talentos 1.1.6 → 1.2.0

package/dist/agent/native/workspace.js

@@ -0,0 +1,87 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { rootProblem } from "./config.js";
+import { canonical, isInside } from "./paths.js";
+const exec = promisify(execFile);
+const safeId = (value, length) => value
+    .replace(/[^a-z\d]/giu, "")
+    .slice(0, length)
+    .toLowerCase() || "thread";
+/**
+ * The folder one thread's owner jobs run in. In a repo it is a git worktree the
+ * CLI creates (never the model), so the owner's checkout stays untouched; with
+ * no repo, or one with no commits yet, a plain per-thread folder under the
+ * managed root. Throws when the configured root fails its checks.
+ */
+export async function prepareWorkspace(input) {
+    const { config, home } = input;
+    const problem = rootProblem(config, home);
+    if (problem) {
+        throw new Error(problem);
+    }
+    const thread = safeId(input.threadId, 12);
+    const managed = join(home, "TalentOS", "threads");
+    let cwd;
+    const useWorktree = config.kind === "repo" && (await hasCommit(config.root));
+    if (useWorktree) {
+        const repo = `${safeId(config.root.split("/").pop() ?? "repo", 20)}-${createHash("sha256").update(config.root).digest("hex").slice(0, 8)}`;
+        cwd = join(home, "TalentOS", ".worktrees", repo, thread);
+    }
+    else {
+        cwd = join(config.kind === "managed" ? config.root : managed, thread);
+    }
+    // The folder must resolve inside the TalentOS area or the managed root, and
+    // that is checked BEFORE anything is created, so a planted symlink cannot
+    // make the CLI build a worktree somewhere else.
+    const bases = [join(home, "TalentOS"), config.root].map((base) => canonical(base, home, home));
+    const inside = (path) => bases.some((base) => isInside(canonical(path, home, home), base));
+    if (!inside(cwd)) {
+        throw new Error("The workspace left its folder.");
+    }
+    if (useWorktree) {
+        await ensureWorktree(config.root, cwd, thread);
+    }
+    else {
+        mkdirSync(cwd, { recursive: true, mode: 0o700 });
+    }
+    const real = realpathSync.native(cwd);
+    if (!(statSync(real).isDirectory() && inside(real))) {
+        throw new Error("The workspace left its folder.");
+    }
+    return { cwd: real, writeRoots: [real] };
+}
+async function hasCommit(root) {
+    try {
+        await exec("git", ["rev-parse", "--verify", "HEAD"], {
+            cwd: root,
+            timeout: 5000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureWorktree(root, path, thread) {
+    try {
+        if (statSync(path).isDirectory()) {
+            return;
+        }
+    }
+    catch {
+        // Missing: create it below.
+    }
+    mkdirSync(join(path, ".."), { recursive: true, mode: 0o700 });
+    const branch = `talentos/${thread}`;
+    const options = { cwd: root, timeout: 60_000 };
+    try {
+        await exec("git", ["worktree", "add", "-b", branch, path, "HEAD"], options);
+    }
+    catch {
+        // The branch survives a deleted folder: reattach it.
+        await exec("git", ["worktree", "add", path, branch], options);
+    }
+}

