talentos 1.1.6 → 1.2.0

package/dist/agent/adapters.js

@@ -1,7 +1,7 @@
 import { execFile, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { delimiter, dirname, join } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
@@ -11,6 +11,7 @@ import { gatewayLauncherPath } from "../gateway-install.js";
 import { providerPathEnv, resolveProviderBinary } from "../provider-binary.js";
 import { codexRoomArgs, ROOM_TOOLS } from "./codex-policy.js";
 import { CodexBoundaryError, probeCodexBoundary } from "./codex-probe.js";
+import { prepareOwnerLaunch } from "./native/launch.js";
 const CHILD_ENV = [
     "HOME",
     "PATH",
@@ -190,7 +191,26 @@ export async function runProvider(input) {
     const catalogPath = join(dirname(workDir), ".talentos-codex-models.json");
     const binary = resolveProviderBinary(config.provider, config.providerPath);
     let command, args;
-    if (config.provider === "claude_code") {
+    let ownerLaunch;
+    let stopWatching;
+    if (input.owner && config.provider === "claude_code") {
+        const watching = await input.owner.watch?.();
+        stopWatching = watching?.stop;
+        ownerLaunch = await prepareOwnerLaunch({
+            agentId: config.agentId,
+            askSocket: watching?.socketPath,
+            directory: dirname(workDir),
+            home: input.owner.home,
+            instructions,
+            jobId: job.jobId,
+            prompt,
+            sessionId,
+            workspace: input.owner.workspace,
+        });
+        command = binary;
+        args = ownerLaunch.args;
+    }
+    else if (config.provider === "claude_code") {
         await writePrivateFile(mcpPath, JSON.stringify({
             mcpServers: {
                 talentos: {
@@ -249,11 +269,26 @@ export async function runProvider(input) {
         });
     }
     const child = spawn(command, args, {
-        cwd: workDir,
-        env: childEnvironment(process.env, binary),
+        cwd: input.owner?.workspace.cwd ?? workDir,
+        env: input.owner
+            ? {
+                ...input.owner.env,
+                PATH: [dirname(binary), input.owner.env.PATH]
+                    .filter(Boolean)
+                    .join(delimiter),
+            }
+            : childEnvironment(process.env, binary),
         stdio: ["ignore", "pipe", "ignore"],
         detached: process.platform !== "win32",
     });
+    const marked = new Set();
+    const mark = (name) => {
+        if (!marked.has(name)) {
+            marked.add(name);
+            input.mark?.(name);
+        }
+    };
+    child.once("spawn", () => mark("spawn"));
     let killTimer;
     const stop = () => {
         const pid = child.pid;
@@ -302,6 +337,10 @@ export async function runProvider(input) {
                 continue;
             }
             const event = readProviderEvent(config.provider, value);
+            mark("firstEvent");
+            if (event.status) {
+                mark("firstTool");
+            }
             if (event.failed) {
                 failed = true;
             }
@@ -309,7 +348,8 @@ export async function runProvider(input) {
                 await input.remember(event.sessionId);
             }
             if (event.status) {
-                input.status(event.status);
+                // Room-visible status never names the owner's private tools.
+                input.status(ownerLaunch ? "Working on your computer…" : event.status);
             }
             if (event.text !== undefined) {
                 text = event.text.slice(0, 12_000);
@@ -334,5 +374,7 @@ export async function runProvider(input) {
         }
         await rm(mcpPath, { force: true });
         await rm(catalogPath, { force: true });
+        stopWatching?.();
+        await ownerLaunch?.cleanup();
     }
 }

package/dist/agent/codex-policy.js

@@ -7,6 +7,11 @@ export const ROOM_TOOLS = [
     "suggest_change",
     "create_file",
     "create_deck",
+    "create_web_app",
+    "revise_web_app",
+    "upload_file",
+    "prepare_upload",
+    "commit_upload",
     "post_message",
     "share_link",
     "whoami",

