talentos 1.1.0 → 1.1.1

package/dist/agent/adapters.js

@@ -1,4 +1,5 @@
 import { execFile, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline";
@@ -6,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { writePrivateFile } from "../agent-config.js";
 import { redactAgentOutput, } from "../agent-link.js";
+import { gatewayLauncherPath } from "../gateway-install.js";
 const CHILD_ENV = [
     "HOME",
     "PATH",
@@ -23,8 +25,12 @@ const CHILD_ENV = [
     "CLAUDE_CONFIG_DIR",
 ];
 const CLAUDE_VERSION = /^\d+\.\d+\.\d+/u;
+const CODEX_VERSION = /\b\d+\.\d+\.\d+\b/u;
 const DONT_ASK = /\bdontAsk\b/u;
-const CLAUDE_TOOLS = [
+// Kept package-local for the published CLI. The launch tests compare both
+// adapters against the server's exported ROOM_AGENT_TOOLS contract.
+const ROOM_TOOLS = [
+    "list_rooms",
     "read_room",
     "list_room_files",
     "read_file",
@@ -33,9 +39,9 @@ const CLAUDE_TOOLS = [
     "create_deck",
     "post_message",
     "share_link",
-]
-    .map((tool) => `mcp__talentos__${tool}`)
-    .join(",");
+    "whoami",
+];
+const CLAUDE_TOOLS = ROOM_TOOLS.map((tool) => `mcp__talentos__${tool}`).join(",");
 export function childEnvironment(source = process.env) {
     return Object.fromEntries(CHILD_ENV.filter((key) => source[key] !== undefined).map((key) => [
         key,
@@ -63,6 +69,77 @@ export async function verifyClaudeCode() {
     }
     throw new Error(`Update Claude Code (${version}) to a version that supports --permission-mode dontAsk.`);
 }
+export async function verifyCodex() {
+    const execute = promisify(execFile);
+    const options = {
+        env: childEnvironment(),
+        timeout: 5000,
+        maxBuffer: 256_000,
+    };
+    let version = "unknown";
+    try {
+        const detected = await execute("codex", ["--version"], options);
+        version = CODEX_VERSION.exec(detected.stdout)?.[0] ?? "unknown";
+        for (const args of [
+            ["exec", "--help"],
+            ["exec", "resume", "--help"],
+        ]) {
+            const help = await execute("codex", args, options);
+            if (![
+                "--json",
+                "--skip-git-repo-check",
+                "--ignore-user-config",
+                "--ignore-rules",
+            ].every((flag) => help.stdout.includes(flag))) {
+                throw new Error("Unsupported Codex flags");
+            }
+        }
+        if (version !== "unknown") {
+            await codexRoomCatalog();
+            return;
+        }
+    }
+    catch {
+        // Provider diagnostics can contain login details.
+    }
+    throw new Error(`Update Codex (${version}) to a version supporting isolated room turns, exec/resume flags and a local model catalog.`);
+}
+async function codexRoomCatalog() {
+    try {
+        const { stdout } = await promisify(execFile)("codex", ["debug", "models", "--bundled"], {
+            env: childEnvironment(),
+            timeout: 5000,
+            maxBuffer: 4_000_000,
+        });
+        const catalog = JSON.parse(stdout);
+        if (!Array.isArray(catalog.models) || catalog.models.length === 0) {
+            throw new Error("Missing model catalog");
+        }
+        const models = catalog.models.map((model) => {
+            if (!model ||
+                typeof model !== "object" ||
+                !("slug" in model) ||
+                !("apply_patch_tool_type" in model)) {
+                throw new Error("Unsupported model catalog");
+            }
+            return {
+                ...model,
+                // apply_patch has no feature toggle: its exposure comes from model