package/dist/agent/serve.js

@@ -4,11 +4,17 @@ import { dirname, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { installSharedGateway } from "../gateway-install.js";
 import { compareGatewayVersions } from "../gateway-version.js";
+import { homeDir } from "../install.js";
 import { runProvider } from "./adapters.js";
 import { AgentGateway, GatewayError } from "./gateway.js";
+import { ApprovalBridge } from "./native/approvals.js";
+import { NativeGate } from "./native/gate.js";
 import { SessionMap } from "./sessions.js";
 const HEARTBEAT_MS = 20_000;
 const LEASE_SAFETY_MS = 55_000;
+// A native job holds a 30 s server lease and is re-derived on every renewal.
+const NATIVE_RENEW_MS = 10_000;
+const NATIVE_SAFETY_MS = 25_000;
 const IDLE_MS = 30 * 60_000;
 export function needsUpdate(current, minimum) {
     if (compareGatewayVersions(minimum, minimum) === undefined) {
@@ -55,12 +61,14 @@ export async function installGatewayUpdate(directory, minimum, signal) {
         signal,
     });
 }
-export async function serveAgent(config, directory, version, stop, verify) {
+export async function serveAgent(config, directory, version, stop, verify, options = {}) {
     const release = await acquireLock(directory);
     try {
         const workDir = join(directory, "work"), sessions = new SessionMap(directory), gateway = new AgentGateway(config);
         await mkdir(workDir, { recursive: true, mode: 0o700 });
         const deviceId = randomUUID();
+        const gate = options.gate ??
+            new NativeGate({ agent: config, directory, home: homeDir() });
         const service = new AbortController();
         const signal = AbortSignal.any([stop, service.signal]);
         let wakeResolve, wakePending = true;
@@ -81,7 +89,8 @@ export async function serveAgent(config, directory, version, stop, verify) {
             }
         };
         const heartbeat = async () => {
-            const response = await gateway.request("/agent-gateway/heartbeat", { cliVersion: version }, signal);
+            gate.refresh();
+            const response = await gateway.request("/agent-gateway/heartbeat", { cliVersion: version, nativeOptIn: gate.reportable() }, signal);
             if (response) {
                 minimum = response.cliMinVersion;
                 if (response.pendingJobs > 0 || needsUpdate(version, minimum)) {
@@ -100,7 +109,9 @@ export async function serveAgent(config, directory, version, stop, verify) {
                             .request(`/agent-gateway/jobs/${leased.job.jobId}/renew`, { leaseToken: leased.job.leaseToken }, signal)
                             .then(() => {
                             if (active === leased) {
-                                leased.deadline = started + LEASE_SAFETY_MS;
+                                leased.deadline =
+                                    started +
+                                        (leased.job.native ? NATIVE_SAFETY_MS : LEASE_SAFETY_MS);
                             }
                         })
                             .catch((error) => {
@@ -114,7 +125,12 @@ export async function serveAgent(config, directory, version, stop, verify) {
                         })
                         : Promise.resolve(),
                 ]);
-                await delay(Math.max(1, HEARTBEAT_MS - (Date.now() - started)), undefined, { signal }).catch(() => {
+                // The owner's local `native off` ends a running owner job at once.
+                if (active?.job.native && active.owner && !gate.optedIn()) {
+                    active.cancel.abort();
+                }
+                await delay(Math.max(1, (active?.job.native ? NATIVE_RENEW_MS : HEARTBEAT_MS) -
+                    (Date.now() - started)), undefined, { signal }).catch(() => {
                     /* Shutdown interrupts the timer. */
                 });
             }
@@ -170,17 +186,67 @@ export async function serveAgent(config, directory, version, stop, verify) {
                 if (job) {
                     lastJobAt = Date.now();
                     const cancel = new AbortController();
-                    active = { job, cancel, deadline: claimStartedAt + LEASE_SAFETY_MS };
+                    const current = {
+                        job,
+                        cancel,
+                        deadline: claimStartedAt +
+                            (job.native ? NATIVE_SAFETY_MS : LEASE_SAFETY_MS),
+                        owner: false,
+                    };
+                    active = current;