package/dist/agent/mcp-entry.js

@@ -4,8 +4,11 @@ import { AgentClient } from "../client.js";
 import { startMcpProxy } from "../mcp-proxy.js";
 // A local stdio entry avoids putting the bearer key in Codex's argv or child
 // environment. Only the MCP proxy reads the linked-agent credential file.
-const config = (await localAgents()).find((agent) => agent.agentId === parseArgv(process.argv.slice(2)).options.agent);
+const { options } = parseArgv(process.argv.slice(2));
+const config = (await localAgents()).find((agent) => agent.agentId === options.agent);
 if (!config) {
     throw new Error("Linked agent configuration is unavailable.");
 }
-await startMcpProxy(new AgentClient({ apiUrl: config.apiUrl, apiKey: config.apiKey }));
+await startMcpProxy(new AgentClient({ apiUrl: config.apiUrl, apiKey: config.apiKey }), 
+// The launcher names the job's workspace; a job with none uploads nothing.
+options["upload-root"]);

package/dist/agent/native/approvals.js

@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+// The supervisor's half of an ask (#10987 PR 2). The hook (a separate process,
+// inside the provider) connects to this process over a unix socket, sends the
+// ask, and WAITS ON THAT CONNECTION. Nothing is ever read back from a file: an
+// answer exists only as bytes this process writes on the asker's own connection,
+// after the server said so. There is no decision file for the model to forge.
+//
+// The socket lives in a fresh 0700 directory under the system temp folder, never
+// inside any workspace or the job folder. Code that runs as the same user (an
+// approved script) could still impersonate this process; that needs running
+// code, which is itself an owner-approved tier 1 action.
+const ACTION_KEY = /^[0-9a-f]{64}$/u;
+const STATUS_EVERY_MS = 1000;
+const MAX_LINE = 4096;
+const asAnswer = (status) => status === "approved" || status === "denied" || status === "expired"
+    ? status
+    : undefined;
+function parseAsk(line) {
+    try {
+        const value = JSON.parse(line);
+        if (typeof value.actionKey === "string" &&
+            ACTION_KEY.test(value.actionKey) &&
+            typeof value.kind === "string" &&
+            value.kind.length <= 80 &&
+            typeof value.summary === "string" &&
+            value.summary.length <= 200 &&
+            (value.tier === 1 || value.tier === 2)) {
+            return {
+                actionKey: value.actionKey,
+                kind: value.kind,
+                summary: value.summary,
+                tier: value.tier,
+            };
+        }
+    }
+    catch {
+        // Not an ask.
+    }
+    return;
+}
+export class ApprovalBridge {
+    gateway;
+    onWaiting;
+    statusEveryMs;
+    waiters = new Map();
+    waiting = false;
+    polling = false;
+    lastPollAt = 0;
+    constructor(input) {
+        this.gateway = input.gateway;
+        this.onWaiting = input.onWaiting ?? (() => undefined);
+        this.statusEveryMs = input.statusEveryMs ?? STATUS_EVERY_MS;
+    }
+    /** Listens for the hook's asks; `stop` refuses anything still held. */
+    async start() {
+        const directory = mkdtempSync(join(tmpdir(), "tos-"));
+        const socketPath = join(directory, "a.sock");
+        const server = createServer((socket) => this.accept(socket));
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, resolve);
+        });
+        const timer = setInterval(() => {
+            this.poll().catch(() => undefined);
+        }, Math.max(100, Math.min(this.statusEveryMs, 250)));
+        return {
+            socketPath,
+            stop: () => {
+                clearInterval(timer);
+                for (const sockets of this.waiters.values()) {
+                    for (const socket of sockets) {
+                        socket.destroy();
+                    }
+                }
+                this.waiters.clear();
+                this.signal();
+                server.close();
+                rmSync(directory, { force: true, recursive: true });
+            },
+        };
+    }
+    accept(socket) {
+        let buffer = "";
+        socket.setEncoding("utf8");
+        socket.on("error", () => socket.destroy());
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > MAX_LINE) {
+                socket.destroy();
+                return;
+            }
+            const end = buffer.indexOf("\n");
+            if (end < 0) {
+                return;
+            }
+            const ask = parseAsk(buffer.slice(0, end));
+            buffer = "";
+            if (!ask) {
+                socket.destroy();
+                return;
+            }
+            this.forward(ask, socket).catch(() => socket.destroy());
+        });
+        socket.on("close", () => {
+            for (const [key, sockets] of this.waiters) {
+                sockets.delete(socket);
+                if (sockets.size === 0) {
+                    this.waiters.delete(key);
+                }
+            }
+            this.signal();
+        });
+    }
+    async forward(ask, socket) {
+        try {
+            const { status } = await this.gateway.request(ask);
+            const answer = asAnswer(status);
+            if (answer) {
+                this.reply(socket, answer);
+                return;
+            }
+        }
+        catch {
+            // A lost lease ends the ask; an unreachable server also refuses, because a
+            // held call must never outlive the answer it waits for.
+            this.reply(socket, "expired");
+            return;
+        }
+        const sockets = this.waiters.get(ask.actionKey) ?? new Set();
+        sockets.add(socket);
+        this.waiters.set(ask.actionKey, sockets);
+        this.signal();
+    }
+    async poll() {
+        if (this.polling ||
+            this.waiters.size === 0 ||
+            Date.now() - this.lastPollAt < this.statusEveryMs) {
+            return;
+        }
+        this.polling = true;
+        this.lastPollAt = Date.now();
+        try {
+            const keys = [...this.waiters.keys()].slice(0, 10);
+            const answers = new Map((await this.gateway.status(keys)).map((row) => [
+                row.actionKey,
+                row.status,
+            ]));
+            for (const key of keys) {
+                const status = answers.get(key);
+                const answer = status === undefined ? "expired" : asAnswer(status);
+                if (answer) {
+                    for (const socket of this.waiters.get(key) ?? []) {
+                        this.reply(socket, answer);
+                    }
+                    this.waiters.delete(key);
+                }
+            }
+        }
+        catch (error) {
+            const code = error.status;
+            if (code === 409 || code === 404) {
+                for (const sockets of this.waiters.values()) {
+                    for (const socket of sockets) {
+                        this.reply(socket, "expired");
+                    }
+                }
+                this.waiters.clear();
+            }
+        }
+        finally {
+            this.polling = false;
+            this.signal();
+        }
+    }
+    reply(socket, status) {
+        socket.end(`${JSON.stringify({ status })}\n`);
+    }
+    signal() {
+        const waiting = this.waiters.size > 0;
+        if (waiting !== this.waiting) {
+            this.waiting = waiting;
+            this.onWaiting(waiting);
+        }
+    }
+}