+                // metadata. A local catalog removes it before tool registration.
+                apply_patch_tool_type: null,
+                shell_type: "disabled",
+                experimental_supported_tools: [],
+                // Code-mode-only models route MCP through native execution. Expose
+                // allowed MCP functions directly while native execution stays off.
+                tool_mode: "direct",
+            };
+        });
+        return JSON.stringify({ ...catalog, models });
+    }
+    catch {
+        throw new Error("Update Codex to a version supporting a local room-only model catalog.");
+    }
+}
 export function readProviderEvent(provider, value) {
     if (!value || typeof value !== "object") {
         return {};
@@ -110,6 +187,7 @@ export function readProviderEvent(provider, value) {
 export async function runProvider(input) {
     const { config, job, workDir, sessionId, signal } = input;
     const prompt = JSON.stringify(job.packet), mcpPath = join(dirname(workDir), ".talentos-mcp.json");
+    const catalogPath = join(dirname(workDir), ".talentos-codex-models.json");
     let command, args;
     if (config.provider === "claude_code") {
         await writePrivateFile(mcpPath, JSON.stringify({
@@ -148,12 +226,14 @@ export async function runProvider(input) {
     }
     else {
         command = "codex";
-        const entry = fileURLToPath(new URL("./mcp-entry.js", import.meta.url));
+        const launcher = gatewayLauncherPath();
+        const useLauncher = process.platform !== "win32" && existsSync(launcher);
+        await writePrivateFile(catalogPath, await codexRoomCatalog());
         // Resume has a different flag surface. Root overrides are inherited by
         // both exec paths; shell_tool=false enforces ADR 0093's default no-Bash.
         args = [
             "-c",
-            'sandbox_mode="workspace-write"',
+            'sandbox_mode="read-only"',
             "-c",
             'approval_policy="never"',
             "-c",
@@ -161,9 +241,31 @@ export async function runProvider(input) {
             "-c",
             "features.unified_exec=false",
             "-c",
-            `mcp_servers.talentos.command=${JSON.stringify(process.execPath)}`,
+            'web_search="disabled"',
+            "-c",
+            "features.view_image=false",
+            "-c",
+            "features.image_generation=false",
+            "-c",
+            "features.apps=false",
+            "-c",
+            "features.plugins=false",
+            "-c",
+            "features.multi_agent=false",
+            "-c",
+            "features.skip_host_skill_discovery=true",
+            "-c",
+            "memories.use_memories=false",
+            "-c",
+            "memories.generate_memories=false",
+            "-c",
+            `model_catalog_json=${JSON.stringify(catalogPath)}`,
+            "-c",
+            `mcp_servers.talentos.enabled_tools=${JSON.stringify(ROOM_TOOLS)}`,
+            "-c",
+            `mcp_servers.talentos.command=${JSON.stringify(useLauncher ? launcher : process.execPath)}`,
             "-c",
-            `mcp_servers.talentos.args=${JSON.stringify([entry, config.agentId])}`,
+            `mcp_servers.talentos.args=${JSON.stringify([...(useLauncher ? [] : [fileURLToPath(new URL("../index.js", import.meta.url))]), "agent", "mcp", "--agent", config.agentId])}`,
             "exec",
         ];
         if (sessionId) {
@@ -256,5 +358,6 @@ export async function runProvider(input) {
             clearTimeout(killTimer);
         }
         await rm(mcpPath, { force: true });
+        await rm(catalogPath, { force: true });
     }
 }

