ticlawk 0.1.16-dev.14 → 0.1.16-dev.16

package/src/adapters/ticlawk/index.mjs

@@ -10,13 +10,15 @@ import { isTerminalRuntimeFailure } from '../../core/runtime-support.mjs';
 import { clearUpdateRequiredState, readUpdateState, setUpdateRequiredState } from '../../core/update-state.mjs';
 import { isManagedInstall, startDetachedSelfUpdate } from '../../core/update.mjs';
 import * as api from './api.mjs';
-import { persistApiCredential } from './credentials.mjs';
+import { persistApiCredential, persistRuntimeCredentials } from './credentials.mjs';
 import { TiclawkWakeClient } from './wake-client.mjs';
+import { buildInboundWakePrompt } from '../../runtimes/_shared/wake-prompt.mjs';
 
 const require = createRequire(import.meta.url);
 const qrcode = require('qrcode-terminal');
 const JOBS_WAKE_DEBOUNCE_MS = 100;
 const BINDINGS_WAKE_DEBOUNCE_MS = 500;
+const CREDENTIALS_WAKE_DEBOUNCE_MS = 500;
 const RECOVERY_AUDIT_INTERVAL_MS = 5 * 60 * 1000;
 const BINDING_AUDIT_INTERVAL_MS = 5 * 60 * 1000;
 const UPDATE_RETRY_COOLDOWN_MS = 15 * 60 * 1000;
@@ -69,145 +71,6 @@ function normalizeInboundMediaAssets(msg) {
     .filter(Boolean);
 }
 