                     let lastStatusAt = 0;
+                    // Monotonic, so a wall-clock change cannot corrupt the marks.
+                    const receivedAt = performance.now();
+                    const timings = {};
                     try {
+                        // An owner job runs the owner's real setup only when the plane
+                        // confirmed owner authority just now AND this computer is ready;
+                        // anything less is the room-only profile, as before.
+                        let owner;
+                        if (job.native) {
+                            const post = (statusLine) => gateway
+                                .request(`/agent-gateway/jobs/${job.jobId}/status`, { leaseToken: job.leaseToken, statusLine }, signal)
+                                .catch(failService);
+                            post("Starting on your computer…");
+                            lastStatusAt = Date.now();
+                            const [, prepared] = await Promise.all([
+                                gateway.request(`/agent-gateway/jobs/${job.jobId}/native-confirm`, { leaseToken: job.leaseToken }, signal),
+                                gate.prepare(job.packet.thread.id).catch(() => undefined),
+                            ]);
+                            owner = prepared;
+                            current.owner = Boolean(owner);
+                        }
+                        const sessionKey = owner
+                            ? `${job.packet.thread.id}:owner`
+                            : job.packet.thread.id;
+                        const bridge = () => new ApprovalBridge({
+                            gateway: {
+                                request: async (ask) => (await gateway.request(`/agent-gateway/jobs/${job.jobId}/approval-request`, { leaseToken: job.leaseToken, ...ask }, signal)) ?? { status: "expired" },
+                                status: async (actionKeys) => (await gateway.request(`/agent-gateway/jobs/${job.jobId}/approval-status`, { actionKeys, leaseToken: job.leaseToken }, signal)) ?? [],
+                            },
+                            onWaiting: (waiting) => {
+                                gateway
+                                    .request(`/agent-gateway/jobs/${job.jobId}/status`, {
+                                    leaseToken: job.leaseToken,
+                                    statusLine: waiting
+                                        ? "Waiting for your approval…"
+                                        : "Working on your computer…",
+                                }, signal)
+                                    .catch(failService);
+                            },
+                        }).start();
                         const result = await runProvider({
                             config,
                             job,
                             workDir,
-                            sessionId: await sessions.get(job.packet.thread.id),
+                            owner: owner && { ...owner, watch: bridge },
+                            sessionId: await sessions.get(sessionKey),
                             signal: AbortSignal.any([signal, cancel.signal]),
                             remember: async (sessionId) => {
-                                await sessions.remember(job.packet.thread.id, sessionId);
+                                await sessions.remember(sessionKey, sessionId);
+                            },
+                            mark: (name) => {
+                                timings[`${name}Ms`] = Math.round(performance.now() - receivedAt);
                             },
                             status: (line) => {
                                 if (Date.now() - lastStatusAt < 1000) {
@@ -196,7 +262,7 @@ export async function serveAgent(config, directory, version, stop, verify) {
                         // never become a new provider run or a duplicate final reply.
                         while (!(signal.aborted || cancel.signal.aborted)) {
                             try {
-                                await gateway.request(`/agent-gateway/jobs/${job.jobId}/complete`, { leaseToken: job.leaseToken, text: result.text }, signal);
+                                await gateway.request(`/agent-gateway/jobs/${job.jobId}/complete`, { leaseToken: job.leaseToken, text: result.text, timings }, signal);
                                 break;
                             }
                             catch (error) {