package/dist/agent/native/config.js

@@ -0,0 +1,118 @@
+import { execFile } from "node:child_process";
+import { mkdirSync, realpathSync, statSync } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { isMissing, writePrivateFile } from "../../agent-config.js";
+import { isInside, reachesProtected } from "./paths.js";
+const exec = promisify(execFile);
+export const NATIVE_FILE = "native.json";
+export async function readNativeConfig(directory) {
+    try {
+        const value = JSON.parse(await readFile(join(directory, NATIVE_FILE), "utf8"));
+        if (typeof value.root === "string" &&
+            (value.kind === "repo" || value.kind === "managed") &&
+            typeof value.optInAt === "number" &&
+            typeof value.dev === "number" &&
+            typeof value.ino === "number") {
+            return value;
+        }
+        return;
+    }
+    catch (error) {
+        if (isMissing(error) || error instanceof SyntaxError) {
+            return;
+        }
+        throw error;
+    }
+}
+export async function disableNative(directory) {
+    await rm(join(directory, NATIVE_FILE), { force: true });
+}
+/** [a-z0-9-] only: a display name never forms a path. */
+export function folderSlug(name, agentId) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z\d]+/gu, "-")
+        .replace(/^-+|-+$/gu, "")
+        .slice(0, 24);
+    return `${slug || "agent"}-${agentId
+        .replace(/[^a-z\d]/giu, "")
+        .slice(0, 8)
+        .toLowerCase()}`;
+}
+async function repoRoot(cwd) {
+    try {
+        const { stdout } = await exec("git", ["rev-parse", "--show-toplevel"], {
+            cwd,
+            timeout: 5000,
+        });
+        return stdout.trim() || undefined;
+    }
+    catch {
+        return;
+    }
+}
+/**
+ * Why a root may not serve as the agent's workspace, or undefined. Checked at
+ * enable time and again before every owner job: the folder must still be the
+ * same directory (device + inode), owned by this user, and neither the home
+ * folder nor anything that contains credentials.
+ */
+export function rootProblem(config, home) {
+    try {
+        const real = realpathSync.native(config.root);
+        const stats = statSync(real);
+        const homeReal = realpathSync.native(home);
+        if (!stats.isDirectory()) {
+            return "The workspace is not a folder.";
+        }
+        if (stats.dev !== config.dev || stats.ino !== config.ino) {
+            return "The workspace folder changed since it was set up.";
+        }
+        if (process.getuid && stats.uid !== process.getuid()) {
+            return "The workspace folder is not yours.";
+        }
+        if (real === "/" ||
+            real === homeReal ||
+            isInside(homeReal, real) ||
+            reachesProtected(real, home)) {
+            return "The workspace folder is too broad.";
+        }
+        return;
+    }
+    catch {
+        return "The workspace folder is missing.";
+    }
+}
+/**
+ * Records the owner's yes. The workspace is automatic: the repo the command
+ * runs in, otherwise ~/TalentOS/<name>-<id>/ (created here, empty).
+ */
+export async function enableNative(input) {
+    let root = await repoRoot(input.cwd);
+    let kind = "repo";
+    if (root) {
+        root = realpathSync.native(root);
+    }
+    else {
+        kind = "managed";
+        root = join(input.home, "TalentOS", folderSlug(input.name, input.agentId));
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        root = realpathSync.native(root);
+    }
+    const stats = statSync(root);
+    const config = {
+        dev: stats.dev,
+        ino: stats.ino,
+        kind,
+        optInAt: input.now ?? Date.now(),
+        root,
+    };
+    const problem = rootProblem(config, input.home);
+    if (problem) {
+        throw new Error(`${problem} Run this from a project folder, or from a normal folder to use ~/TalentOS.`);
+    }
+    await writePrivateFile(join(input.directory, NATIVE_FILE), `${JSON.stringify(config)}\n`);
+    return config;
+}