-function buildEnvelopeTarget(msg) {
-  const convType = msg.conversation_type || 'dm';
-  const conversationId = msg.conversation_id || '';
-  const senderHandle = msg.sender_display_name || msg.sender_user_id || msg.sender_agent_id || '';
-  if (convType === 'dm') {
-    return senderHandle ? `dm:@${senderHandle}` : `dm:${conversationId}`;
-  }
-  if (convType === 'thread') {
-    const groupName = msg.conversation_name || conversationId;
-    const threadRoot = msg.thread_root_message_id || msg.message_id || '';
-    return `#${groupName}:${threadRoot}`;
-  }
-  // group
-  const groupName = msg.conversation_name || conversationId;
-  return `#${groupName}`;
-}
-
-function buildTaskSuffix(msg) {
-  if (msg.task_number == null) return '';
-  const status = msg.task_status || 'todo';
-  const parts = [`task #${msg.task_number} status=${status}`];
-  if (msg.task_assignee_agent_id || msg.task_assignee_user_id) {
-    const t = msg.task_assignee_type || 'agent';
-    const id = msg.task_assignee_agent_id || msg.task_assignee_user_id;
-    parts.push(`assignee=${t}:${id}`);
-  }
-  if (msg.task_title) {
-    parts.push(`title=${JSON.stringify(msg.task_title)}`);
-  }
-  return ` [${parts.join(' ')}]`;
-}
-
-function buildReactionsSuffix(msg) {
-  const entries = Array.isArray(msg.reactions_summary) ? msg.reactions_summary : [];
-  if (entries.length === 0) return '';
-  return ` [reactions: ${entries.join('; ')}]`;
-}
-
-function buildEnvelopeHeader(msg) {
-  const target = buildEnvelopeTarget(msg);
-  const msgId = msg.id || msg.message_id || '';
-  const seq = msg.seq != null ? msg.seq : '';
-  const time = msg.created_at || new Date().toISOString();
-  const type = msg.sender_type || 'human';
-  const sender = msg.sender_display_name || msg.sender_user_id || msg.sender_agent_id || 'unknown';
-  // `reason` tells the agent how this delivery was routed: 'mention'
-  // / 'assignment' = you were directly addressed → respond by default;
-  // 'ambient' = you are in the room and saw it → respond only if
-  // clearly the right responder; 'dm' / 'thread_follow' / 'manual' =
-  // the legacy direct paths. The agent's behaviour split is in the
-  // standing prompt; we just surface the field.
-  const reason = msg.reason ? ` reason=${msg.reason}` : '';
-  return `[target=${target} msg=${msgId} seq=${seq} time=${time} type=${type}${reason}] @${sender}:`;
-}
-
-function buildGroupContextBlock(msg) {
-  // Only useful in groups — DMs don't need group-purpose context.
-  if ((msg.conversation_type || 'dm') !== 'group') return '';
-  const lines = [];
-  const name = msg.conversation_name || msg.conversation_display_name || '';
-  if (name) lines.push(`name: ${name}`);
-  const description = (msg.conversation_description || '').trim();
-  if (description) lines.push(`purpose: ${description}`);
-  if (lines.length === 0) return '';
-  return [
-    'Group context:',
-    ...lines.map((l) => `  ${l}`),
-    'Use `ticlawk group members --target <target>` if you need to see who else is here.',
-  ].join('\n');
-}
-
-// Charter is the workstream's CoS-authored markdown spec. It's a stable
-// prefix-cacheable block — same bytes across every turn in the same
-// conversation — so it sits above the per-turn envelope.
-function buildCharterBlock(msg) {
-  const charter = (msg.conversation_charter || '').trim();
-  if (!charter) return '';
-  return ['[charter]', charter, '[/charter]'].join('\n');
-}
-
-// CoS-only addendum. Splice above the per-turn envelope (after charter,
-// before group context) when the recipient is the user's CoS.
-// Same bytes every turn → still prefix-cache-friendly.
-const COS_ADDENDUM = [
-  '[cos-role]',
-  'You are the user\'s Chief of Staff (CoS). You answer to the user. In every workstream:',
-  '',
-  '1. Push — break goals into agent-executable tasks, supervise progress, do not let work stall in place.',
-  '2. Simplify — agents should work simply and reliably. Stop over-engineering, junk-code piles, and detours.',
-  '3. Track — keep an entry per workstream in MEMORY.md; update it whenever state changes.',
-  '4. Represent — bundle resource / decision / approval requests and bring them to the user; do not flood the user with raw asks.',
-  '',
-  'Wake-on-event: every turn (including ambient delivery) you must read the message, update MEMORY.md if anything changed, and only reply when you need to intervene. Otherwise stop silently.',
-  '',
-  'Posture: bring a proposal, default to acting on it, change course if the user objects. "I propose A — reasons 1/2/3. Unless you redirect within 24h, I\'ll proceed with A." Not "should we do A or B?"',
-  '',
-  'Owner model: hold the user\'s preferences and constraints across workstreams. Apply them consistently. Do not "for-your-own-good" around stated preferences.',
-  '',
-  'Briefing posture: publish briefings via `ticlawk briefing publish` — this is a SEPARATE surface from chat. Two content formats: `--text "<≤100 chars>"` for short pings, or `--html <path/to/file.html>` for rich one-page bodies. Briefings do NOT appear in the chat stream — they only render in Office → Briefings as full-screen cards owner steps through. Do not over-spam — one per meaningful state change. When the owner taps "comment" on a briefing, the inbound reply message carries metadata.context_ref = { kind: "briefing", briefing_id }; thread the conversation from there.',
-  '',
-  'Dashboard posture: maintain a per-workstream dashboard via `ticlawk dashboard set --target "#<ws>"` (stdin JSON: { data_json, html_template }). data_json holds the live numbers; html_template is the hand-written rendering. CoS replaces wholesale — there is no partial update protocol, and there is no schema lock-in on data_json. Use the dashboard for at-a-glance state; use Briefings for narrative. When the owner replies to a dashboard via the Office "聊一下" path, the inbound message carries metadata.context_ref pointing at the workstream; thread the conversation from there.',
-  '',
-  'Cadence: schedule your own daily morning briefing via `ticlawk reminder schedule --title "morning briefing" --in-minutes 1440 --anchor-conversation-id <your DM with owner>` after you handle this turn. The reminder fires by waking you with a system message; treat that wake as the trigger to compile the day\'s briefings across workstreams. Re-schedule on each fire so the cadence persists. Skip a day only if you are explicitly told to.',
-  '[/cos-role]',
-].join('\n');
-
-function buildCosAddendum(msg) {
-  if (!msg.recipient_is_cos) return '';
-  return COS_ADDENDUM;
-}
-
-// Wrap each per-turn message with an explicit reply instruction so the
-// runtime LLM never has to remember the standing prompt to figure out
-// HOW to reply. Codex in particular treats the developerInstructions as
-// background and ignores the chat-send pattern without this per-turn
-// nudge.
-function buildWakePromptText({ envelopeHeader, target, rawText, groupContext, charterBlock, cosAddendum }) {
-  const body = `${envelopeHeader} ${rawText || ''}`.trim();
-  const lines = [];
-  if (charterBlock) {
-    lines.push(charterBlock, '');
-  }
-  if (cosAddendum) {
-    lines.push(cosAddendum, '');
-  }
-  lines.push('New message received:', '', body);
-  if (groupContext) {
-    lines.push('', groupContext);
-  }
-  lines.push(
-    '',
-    `Respond as appropriate — reply using \`ticlawk message send --target "${target}"\` (body via stdin / heredoc), or take action as needed. Complete ALL your work before stopping.`,
-    'Reply in the channel or create/reply in a thread as appropriate; use each message\'s `target` and `msg` fields to choose the exact target.',
-    '',
-    'IMPORTANT: If the message requires multi-step work (research, code changes, testing), complete ALL steps before stopping. Sending a progress update does NOT mean your task is done — only stop when you have NO more work to do. The daemon will wake you again automatically when new messages arrive.',
-  );
-  return lines.join('\n');
-}
-
 export function normalizeInboundMessage(msg) {
   // Claimed delivery rows carry the recipient agent id; legacy messages
   // (history sync, manual inserts) may still use plain agent_id. Prefer
@@ -216,23 +79,8 @@ export function normalizeInboundMessage(msg) {
   const messageId = msg.id || msg.message_id || null;
   const deliveryId = msg.delivery_id || null;
   const media = normalizeInboundMediaAssets(msg);
-  const rawText = msg.text || '';
   const enriched = { ...msg, id: messageId };
-  const baseHeader = buildEnvelopeHeader(enriched);
-  // Task + reactions suffixes are appended INSIDE the envelope so an
-  // agent can see at a glance whether a message is already claimed and
-  // who has already acknowledged it: `[task #N status=… assignee=…]` +
-  // `[reactions: …]`.
-  const taskSuffix = buildTaskSuffix(enriched);
-  const reactionsSuffix = buildReactionsSuffix(enriched);
-  const header = baseHeader + taskSuffix + reactionsSuffix;
-  const target = buildEnvelopeTarget(enriched);
-  const groupContext = buildGroupContextBlock(enriched);
-  const charterBlock = buildCharterBlock(enriched);
-  const cosAddendum = buildCosAddendum(enriched);
-  const text = header
-    ? buildWakePromptText({ envelopeHeader: header, target, rawText, groupContext, charterBlock, cosAddendum })
-    : rawText;
+  const wakePrompt = buildInboundWakePrompt(enriched);
   return {
     bindingId: recipientAgentId,
     messageId,
@@ -240,10 +88,10 @@ export function normalizeInboundMessage(msg) {
     conversationId: msg.conversation_id || null,
     seq: msg.seq != null ? Number(msg.seq) : null,
     senderType: msg.sender_type || 'human',
-    envelopeHeader: header,
-    envelopeTarget: target,
-    text,
-    rawText,
+    envelopeHeader: wakePrompt.header,
+    envelopeTarget: wakePrompt.target,
+    text: wakePrompt.text,
+    rawText: wakePrompt.rawText,
     action: msg.action || (media.length > 0 ? 'image' : 'task'),
     media,
     raw: {
@@ -292,6 +140,7 @@ const RUNTIME_META_KEYS = [
   'runtimePath',
   'rotatePending',
   'lastRotatedAt',
+  'conversationSessions',
   // claude_code
   'claudePath',
   'claudeVersion',
@@ -408,6 +257,31 @@ function getRuntimeWorkdir(runtimeMeta = {}) {
   return String(runtimeMeta.workdir || runtimeMeta.cwd || runtimeMeta.projectDir || '').trim();
 }
 