package/dist/args.js

@@ -22,6 +22,7 @@ const CLI_OPTIONS = {
     url: { type: "string" },
     yes: { type: "boolean" },
     agent: { type: "string" },
+    "upload-root": { type: "string" },
 };
 /** Groups whose first positional is a sub-command rather than an argument. */
 const ACTION_GROUPS = new Set(["agent", "mcp", "skills", "memory", "routines"]);

package/dist/commands/agent-native.js

@@ -0,0 +1,64 @@
+import { dirname } from "node:path";
+import { disableNative, enableNative, readNativeConfig, } from "../agent/native/config.js";
+import { NativeGate } from "../agent/native/gate.js";
+import { agentWorkDir, localAgents, } from "../agent-config.js";
+import { emit } from "../format.js";
+import { homeDir } from "../install.js";
+// `talentos agent native enable | off | status` (#10987): the owner's local yes
+// to "let this agent work on this computer when you ask it in a room". The
+// server still needs the owner's own confirmation in TalentOS; this only
+// records consent on this machine and proves the provider can be guarded.
+async function pickAgent(parsed, home) {
+    const agents = await localAgents(home);
+    const selector = parsed.options.agent;
+    let chosen;
+    if (selector) {
+        chosen = agents.find((agent) => agent.agentId === selector || agent.name === selector);
+    }
+    else if (agents.length === 1) {
+        chosen = agents[0];
+    }
+    if (!chosen) {
+        throw new Error("Choose a linked agent with `talentos agent native enable --agent <id>`.");
+    }
+    return chosen;
+}
+const shown = (path, home) => path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
+export async function runAgentNative(parsed, home = homeDir()) {
+    const action = parsed.args[0];
+    if (action !== "enable" && action !== "off" && action !== "status") {
+        throw new Error("Use talentos agent native enable | off | status.");
+    }
+    const agent = await pickAgent(parsed, home);
+    const directory = dirname(agentWorkDir(agent.agentId, home));
+    if (action === "off") {
+        await disableNative(directory);
+        emit(`Turned off. ${agent.name} answers with room tools only, and any run in progress stops within seconds.`);
+        return;
+    }
+    if (action === "status") {
+        const config = await readNativeConfig(directory);
+        emit(config
+            ? `On. ${agent.name} works in ${shown(config.root, home)} when you ask it in a room where you are the only person.`
+            : `Off. Run talentos agent native enable to let ${agent.name} use your full setup in rooms only you are in.`);
+        return;
+    }
+    if (agent.provider !== "claude_code") {
+        throw new Error("Full-setup rooms support Claude Code first. Codex is not available yet.");
+    }
+    const config = await enableNative({
+        agentId: agent.agentId,
+        cwd: process.cwd(),
+        directory,
+        home,
+        name: agent.name,
+    });
+    try {
+        await new NativeGate({ agent, directory, home }).runProbe();
+    }
+    catch (error) {
+        await disableNative(directory);
+        throw error;
+    }
+    emit(`I'll work in ${shown(config.root, home)}${config.kind === "repo" ? " (each room thread gets its own copy of the branch)" : ""}. TalentOS will ask you to confirm once.`);
+}

package/dist/commands/agent.js

@@ -92,6 +92,10 @@ export async function runAgent(parsed, dependencies = {}) {
             await import("../agent/mcp-entry.js");
             return;
         }
+        case "native": {
+            const { runAgentNative } = await import("./agent-native.js");
+            return await runAgentNative(parsed, dependencies.home);
+        }
         case "status":
         case "list":
             return await showAgents(parsed);
@@ -100,7 +104,7 @@ export async function runAgent(parsed, dependencies = {}) {
         case "logs":
             return await showLogs(parsed);
         default:
-            throw new Error("Use talentos agent link | repair | status | list | unlink | logs.");
+            throw new Error("Use talentos agent link | repair | status | list | unlink | logs | native.");
     }
 }
 export async function installLinkedAgent(parsed, dependencies = {}) {