package/dist/agent/native/disqualify.js

@@ -0,0 +1,46 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+// R4 (R12): the hook is the only thing between a steered model and the owner's
+// tools, so every owner job checks the owner's own settings for anything that
+// would switch it off. Cheap file reads, run per job (the behavioural probe is
+// cached; this is not).
+const MANAGED = [
+    "/Library/Application Support/ClaudeCode/managed-settings.json",
+    "/etc/claude-code/managed-settings.json",
+];
+function readSettings(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return value && typeof value === "object" && !Array.isArray(value)
+            ? value
+            : "bad";
+    }
+    catch (error) {
+        return error.code === "ENOENT"
+            ? undefined
+            : "bad";
+    }
+}
+/** Why the owner's setup cannot run an owner job safely, or undefined. */
+export function claudeDisqualifier(input) {
+    const files = [
+        ...MANAGED,
+        join(input.configDir, "settings.json"),
+        join(input.configDir, "settings.local.json"),
+        ...input.projectRoots.flatMap((root) => [
+            join(root, ".claude", "settings.json"),
+            join(root, ".claude", "settings.local.json"),
+        ]),
+    ];
+    for (const file of files) {
+        const settings = readSettings(file);
+        if (settings === "bad") {
+            return "A Claude Code settings file could not be read, so the room safety hook cannot be confirmed.";
+        }
+        if (settings?.disableAllHooks === true ||
+            settings?.allowManagedHooksOnly === true) {
+            return "Your Claude Code settings turn hooks off, which the room safety check needs.";
+        }
+    }
+    return;
+}

package/dist/agent/native/env.js

@@ -0,0 +1,29 @@
+import { execFile } from "node:child_process";
+const MARK = "@@talentos-env@@";
+// TalentOS and its deployment credentials never reach the model's environment,
+// and a parent Claude Code session's markers must not make the child behave
+// as if it were nested.
+const DROP = /^(TALENTOS_|CONVEX_|CLAUDECODE$|CLAUDE_CODE_ENTRYPOINT$|CLAUDE_CODE_SSE_PORT$)/u;
+export function scrubEnv(env) {
+    return Object.fromEntries(Object.entries(env).filter(([key, value]) => value !== undefined && !DROP.test(key)));
+}
+/**
+ * The owner's login-shell environment (PATH for nvm/uvx/npx, tokens their own
+ * MCP servers expect), captured once. A launchd service starts with almost
+ * nothing, which would break the very setup the owner wants to bring. Falls
+ * back to the service environment when the shell cannot be read.
+ */
+export async function loginShellEnv(base = process.env, shell = base.SHELL || "/bin/zsh") {
+    const script = `printf %s ${MARK}; "${process.execPath}" -e 'process.stdout.write(JSON.stringify(process.env))'; printf %s ${MARK}`;
+    const stdout = await new Promise((resolve) => {
+        execFile(shell, ["-ilc", script], { env: base, maxBuffer: 2_000_000, timeout: 8000 }, (error, out) => resolve(error ? "" : String(out)));
+    });
+    const parts = stdout.split(MARK);
+    try {
+        const parsed = JSON.parse(parts[1] ?? "");
+        return scrubEnv({ ...base, ...parsed });
+    }
+    catch {
+        return scrubEnv(base);
+    }
+}

