(path, { force: true });
+                    }
+                };
+            }
+            catch (error) {
+                if (error.code !== "EEXIST") {
+                    throw error;
+                }
+                try {
+                    const lock = await readFile(path, "utf8");
+                    const metadata = await stat(path);
+                    const age = Date.now() - metadata.mtimeMs;
+                    const pid = Number(lock.split("\n")[0]);
+                    let stale = !lock.trim() || age > 5 * 60_000;
+                    if (!stale && pid > 0) {
+                        try {
+                            process.kill(pid, 0);
+                        }
+                        catch (failure) {
+                            stale = failure.code === "ESRCH";
+                        }
+                    }
+                    if (stale && (await readFile(path, "utf8")) === lock) {
+                        const latest = await stat(path);
+                        if (latest.dev === metadata.dev && latest.ino === metadata.ino) {
+                            await rm(path, { force: true });
+                            continue;
+                        }
+                    }
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT") {
+                        throw error;
+                    }
+                    continue;
+                }
+                await delay(200, undefined, { signal });
+            }
+        }
+        throw new Error("Another gateway installation is still running. Retry agent repair shortly.");
+    }
+    finally {
+        await rm(pending, { force: true });
+    }
+}
+export async function installSharedGateway(options = {}) {
+    const home = options.home ?? homeDir();
+    const source = options.source ?? fileURLToPath(new URL("../", import.meta.url));
+    const ownVersion = await manifestVersion(source);
+    let version = options.version ?? ownVersion;
+    if (compareGatewayVersions(version, version) === undefined) {
+        throw new Error("Unsupported gateway version.");
+    }
+    const root = join(home, ".talentos/cli");
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const release = await installLock(root, options.signal);
+    const temporary = join(root, `.install-${randomUUID()}`);
+    const pointer = join(root, `.current-${randomUUID()}`);
+    let stagedVersion;
+    try {
+        const active = await readlink(join(root, "current")).catch(() => "");
+        if ((compareGatewayVersions(active, version) ?? 0) > 0 &&
+            (await installed(join(root, active, "node_modules/talentos"), active))) {
+            version = active;
+        }
+        const destination = join(root, version);
+        const pkg = join(destination, "node_modules/talentos");
+        if (!(await installed(pkg, version))) {
+            await mkdir(temporary, { mode: 0o700 });
+            // Local builds have not been published. Copy resolved dependencies too,
+            // so pnpm's symlinks cannot strand the installed gateway in a worktree.
+            if (version === ownVersion &&
+                !source.includes("/node_modules/talentos")) {
+                await copyPackage(source, join(temporary, "node_modules/talentos"));
+            }
+            else {
+                const npmEnv = {
+                    PATH: `${process.env.PATH ?? servicePathEnv()}:${dirname(process.execPath)}`,
+                };
+                for (const [key, value] of Object.entries(process.env)) {
+                    if ((NPM_ENV.has(key) || key.toLowerCase().startsWith("npm_config_")) &&
+                        value) {
+                        npmEnv[key] = value;
+                    }
+                }
+                try {
+                    await exec("npm", [
+                        "install",
+                        "--prefix",
+                        temporary,
+                        "--omit=dev",
+                        "--ignore-scripts",
+                        "--no-audit",
+                        "--no-fund",
+                        `talentos@${version}`,
+                    ], { env: npmEnv, signal: options.signal, timeout: 90_000 });
+                }
+                catch {
+                    if (version === ownVersion) {
+                        await rm(temporary, { recursive: true, force: true });
+                        await copyPackage(source, join(temporary, "node_modules/talentos"));
+                    }
+                    else {
+                        throw new Error("Gateway update failed. Serving the current version; retrying when the network is available.");
+                    }
+                }
+            }
+            if (!(await installed(join(temporary, "node_modules/talentos"), version))) {
+                throw new Error("Gateway package is incomplete. Restore its runtime dependencies or retry agent repair online.");
+            }
+            await rm(destination, { recursive: true, force: true });
+            await rename(temporary, destination);
+            if (version !== active) {
+                stagedVersion = destination;
+            }
+        }
+        let previous;
+        try {
+            previous = await readlink(join(root, "current"));
+        }
+        catch {
+            /* First install. */
+        }
+        await symlink(version, pointer);
+        await rename(pointer, join(root, "current"));
+        stagedVersion = undefined;
+        const launcher = gatewayLauncherPath(home);
+        await writePrivateFile(launcher, LAUNCHER, 0o700);
+        let nodePath = options.nodePath ?? process.execPath;
+        for (const stable of [
+            "/opt/homebrew/bin/node",
+            "/usr/local/bin/node",
+            "/usr/bin/node",
+        ]) {
+            if ((await realpath(stable).catch(() => "")) === nodePath) {
+                nodePath = stable;
+                break;
+            }
+        }
+        // Preserve the link-time hint during updates and repairs.
+        const hint = join(root, "node-path");
+        try {
+            await readFile(hint);
+        }
+        catch {
+            await writePrivateFile(hint, `${nodePath}\n`);
+        }
+        const keep = new Set([version, previous]);
+        const oldVersions = (await readdir(root))
+            .filter((entry) => compareGatewayVersions(entry, entry) !== undefined && !keep.has(entry))
+            .sort((a, b) => compareGatewayVersions(b, a) ?? 0);
+        // A repeat repair retains the other installed version.
+        if (previous === version) {
+            oldVersions.shift();
+        }
+        for (const old of oldVersions) {
+            await rm(join(root, old), { recursive: true, force: true });
+        }
+        return launcher;
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+        await rm(pointer, { force: true });
+        if (stagedVersion) {
+            await rm(stagedVersion, { recursive: true, force: true });
+        }
+        await release();
+    }
+}