package/dist/agent/mcp-entry.js

@@ -1,9 +1,10 @@
 import { localAgents } from "../agent-config.js";
+import { parseArgv } from "../args.js";
 import { AgentClient } from "../client.js";
 import { startMcpProxy } from "../mcp-proxy.js";
 // A local stdio entry avoids putting the bearer key in Codex's argv or child
 // environment. Only the MCP proxy reads the linked-agent credential file.
-const config = (await localAgents()).find((agent) => agent.agentId === process.argv[2]);
+const config = (await localAgents()).find((agent) => agent.agentId === parseArgv(process.argv.slice(2)).options.agent);
 if (!config) {
     throw new Error("Linked agent configuration is unavailable.");
 }

package/dist/agent/serve.js

@@ -1,29 +1,20 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { childEnvironment, runProvider } from "./adapters.js";
+import { installSharedGateway } from "../gateway-install.js";
+import { compareGatewayVersions } from "../gateway-version.js";
+import { runProvider } from "./adapters.js";
 import { AgentGateway, GatewayError } from "./gateway.js";
 import { SessionMap } from "./sessions.js";
 const HEARTBEAT_MS = 20_000;
 const LEASE_SAFETY_MS = 55_000;
 const IDLE_MS = 30 * 60_000;
-const VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
 export function needsUpdate(current, minimum) {
-    const a = VERSION.exec(current), b = VERSION.exec(minimum);
-    if (!b) {
+    if (compareGatewayVersions(minimum, minimum) === undefined) {
         return false;
     }
-    if (!a) {
-        return true;
-    }
-    for (let i = 1; i <= 3; i++) {
-        if (Number(a[i]) !== Number(b[i])) {
-            return Number(a[i]) < Number(b[i]);
-        }
-    }
-    return false;
+    return (compareGatewayVersions(current, minimum) ?? -1) < 0;
 }
 export function claimPollInterval(lastJobAt, now = Date.now()) {
     return now - lastJobAt >= IDLE_MS ? 10_000 : 2000;
@@ -58,27 +49,11 @@ async function acquireLock(directory) {
     };
 }
 export async function installGatewayUpdate(directory, minimum, signal) {
-    if (!VERSION.test(minimum)) {
-        throw new Error("Unsupported gateway minimum version.");
-    }
-    const destination = join(directory, "gateway-cli");
-    await new Promise((resolve, reject) => {
-        const child = spawn("npm", [
-            "install",
-            "--prefix",
-            destination,
-            "--omit=dev",
-            "--ignore-scripts",
-            "--no-audit",
-            "--no-fund",
-            `talentos@${minimum}`,
-        ], { env: childEnvironment(), stdio: "ignore", signal });
-        child.once("error", () => reject(new Error("Gateway update could not start.")));
-        child.once("close", (code) => code === 0
-            ? resolve()
-            : reject(new Error("Gateway update failed. Retry when the network is available.")));
+    return await installSharedGateway({
+        home: dirname(dirname(dirname(directory))),
+        version: minimum,
+        signal,
     });
-    return join(destination, "node_modules", "talentos", "dist", "index.js");
 }
 export async function serveAgent(config, directory, version, stop) {
     const release = await acquireLock(directory);
@@ -144,6 +119,7 @@ export async function serveAgent(config, directory, version, stop) {
             }
         };
         let heartbeats;
+        let updateAfter = 0;
         const watchdog = setInterval(() => {
             if (active && Date.now() >= active.deadline) {
                 active.cancel.abort();
@@ -164,8 +140,17 @@ export async function serveAgent(config, directory, version, stop) {
             }
             heartbeats = heartbeatLoop();
             while (!signal.aborted) {
-                if (needsUpdate(version, minimum)) {
-                    return await installGatewayUpdate(directory, minimum, signal);
+                if (needsUpdate(version, minimum) && Date.now() >= updateAfter) {
+                    if (process.platform === "win32") {
+                        throw new Error(`Gateway update required; re-run npx talentos@${minimum} agent serve --agent ${config.agentId}. Windows gateways update in the foreground.`);
+                    }
+                    try {
+                        return await installGatewayUpdate(directory, minimum, signal);
+                    }
+                    catch {
+                        updateAfter = Date.now() + 60_000;
+                        console.error("Gateway update unavailable. Serving the current version; retrying in one minute.");
+                    }
                 }
                 wakePending = false;
                 let job;

package/dist/agent-config.js

@@ -22,11 +22,11 @@ export function agentLogPath(agentId, home = homeDir()) {
     agentConfigPath(agentId, home);
     return join(agentsDir(home), agentId, "gateway.log");
 }
-export async function writePrivateFile(path, content) {
+export async function writePrivateFile(path, content, mode = 0o600) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     try {
         if ((await readFile(path, "utf8")) === content) {
-            await chmod(path, 0o600);
+            await chmod(path, mode);
             return false;
         }
     }
@@ -37,7 +37,7 @@ export async function writePrivateFile(path, content) {
     }
     const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(temporary, content, { mode: 0o600, flag: "wx" });
+        await writeFile(temporary, content, { mode, flag: "wx" });
         await rename(temporary, path);
     }
     finally {

package/dist/agent-http.js

@@ -92,7 +92,13 @@ export async function redeemAgent(apiUrl, body) {
         typeof value.name !== "string") {
         throw new Error("TalentOS returned an invalid agent link. Ask for a fresh prompt.");
     }
-    return { agentId: value.agentId, name: value.name };
+    const retiredAgentIds = "retiredAgentIds" in value ? value.retiredAgentIds : undefined;
+    if (retiredAgentIds !== undefined &&
+        (!Array.isArray(retiredAgentIds) ||
+            retiredAgentIds.some((id) => typeof id !== "string"))) {
+        throw new Error("TalentOS returned an invalid agent link. Ask for a fresh prompt.");
+    }
+    return { agentId: value.agentId, name: value.name, retiredAgentIds };
 }
 export async function fetchAgentStatus(agent) {
     const response = await safeFetch(`${apiOrigin(agent.apiUrl)}/agent-link/status`, { headers: { Authorization: `Bearer ${agent.apiKey}` } });