package/dist/mcp-proxy.js

@@ -1,17 +1,58 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { UploadRefusal, uploadFile } from "./upload-file.js";
+// The two server steps behind upload_file. The model sees only upload_file.
+const UPLOAD_STEP_TOOLS = new Set(["prepare_upload", "commit_upload"]);
 /**
  * stdio front end for clients that cannot speak streamable HTTP (Codex, older
  * desktop builds). It forwards tool listing and calls verbatim so the tool set
  * an agent sees over stdio is the one the remote server owns.
  */
-export async function startMcpProxy(client) {
+export async function startMcpProxy(client, 
+// The only folder upload_file reads from: the job's workspace, named by the
+// launcher. Never a tool argument, never this process's own folder; without
+// it upload_file refuses.
+root) {
     const server = new Server({ name: "talentos", version: "1.0.0" }, { capabilities: { tools: {} } });
-    server.setRequestHandler(ListToolsRequestSchema, async () => await client.listTools());
-    server.setRequestHandler(CallToolRequestSchema, async (request) => await client.callTool({
-        name: request.params.name,
-        arguments: request.params.arguments ?? {},
-    }));
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const listed = await client.listTools();
+        return {
+            ...listed,
+            tools: listed.tools.filter((tool) => !UPLOAD_STEP_TOOLS.has(tool.name)),
+        };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const { name, arguments: args = {} } = request.params;
+        if (name === "upload_file") {
+            return await runUpload(client, args, root);
+        }
+        if (UPLOAD_STEP_TOOLS.has(name)) {
+            return {
+                content: [{ text: "Use upload_file instead.", type: "text" }],
+                isError: true,
+            };
+        }
+        return await client.callTool({ name, arguments: args });
+    });
     await server.connect(new StdioServerTransport());
 }
+async function runUpload(client, args, root) {
+    try {
+        const text = await uploadFile(client, {
+            path: String(args.path ?? ""),
+            roomId: String(args.roomId ?? ""),
+            title: typeof args.title === "string" ? args.title : undefined,
+        }, root);
+        return { content: [{ text, type: "text" }] };
+    }
+    catch (error) {
+        const message = error instanceof UploadRefusal || error instanceof Error
+            ? error.message
+            : "The upload failed.";
+        return {
+            content: [{ text: message, type: "text" }],
+            isError: true,
+        };
+    }
+}