package/dist/agent/native/gate.js

@@ -0,0 +1,102 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { providerPathEnv, resolveProviderBinary, } from "../../provider-binary.js";
+import { NATIVE_FILE, readNativeConfig } from "./config.js";
+import { claudeDisqualifier } from "./disqualify.js";
+import { loginShellEnv } from "./env.js";
+import { ensureOwnerNativeProbe } from "./probe.js";
+import { prepareWorkspace } from "./workspace.js";
+const WHITESPACE = /\s+/u;
+const exec = promisify(execFile);
+const ENV_TTL_MS = 10 * 60_000;
+const RETRY_MS = 10 * 60_000;
+/**
+ * Everything the owner-native profile needs on this computer, decided here and
+ * nowhere else: the owner's local yes, a passing cached probe, settings that
+ * leave the hook on, a workspace that still checks out. Any miss means the job
+ * runs room-only exactly as before. The probe runs once per provider change, in
+ * the background, never per job.
+ */
+export class NativeGate {
+    probe = "none";
+    retryAt = 0;
+    env;
+    agent;
+    directory;
+    home;
+    constructor(input) {
+        this.agent = input.agent;
+        this.directory = input.directory;
+        this.home = input.home;
+    }
+    /** The owner's yes exists on this computer (a file, so `native off` is instant). */
+    optedIn() {
+        return existsSync(join(this.directory, NATIVE_FILE));
+    }
+    /** Whether to tell the plane this computer is ready (heartbeat). */
+    reportable() {
+        return this.probe === "ok" && this.optedIn();
+    }
+    /** Starts the cached probe when the owner has opted in. Safe to call every beat. */
+    refresh() {
+        if (this.agent.provider !== "claude_code" ||
+            process.platform === "win32" ||
+            !this.optedIn() ||
+            this.probe === "pending" ||
+            this.probe === "ok" ||
+            (this.probe === "failed" && Date.now() < this.retryAt)) {
+            if (!this.optedIn()) {
+                this.probe = "none";
+            }
+            return;
+        }
+        this.probe = "pending";
+        this.runProbe().then(() => {
+            this.probe = "ok";
+        }, () => {
+            this.probe = "failed";
+            // A failing provider is not re-probed on every heartbeat.
+            this.retryAt = Date.now() + RETRY_MS;
+        });
+    }
+    async runProbe() {
+        const binary = resolveProviderBinary("claude_code", this.agent.providerPath);
+        const { stdout } = await exec(binary, ["--version"], {
+            env: { ...process.env, PATH: providerPathEnv(binary, this.home) },
+            timeout: 5000,
+        });
+        await ensureOwnerNativeProbe({
+            binary,
+            cachePath: join(this.directory, "native-probe.json"),
+            version: stdout.trim().split(WHITESPACE)[0] ?? "unknown",
+        });
+    }
+    /** The login-shell env, captured once and refreshed after ten minutes. */
+    loginEnv() {
+        if (!this.env || Date.now() - this.env.at > ENV_TTL_MS) {
+            this.env = { at: Date.now(), value: loginShellEnv() };
+        }
+        return this.env.value;
+    }
+    /** Per owner job (R4): returns the launch inputs, or undefined to run room-only. */
+    async prepare(threadId) {
+        this.refresh();
+        const config = await readNativeConfig(this.directory);
+        if (!config || this.probe !== "ok") {
+            return;
+        }
+        const env = await this.loginEnv();
+        const configDir = env.CLAUDE_CONFIG_DIR || join(this.home, ".claude");
+        if (claudeDisqualifier({ configDir, projectRoots: [config.root] })) {
+            return;
+        }
+        const workspace = await prepareWorkspace({
+            config,
+            home: this.home,
+            threadId,
+        });
+        return { env, home: this.home, workspace };
+    }
+}