package/dist/agent-service.js

@@ -1,8 +1,8 @@
 import { spawnSync } from "node:child_process";
 import { chmod, mkdir, open, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { agentLogPath, agentWorkDir, writePrivateFile, } from "./agent-config.js";
+import { gatewayLauncherPath, servicePathEnv } from "./gateway-install.js";
 import { homeDir } from "./install.js";
 export function runCommand(command, args) {
     return (spawnSync(command, args, { stdio: "ignore", timeout: 15_000 }).status ?? 1);
@@ -25,8 +25,7 @@ export async function installAgentService(agent, options = {}) {
         return { path: "", started: false };
     }
     const args = [
-        options.nodePath ?? process.execPath,
-        options.cliPath ?? fileURLToPath(new URL("./index.js", import.meta.url)),
+        gatewayLauncherPath(home),
         "agent",
         "serve",
         "--agent",
@@ -34,9 +33,15 @@ export async function installAgentService(agent, options = {}) {
     ];
     const workDir = agentWorkDir(agent.agentId, home);
     const content = platform === "darwin"
-        ? launchdUnit(name, args, workDir, logPath)
-        : systemdUnit(args, workDir, logPath);
+        ? launchdUnit(name, args, workDir, logPath, servicePathEnv(home))
+        : systemdUnit(args, workDir, logPath, servicePathEnv(home));
     const changed = await writePrivateFile(path, content);
+    if (options.reload === false) {
+        if (platform === "linux" && changed) {
+            run("systemctl", ["--user", "daemon-reload"]);
+        }
+        return { path, started: true };
+    }
     if (platform === "darwin") {
         const domain = `gui/${options.uid ?? process.getuid?.() ?? 0}`;
         const loaded = run("launchctl", ["print", `${domain}/${name}`]) === 0;
@@ -103,7 +108,7 @@ function servicePath(agentId, platform, home) {
         ? join(home, ".config", "systemd", "user", `talentos-agent@${agentId}.service`)
         : "";
 }
-function launchdUnit(name, args, workDir, logPath) {
+function launchdUnit(name, args, workDir, logPath, pathEnv) {
     const xml = (value) => value
         .replaceAll("&", "&")
         .replaceAll("<", "&lt;")
@@ -116,14 +121,15 @@ function launchdUnit(name, args, workDir, logPath) {
 <key>Label</key><string>${xml(name)}</string>
 <key>ProgramArguments</key><array>${args.map((arg) => `<string>${xml(arg)}</string>`).join("")}</array>
 <key>WorkingDirectory</key><string>${xml(workDir)}</string>
-<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin")}</string></dict>
+<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(pathEnv)}</string></dict>
+<key>ThrottleInterval</key><integer>60</integer>
 <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
 <key>StandardOutPath</key><string>${xml(logPath)}</string>
 <key>StandardErrorPath</key><string>${xml(logPath)}</string>
 </dict></plist>
 `;
 }
-function systemdUnit(args, workDir, logPath) {
+function systemdUnit(args, workDir, logPath, pathEnv) {
     const quote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("\n", "\\n").replaceAll("\r", "\\r")}"`;
     return `[Unit]
 Description=TalentOS agent gateway
@@ -133,9 +139,10 @@ After=network-online.target
 Type=simple
 ExecStart=${args.map(quote).join(" ")}
 WorkingDirectory=${quote(workDir)}
-Environment=${quote(`PATH=${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}`)}
+Environment=${quote(`PATH=${pathEnv}`)}
 Restart=always
-RestartSec=5
+RestartSec=60
+RestartPreventExitStatus=78
 StandardOutput=${quote(`append:${logPath}`)}
 StandardError=${quote(`append:${logPath}`)}
 

package/dist/commands/agent-serve.js

@@ -1,9 +1,10 @@
-import { spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { childEnvironment, verifyClaudeCode } from "../agent/adapters.js";
+import { verifyClaudeCode, verifyCodex } from "../agent/adapters.js";
 import { serveAgent } from "../agent/serve.js";
 import { agentWorkDir, localAgents } from "../agent-config.js";
+import { installAgentService } from "../agent-service.js";
+import { installSharedGateway } from "../gateway-install.js";
 export async function runAgentServe(parsed) {
     const id = parsed.options.agent;
     const agents = await localAgents();
@@ -14,26 +15,28 @@ export async function runAgentServe(parsed) {
     if (!config) {
         throw new Error("Choose a linked agent with `talentos agent serve --agent <id>`.");
     }
+    try {
+        if (process.platform !== "win32") {
+            await installSharedGateway();
+        }
+        await installAgentService(config, { reload: false });
+    }
+    catch {
+        console.error("Gateway installation unavailable. Serving the loaded version; retry talentos agent repair when the installation is available.");
+    }
     if (config.provider === "claude_code") {
         await verifyClaudeCode();
     }
+    else {
+        await verifyCodex();
+    }
     const stop = new AbortController();
     const abort = () => stop.abort();
     process.once("SIGTERM", abort);
     process.once("SIGINT", abort);
     const version = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
     try {
-        const updated = await serveAgent(config, dirname(agentWorkDir(config.agentId)), version, stop.signal);
-        if (updated && !stop.signal.aborted) {
-            await new Promise((resolve, reject) => {
-                const child = spawn(process.execPath, [updated, "agent", "serve", "--agent", config.agentId], { env: childEnvironment(), stdio: "inherit", signal: stop.signal });
-                child.once("error", () => reject(new Error("Updated gateway could not start.")));
-                child.once("close", (code) => {
-                    process.exitCode = code ?? 1;
-                    resolve();
-                });
-            });
-        }
+        await serveAgent(config, dirname(agentWorkDir(config.agentId)), version, stop.signal);
     }
     finally {
         process.removeListener("SIGTERM", abort);