package/dist/upload-file.js

@@ -0,0 +1,172 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { Readable } from "node:stream";
+import { canonical, protectedPaths, protectedReason, } from "./agent/native/paths.js";
+// The server caps and re-checks everything (type, size, names, content); this
+// is the client's half of the boundary: only a regular file inside the folder
+// the agent works in, and never a credential store, whatever the model asks.
+export const UPLOAD_BYTES_MAX = 50 * 1024 * 1024;
+const DENIED_SEGMENTS = new Set([
+    ".aws",
+    ".azure",
+    ".docker",
+    ".git",
+    ".git-credentials",
+    ".gnupg",
+    ".kube",
+    ".netrc",
+    ".npmrc",
+    ".pypirc",
+    ".ssh",
+    ".talentos",
+    ".yarnrc",
+    ".yarnrc.yml",
+    // Provider and hook configuration, inside a workspace as well as in $HOME.
+    ".claude",
+    ".codex",
+    ".cursor",
+    ".mcp.json",
+]);
+const DENIED_NAME = /^(?:\.env.*|id_(?:rsa|dsa|ecdsa|ed25519).*|credentials?(?:\..*)?|.*\.(?:pem|key|p12|pfx|jks|keystore)|.*_history|\.bash_profile|\.zshenv)$/iu;
+export class UploadRefusal extends Error {
+}
+function refuse(message) {
+    throw new UploadRefusal(message);
+}
+function deniedSegment(segments) {
+    return segments.find((segment) => DENIED_SEGMENTS.has(segment.toLowerCase()) || DENIED_NAME.test(segment));
+}
+// Opens the file the model named, or refuses. Symlinks are resolved first and
+// the real location must sit inside `root`; the file is then opened without
+// following a final link and the opened descriptor, not the path, is what is
+// measured and read, so a swap between check and read cannot widen access.
+export async function openUploadSource(requested, root, home = homedir()) {
+    if (!root) {
+        refuse("upload_file needs the job's workspace folder, and this job has none. Create the file with create_file instead, or ask the owner to run you in a workspace.");
+    }
+    let rootReal;
+    try {
+        rootReal = await realpath(root);
+    }
+    catch {
+        return refuse("The job's workspace folder is not available.");
+    }
+    const guard = protectedPaths(home);
+    const guarded = (path) => {
+        const reason = protectedReason(path, "read", home, guard);
+        if (reason) {
+            refuse(`That file is in a protected location (${reason}), so it was not uploaded.`);
+        }
+    };
+    const candidate = resolve(rootReal, requested);
+    const lexical = relative(rootReal, candidate).split(sep);
+    guarded(candidate);
+    guarded(canonical(candidate, rootReal, home));
+    const lexicalDenied = deniedSegment(lexical);
+    if (lexicalDenied) {
+        refuse(`${lexicalDenied} is a credential or configuration file, so it was not uploaded.`);
+    }
+    let real;
+    try {
+        real = await realpath(candidate);
+    }
+    catch {
+        return refuse("That file does not exist in your working folder.");
+    }
+    const inside = relative(rootReal, real);
+    if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+        refuse("Only files inside your working folder can be uploaded. Copy the file there first.");
+    }
+    guarded(real);
+    const realDenied = deniedSegment(inside.split(sep));
+    if (realDenied) {
+        refuse(`${realDenied} is a credential or configuration file, so it was not uploaded.`);
+    }
+    let handle;
+    try {
+        // biome-ignore lint/suspicious/noBitwiseOperators: open(2) flags combine by OR.
+        handle = await open(real, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch {
+        return refuse("That file could not be opened.");
+    }
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile()) {
+            refuse("Only regular files can be uploaded, not folders or devices.");
+        }
+        const atPath = await lstat(real);
+        if (atPath.dev !== opened.dev || atPath.ino !== opened.ino) {
+            refuse("The file changed while it was being opened. Try again.");
+        }
+        if (opened.size < 1) {
+            refuse("That file is empty.");
+        }
+        if (opened.size > UPLOAD_BYTES_MAX) {
+            refuse(`Files up to ${UPLOAD_BYTES_MAX / 1024 / 1024} MiB can be uploaded. Make it smaller or split it.`);
+        }
+        const hash = createHash("sha256");
+        for await (const chunk of handle.createReadStream({
+            autoClose: false,
+            start: 0,
+        })) {
+            hash.update(chunk);
+        }
+        const stream = () => handle.createReadStream({ autoClose: false, start: 0 });
+        return {
+            handle,
+            name: basename(candidate),
+            sha256: hash.digest("hex"),
+            size: opened.size,
+            stream,
+        };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+// prepare -> stream the bytes straight to storage -> commit. Nothing about the
+// file's contents passes through the model or an MCP argument.
+export async function uploadFile(client, args, root, fetchImpl = fetch, home = homedir()) {
+    const source = await openUploadSource(args.path, root, home);
+    try {
+        const prepared = await client.call("prepare_upload", {
+            filename: source.name,
+            roomId: args.roomId,
+            sha256: source.sha256,
+            sizeBytes: source.size,
+            ...(args.title ? { title: args.title } : {}),
+        });
+        if (prepared.data.status === "committed" || !prepared.data.uploadUrl) {
+            return prepared.text;
+        }
+        const response = await fetchImpl(prepared.data.uploadUrl, {
+            body: Readable.toWeb(source.stream()),
+            duplex: "half",
+            headers: {
+                "Content-Length": String(source.size),
+                "Content-Type": "application/octet-stream",
+            },
+            method: "POST",
+        });
+        if (!response.ok) {
+            refuse(`The upload failed (${response.status}). Try again.`);
+        }
+        const { storageId } = (await response.json());
+        if (!storageId) {
+            refuse("The upload failed. Try again.");
+        }
+        const committed = await client.call("commit_upload", {
+            sessionId: prepared.data.sessionId,
+            storageId,
+        });
+        return committed.text;
+    }
+    finally {
+        await source.handle.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talentos",
-  "version": "1.1.6",
+  "version": "1.2.0",
   "type": "module",
   "description": "TalentOS CLI: push and pull skills, read and write team memory, and delegate work to your Talent from any coding agent.",
   "repository": {