+function compareStrings(a, b) {
+  const av = String(a || '');
+  const bv = String(b || '');
+  if (av < bv) return -1;
+  if (av > bv) return 1;
+  return 0;
+}
+
+function compareNumbers(a, b) {
+  const av = Number(a);
+  const bv = Number(b);
+  const aFinite = Number.isFinite(av);
+  const bFinite = Number.isFinite(bv);
+  if (aFinite && bFinite && av !== bv) return av - bv;
+  if (aFinite !== bFinite) return aFinite ? -1 : 1;
+  return 0;
+}
+
+function compareClaimedDeliveries(a, b) {
+  return compareStrings(a?.created_at, b?.created_at)
+    || compareStrings(a?.conversation_id, b?.conversation_id)
+    || compareNumbers(a?.seq, b?.seq)
+    || compareStrings(a?.delivery_id, b?.delivery_id);
+}
+
 function runtimeLabel(runtime) {
   if (runtime === 'claude_code') return 'Claude Code';
   if (runtime === 'opencode') return 'OpenCode';
@@ -521,8 +395,10 @@ export function createTiclawkAdapter(ctx) {
   let bindingAuditTimer = null;
   let jobsWakeTimer = null;
   let bindingsWakeTimer = null;
+  let credentialsWakeTimer = null;
   let lastJobsWakeAt = 0;
   let lastBindingsWakeAt = 0;
+  let lastCredentialsWakeAt = 0;
   let updateRequired = null;
   let lastUpdateRequiredLogAt = 0;
 