package/dist/commands/agent.js

@@ -7,9 +7,11 @@ import { AgentHttpError, fetchAgentStatus, inspectProvider, redeemAgent, setupAp
 import { parseAgentLink, redactAgentOutput } from "../agent-link.js";
 import { installAgentService, uninstallAgentService, } from "../agent-service.js";
 import { emit, emitJson, renderTable, warn } from "../format.js";
+import { installSharedGateway } from "../gateway-install.js";
 import { homeDir } from "../install.js";
 import { defaultDeviceName, hashKey, mintKey } from "../login.js";
-export async function runAgent(parsed) {
+const MAX_PREVIOUS_AGENT_IDS = 100;
+export async function runAgent(parsed, dependencies = {}) {
     switch (parsed.action) {
         case "link": {
             if (!(parsed.options.yes || (await approveInstall()))) {
@@ -38,6 +40,29 @@ export async function runAgent(parsed) {
             }
             return await command.runAgentServe(parsed);
         }
+        case "repair": {
+            if (process.platform === "win32") {
+                throw new Error("Windows agents run in the foreground. Use talentos agent serve.");
+            }
+            const agents = await selectAgents(parsed, false, dependencies.home);
+            if (!agents.length) {
+                throw new Error("No linked agent matches. Run talentos agent list.");
+            }
+            await installSharedGateway({
+                home: dependencies.home,
+                source: dependencies.gatewaySource,
+            });
+            for (const agent of agents) {
+                const service = await (dependencies.install ??
+                    ((config) => installAgentService(config, { home: dependencies.home })))(agent);
+                emit(`Repaired ${redactAgentOutput(agent.name)} (${agent.agentId}).${service.started ? "" : " Start talentos agent serve in the foreground."}`);
+            }
+            return;
+        }
+        case "mcp": {
+            await import("../agent/mcp-entry.js");
+            return;
+        }
         case "status":
         case "list":
             return await showAgents(parsed);
@@ -46,7 +71,7 @@ export async function runAgent(parsed) {
         case "logs":
             return await showLogs(parsed);
         default:
-            throw new Error("Use talentos agent link | status | list | unlink | logs.");
+            throw new Error("Use talentos agent link | repair | status | list | unlink | logs.");
     }
 }
 export async function installLinkedAgent(parsed, dependencies = {}) {
@@ -56,12 +81,17 @@ export async function installLinkedAgent(parsed, dependencies = {}) {
     const link = parseAgentLink(parsed.options.url ?? "");
     const home = dependencies.home ?? homeDir();
     const linkHash = hashKey(link.token);
-    let agent = (await localAgents(home)).find((item) => item.linkHash === linkHash && item.provider === link.provider);
+    const savedAgents = await localAgents(home);
+    let agent = savedAgents.find((item) => item.linkHash === linkHash && item.provider === link.provider);
     if (agent) {
         await storeAgent(agent, home);
     }
     else {
         const apiUrl = await setupApiOrigin(link, parsed.options["api-url"] ?? process.env.TALENTOS_API_URL);
+        const candidates = savedAgents
+            .filter((item) => item.provider === link.provider && item.apiUrl === apiUrl)
+            .sort((a, b) => b.linkedAt - a.linkedAt)
+            .slice(0, MAX_PREVIOUS_AGENT_IDS);
         const pendingPath = join(agentsDir(home), `.pending-${linkHash}.json`);
         let apiKey;
         let recovered;
@@ -104,6 +134,7 @@ export async function installLinkedAgent(parsed, dependencies = {}) {
         const identity = recovered ??
             (await redeemAgent(apiUrl, {
                 token: link.token,
+                previousAgentIds: candidates.map((item) => item.agentId),
                 keyHash: hashKey(apiKey),
                 provider: link.provider,
                 providerVersion: (dependencies.probe ?? inspectProvider)(link.provider),
@@ -121,9 +152,22 @@ export async function installLinkedAgent(parsed, dependencies = {}) {
             linkedAt: Date.now(),
         };
         await storeAgent(agent, home);
+        for (const old of candidates) {
+            if (old.agentId !== agent.agentId &&
+                identity.retiredAgentIds?.includes(old.agentId)) {
+                await uninstallAgentService(old, { home });
+                await rm(agentConfigPath(old.agentId, home), { force: true });
+            }
+        }
         await rm(pendingPath, { force: true });
     }
-    const service = await (dependencies.install ?? ((config) => installAgentService(config, { home })))(agent);
+    const service = await (dependencies.install ??
+        (async (config) => {
+            if (process.platform !== "win32") {
+                await installSharedGateway({ home });
+            }
+            return await installAgentService(config, { home });
+        }))(agent);
     return { agent, service };
 }
 async function showAgents(parsed) {
@@ -204,9 +248,9 @@ async function showLogs(parsed) {
         await log.close();
     }
 }
-async function selectAgents(parsed, single = false) {
+async function selectAgents(parsed, single = false, home) {
     const selector = parsed.options.agent ?? parsed.args[0];
-    const agents = (await localAgents()).filter((agent) => !selector || agent.agentId === selector || agent.name === selector);
+    const agents = (await localAgents(home)).filter((agent) => !selector || agent.agentId === selector || agent.name === selector);
     if (single && agents.length > 1) {
         throw new Error("Several agents are linked. Select one by name or --agent <id>.");
     }