package/dist/gateway-version.js

@@ -0,0 +1,45 @@
+const VERSION = /^(\d+)\.(\d+)\.(\d+)(?:-([\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*))?(?:\+[\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*)?$/;
+const NUMERIC_IDENTIFIER = /^\d+$/;
+export function compareGatewayVersions(a, b) {
+    const left = VERSION.exec(a), right = VERSION.exec(b);
+    if (!(left && right)) {
+        return;
+    }
+    for (let i = 1; i <= 3; i++) {
+        const difference = Number(left[i]) - Number(right[i]);
+        if (difference) {
+            return difference;
+        }
+    }
+    if (left[4] === right[4]) {
+        return 0;
+    }
+    if (!left[4]) {
+        return 1;
+    }
+    if (!right[4]) {
+        return -1;
+    }
+    const l = left[4].split("."), r = right[4].split(".");
+    for (let i = 0; i < Math.max(l.length, r.length); i++) {
+        const x = l[i], y = r[i];
+        if (x === undefined) {
+            return -1;
+        }
+        if (y === undefined) {
+            return 1;
+        }
+        if (x === y) {
+            continue;
+        }
+        const xn = NUMERIC_IDENTIFIER.test(x), yn = NUMERIC_IDENTIFIER.test(y);
+        if (xn && yn) {
+            return Number(x) - Number(y);
+        }
+        if (xn !== yn) {
+            return xn ? -1 : 1;
+        }
+        return x < y ? -1 : 1;
+    }
+    return 0;
+}

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
+import { redactAgentOutput } from "./agent-link.js";
 import { parseArgv } from "./args.js";
 import { emit } from "./format.js";
 const USAGE = `talentos — your team's skills, memory and Talent, from any coding agent.
@@ -8,6 +9,7 @@ Usage: talentos <command> [options]
 
 Commands:
   init                                    Connect this machine's agents to TalentOS
+  agent <link|repair|status|list|unlink|logs>      Bring your own agent into Rooms
   login                                   Authorize this machine
   logout                                  Forget the key stored on this machine
   whoami                                  Show the member and org this key acts as
@@ -26,6 +28,17 @@ Options:
 
 Run \`talentos <command> --help\` for command options.`;
 const GROUP_USAGE = {
+    agent: `talentos agent link --url <setup-url-with-#token> [--yes] [--name <device>]
+talentos agent status | list [--json] [--agent <id>]
+talentos agent unlink [name] [--agent <id>]
+talentos agent logs [--agent <id>]
+talentos agent repair [--agent <id>]
+talentos agent serve --agent <id>
+
+The link command checks the provider's CLI login, mints the key locally, and
+installs one user service per agent. Only the key hash is sent to redeem.
+Config is private under ~/.talentos/agents. Never print the setup fragment.
+Serve is supplied by the S6 gateway release; Connected requires its heartbeat.`,
     init: `talentos init [--for claude|cursor|codex|all] [--no-pull] [--name <device>]
 
 One command: signs you in (skipped when your stored key still works), writes the
@@ -88,6 +101,8 @@ function helpFor(group) {
 }
 async function dispatch(parsed) {
     switch (parsed.group) {
+        case "agent":
+            return await (await import("./commands/agent.js")).runAgent(parsed);
         case "init":
             return await (await import("./commands/init.js")).runInit(parsed);
         case "login":
@@ -120,6 +135,14 @@ function version() {
 }
 main(process.argv.slice(2)).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`${message.split("\n")[0]}\n`);
+    const fragments = process.argv.flatMap((arg) => {
+        try {
+            return new URLSearchParams(new URL(arg).hash.slice(1)).getAll("token");
+        }
+        catch {
+            return [];
+        }
+    });
+    process.stderr.write(`${redactAgentOutput(message, fragments).split("\n")[0]}\n`);
     process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talentos",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "type": "module",
   "description": "TalentOS CLI: push and pull skills, read and write team memory, and delegate work to your Talent from any coding agent.",
   "repository": {
@@ -25,6 +25,7 @@
     "prepack": "rm -rf dist && tsc -p tsconfig.build.json"
   },
   "dependencies": {
+    "convex": "^1.43.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.4.3"
   },