package/dist/gateway-install.js

@@ -0,0 +1,343 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { cp, link, mkdir, readdir, readFile, readlink, realpath, rename, rm, stat, symlink, } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { writePrivateFile } from "./agent-config.js";
+import { compareGatewayVersions } from "./gateway-version.js";
+import { homeDir } from "./install.js";
+const exec = promisify(execFile);
+const TRANSIENT_BIN = /(?:\/_npx\/|node_modules\/\.bin|node-gyp-bin|\/Cellar\/|\/\.nvm\/versions\/)/;
+const NPM_ENV = new Set([
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "LANG",
+    "LC_ALL",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "SystemRoot",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "NODE_EXTRA_CA_CERTS",
+]);
+export function gatewayLauncherPath(home = homeDir()) {
+    return join(home, ".talentos", "bin", "talentos-gateway");
+}
+export function servicePathEnv(home = homeDir()) {
+    return [
+        ...new Set([
+            ...(process.env.PATH ?? "")
+                .split(":")
+                .filter((entry) => entry.startsWith("/") && !TRANSIENT_BIN.test(entry)),
+            join(home, ".local/bin"),
+            join(home, ".npm-global/bin"),
+            "/opt/homebrew/bin",
+            "/usr/local/bin",
+            "/usr/bin",
+            "/bin",
+        ]),
+    ].join(":");
+}
+// No user paths are interpolated into executable shell text. The Node hint is data.
+const LAUNCHER = `#!/bin/sh
+set -f
+root="\${0%/*}/.."
+agent=
+next_agent=
+for argument in "$@"; do
+  if [ "$next_agent" = yes ]; then agent=$argument; break; fi
+  if [ "$argument" = --agent ]; then next_agent=yes; fi
+done
+node_missing=
+case "$agent" in
+  ''|*[!a-zA-Z0-9_-]*) ;;
+  *) node_missing="$root/agents/$agent/.node-missing" ;;
+esac
+qualifies() {
+  [ -n "$1" ] && [ -x "$1" ] && "$1" -e 'process.exit(Number(process.versions.node.split(".")[0]) >= 20 ? 0 : 1)' >/dev/null 2>&1
+}
+start() {
+  if [ -n "$node_missing" ]; then /bin/rm -f "$node_missing"; fi
+  node=$1
+  shift
+  PATH="\${node%/*}:\${PATH:-/usr/bin:/bin}"
+  export PATH
+  exec "$node" "$root/cli/current/node_modules/talentos/dist/index.js" "$@"
+}
+node_hint=
+IFS= read -r node_hint < "$root/cli/node-path" || :
+if qualifies "\${TALENTOS_NODE:-}"; then
+  start "$TALENTOS_NODE" "$@"
+fi
+if qualifies "$node_hint"; then
+  start "$node_hint" "$@"
+fi
+old_ifs=$IFS
+IFS=:
+for dir in \${PATH:-}; do
+  IFS=$old_ifs
+  if qualifies "$dir/node"; then
+    start "$dir/node" "$@"
+  fi
+  IFS=:
+done
+IFS=$old_ifs
+for candidate in /opt/homebrew/bin/node /usr/local/bin/node; do
+  if qualifies "$candidate"; then
+    start "$candidate" "$@"
+  fi
+done
+# nvm has no stable system bin; discover surviving installations at startup.
+set +f
+for candidate in "$root"/../.nvm/versions/node/*/bin/node; do
+  if qualifies "$candidate"; then start "$candidate" "$@"; fi
+done
+message='TalentOS gateway requires Node.js 20 or newer. Install Node, then run talentos agent repair.'
+if [ -z "$node_missing" ]; then
+  echo "$message" >&2
+elif (set -C; : > "$node_missing") 2>/dev/null; then
+  echo "$message" >> "$root/agents/$agent/gateway.log"
+fi
+exit 78
+`;
+async function manifestVersion(root) {
+    return JSON.parse(await readFile(join(root, "package.json"), "utf8")).version;
+}
+async function copyPackage(source, destination) {
+    await mkdir(destination, { recursive: true, mode: 0o700 });
+    for (const name of ["package.json", "dist", "node_modules"]) {
+        try {
+            await cp(join(source, name), join(destination, name), {
+                recursive: true,
+                dereference: true,
+                force: true,
+            });
+        }
+        catch (error) {
+            if (name !== "node_modules" ||
+                error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+}
+async function installed(root, version) {
+    try {
+        if ((await manifestVersion(root)) !== version ||
+            !(await readFile(join(root, "dist/index.js"))).length) {
+            return false;
+        }
+        const { dependencies = {} } = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+        // The SDK has no root entrypoint. Load the same exports the CLI uses;
+        // imports also catch missing transitive dependencies in partial installs.
+        const imports = Object.keys(dependencies).flatMap((name) => name === "@modelcontextprotocol/sdk"
+            ? [
+                `${name}/client/index.js`,
+                `${name}/server/index.js`,
+                `${name}/types.js`,
+            ]
+            : [name]);
+        if (imports.length) {
+            await exec(process.execPath, [
+                "--input-type=module",
+                "--eval",
+                `await Promise.all(${JSON.stringify(imports)}.map(name => import(name)))`,
+            ], { cwd: root, timeout: 15_000 });
+        }
+        return true;
+    }
+    catch (error) {
+        if (error.killed) {
+            throw new Error("Gateway dependency check timed out. Keeping the current version; retry agent repair shortly.");
+        }
+        return false;
+    }
+}
+async function installLock(root, signal) {
+    const path = join(root, ".install-lock");
+    const pending = join(root, `.lock-${randomUUID()}`);
+    const contents = `${process.pid}\n${randomUUID()}`;
+    // Publish a populated lock atomically so a second installer never sees an
+    // empty new lock and mistakes it for one left behind by a crash.
+    await writePrivateFile(pending, contents);
+    try {
+        for (let attempt = 0; attempt < 600; attempt++) {
+            signal?.throwIfAborted();
+            try {
+                await link(pending, path);
+                return async () => {
+                    if ((await readFile(path, "utf8").catch(() => "")) === contents) {
+                        await rm(path, { force: true });
+                    }
+                };
+            }
+            catch (error) {
+                if (error.code !== "EEXIST") {
+                    throw error;
+                }
+                try {
+                    const lock = await readFile(path, "utf8");
+                    const metadata = await stat(path);
+                    const age = Date.now() - metadata.mtimeMs;
+                    const pid = Number(lock.split("\n")[0]);
+                    let stale = !lock.trim() || age > 5 * 60_000;
+                    if (!stale && pid > 0) {
+                        try {
+                            process.kill(pid, 0);
+                        }
+                        catch (failure) {
+                            stale = failure.code === "ESRCH";
+                        }
+                    }
+                    if (stale && (await readFile(path, "utf8")) === lock) {
+                        const latest = await stat(path);
+                        if (latest.dev === metadata.dev && latest.ino === metadata.ino) {
+                            await rm(path, { force: true });
+                            continue;
+                        }
+                    }
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT") {
+                        throw error;
+                    }
+                    continue;
+                }
+                await delay(200, undefined, { signal });
+            }
+        }
+        throw new Error("Another gateway installation is still running. Retry agent repair shortly.");
+    }
+    finally {
+        await rm(pending, { force: true });
+    }
+}
+export async function installSharedGateway(options = {}) {
+    const home = options.home ?? homeDir();
+    const source = options.source ?? fileURLToPath(new URL("../", import.meta.url));
+    const ownVersion = await manifestVersion(source);
+    let version = options.version ?? ownVersion;
+    if (compareGatewayVersions(version, version) === undefined) {
+        throw new Error("Unsupported gateway version.");
+    }
+    const root = join(home, ".talentos/cli");
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const release = await installLock(root, options.signal);
+    const temporary = join(root, `.install-${randomUUID()}`);
+    const pointer = join(root, `.current-${randomUUID()}`);
+    let stagedVersion;
+    try {
+        const active = await readlink(join(root, "current")).catch(() => "");
+        if ((compareGatewayVersions(active, version) ?? 0) > 0 &&
+            (await installed(join(root, active, "node_modules/talentos"), active))) {
+            version = active;
+        }
+        const destination = join(root, version);
+        const pkg = join(destination, "node_modules/talentos");
+        if (!(await installed(pkg, version))) {
+            await mkdir(temporary, { mode: 0o700 });
+            // Local builds have not been published. Copy resolved dependencies too,
+            // so pnpm's symlinks cannot strand the installed gateway in a worktree.
+            if (version === ownVersion &&
+                !source.includes("/node_modules/talentos")) {
+                await copyPackage(source, join(temporary, "node_modules/talentos"));
+            }
+            else {
+                const npmEnv = {
+                    PATH: `${process.env.PATH ?? servicePathEnv()}:${dirname(process.execPath)}`,
+                };
+                for (const [key, value] of Object.entries(process.env)) {
+                    if ((NPM_ENV.has(key) || key.toLowerCase().startsWith("npm_config_")) &&
+                        value) {
+                        npmEnv[key] = value;
+                    }
+                }
+                try {
+                    await exec("npm", [
+                        "install",
+                        "--prefix",
+                        temporary,
+                        "--omit=dev",
+                        "--ignore-scripts",
+                        "--no-audit",
+                        "--no-fund",
+                        `talentos@${version}`,
+                    ], { env: npmEnv, signal: options.signal, timeout: 90_000 });
+                }
+                catch {
+                    if (version === ownVersion) {
+                        await rm(temporary, { recursive: true, force: true });
+                        await copyPackage(source, join(temporary, "node_modules/talentos"));
+                    }
+                    else {
+                        throw new Error("Gateway update failed. Serving the current version; retrying when the network is available.");
+                    }
+                }
+            }
+            if (!(await installed(join(temporary, "node_modules/talentos"), version))) {
+                throw new Error("Gateway package is incomplete. Restore its runtime dependencies or retry agent repair online.");
+            }
+            await rm(destination, { recursive: true, force: true });
+            await rename(temporary, destination);
+            if (version !== active) {
+                stagedVersion = destination;
+            }
+        }
+        let previous;
+        try {
+            previous = await readlink(join(root, "current"));
+        }
+        catch {
+            /* First install. */
+        }
+        await symlink(version, pointer);
+        await rename(pointer, join(root, "current"));
+        stagedVersion = undefined;
+        const launcher = gatewayLauncherPath(home);
+        await writePrivateFile(launcher, LAUNCHER, 0o700);
+        let nodePath = options.nodePath ?? process.execPath;
+        for (const stable of [
+            "/opt/homebrew/bin/node",
+            "/usr/local/bin/node",
+            "/usr/bin/node",
+        ]) {
+            if ((await realpath(stable).catch(() => "")) === nodePath) {
+                nodePath = stable;
+                break;
+            }
+        }
+        // Preserve the link-time hint during updates and repairs.
+        const hint = join(root, "node-path");
+        try {
+            await readFile(hint);
+        }
+        catch {
+            await writePrivateFile(hint, `${nodePath}\n`);
+        }
+        const keep = new Set([version, previous]);
+        const oldVersions = (await readdir(root))
+            .filter((entry) => compareGatewayVersions(entry, entry) !== undefined && !keep.has(entry))
+            .sort((a, b) => compareGatewayVersions(b, a) ?? 0);
+        // A repeat repair retains the other installed version.
+        if (previous === version) {
+            oldVersions.shift();
+        }
+        for (const old of oldVersions) {
+            await rm(join(root, old), { recursive: true, force: true });
+        }
+        return launcher;
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+        await rm(pointer, { force: true });
+        if (stagedVersion) {
+            await rm(stagedVersion, { recursive: true, force: true });
+        }
+        await release();
+    }
+}

package/dist/gateway-version.js

@@ -0,0 +1,45 @@
+const VERSION = /^(\d+)\.(\d+)\.(\d+)(?:-([\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*))?(?:\+[\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*)?$/;
+const NUMERIC_IDENTIFIER = /^\d+$/;
+export function compareGatewayVersions(a, b) {
+    const left = VERSION.exec(a), right = VERSION.exec(b);
+    if (!(left && right)) {
+        return;
+    }
+    for (let i = 1; i <= 3; i++) {
+        const difference = Number(left[i]) - Number(right[i]);
+        if (difference) {
+            return difference;
+        }
+    }
+    if (left[4] === right[4]) {
+        return 0;
+    }
+    if (!left[4]) {
+        return 1;
+    }
+    if (!right[4]) {
+        return -1;
+    }
+    const l = left[4].split("."), r = right[4].split(".");
+    for (let i = 0; i < Math.max(l.length, r.length); i++) {
+        const x = l[i], y = r[i];
+        if (x === undefined) {
+            return -1;
+        }
+        if (y === undefined) {
+            return 1;
+        }
+        if (x === y) {
+            continue;
+        }
+        const xn = NUMERIC_IDENTIFIER.test(x), yn = NUMERIC_IDENTIFIER.test(y);
+        if (xn && yn) {
+            return Number(x) - Number(y);
+        }
+        if (xn !== yn) {
+            return xn ? -1 : 1;
+        }
+        return x < y ? -1 : 1;
+    }
+    return 0;
+}

package/dist/index.js

@@ -9,7 +9,7 @@ Usage: talentos <command> [options]
 
 Commands:
   init                                    Connect this machine's agents to TalentOS
-  agent <link|status|list|unlink|logs>      Bring your own agent into Rooms
+  agent <link|repair|status|list|unlink|logs>      Bring your own agent into Rooms
   login                                   Authorize this machine
   logout                                  Forget the key stored on this machine
   whoami                                  Show the member and org this key acts as
@@ -32,6 +32,7 @@ const GROUP_USAGE = {
 talentos agent status | list [--json] [--agent <id>]
 talentos agent unlink [name] [--agent <id>]
 talentos agent logs [--agent <id>]
+talentos agent repair [--agent <id>]
 talentos agent serve --agent <id>
 
 The link command checks the provider's CLI login, mints the key locally, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talentos",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "type": "module",
   "description": "TalentOS CLI: push and pull skills, read and write team memory, and delegate work to your Talent from any coding agent.",
   "repository": {