@@ -698,7 +574,7 @@ export function createTiclawkAdapter(ctx) {
 
         const binding = await ctx.persistBinding(buildBindingFromSource(msg));
         if (!binding?.runtime) {
-          throw new Error('claimed message missing runtime binding');
+          throw new Error('claimed delivery missing runtime binding');
         }
         if (!belongsToRuntimeHost(binding, hostId)) {
           await api.releaseDelivery(deliveryId, hostId, 'binding-host-mismatch');
@@ -839,6 +715,33 @@ export function createTiclawkAdapter(ctx) {
     return hydrated;
   }
 
+  const syncCredentials = coalesce(async (reason = 'manual') => {
+    const startedAt = Date.now();
+    try {
+      const payload = await api.fetchCredentials();
+      const credentials = Array.isArray(payload?.credentials) ? payload.credentials : [];
+      const result = persistRuntimeCredentials(credentials);
+      debugLog('ticlawk-credentials', 'sync-ok', {
+        reason,
+        saved: result.saved,
+        removed: result.removed,
+        durationMs: Date.now() - startedAt,
+        wakeToSyncMs: String(reason || '').startsWith('wake') && lastCredentialsWakeAt
+          ? Date.now() - lastCredentialsWakeAt
+          : null,
+      });
+    } catch (err) {
+      if (api.isUpdateRequiredError(err)) {
+        recordUpdateRequired(err, 'credentials.sync');
+      }
+      debugError('ticlawk-credentials', 'sync-failed', {
+        reason,
+        durationMs: Date.now() - startedAt,
+        error: err?.message || 'unknown error',
+      });
+    }
+  });
+
   async function releaseBlockedRows(agentId, messages, reason) {
     for (const msg of messages) {
       if (!msg?.delivery_id) continue;
@@ -887,7 +790,8 @@ export function createTiclawkAdapter(ctx) {
       return { failed: true, claimed: 0, launched: 0 };
     }
 
-    const claimed = Array.isArray(data) ? data.length : 0;
+    const orderedData = Array.isArray(data) ? [...data].sort(compareClaimedDeliveries) : [];
+    const claimed = orderedData.length;
     debugLog('ticlawk', 'claim.result', {
       reason,
       hostId,
@@ -906,12 +810,12 @@ export function createTiclawkAdapter(ctx) {
       });
     }
 
-    if (!Array.isArray(data) || data.length === 0) {
+    if (orderedData.length === 0) {
       return { failed: false, claimed: 0, launched: 0 };
     }
 
     const grouped = new Map();
-    for (const msg of data) {
+    for (const msg of orderedData) {
       const agentId = getAgentIdFromPayload(msg);
       if (!agentId) {
         // Claim rows must carry the recipient agent id; a missing value
@@ -950,7 +854,7 @@ export function createTiclawkAdapter(ctx) {
       launched += messages.length;
     }
 
-    return { failed: false, claimed: data.length, launched };
+    return { failed: false, claimed: orderedData.length, launched };
   }
 
   async function runDrain(reason) {
@@ -989,6 +893,15 @@ export function createTiclawkAdapter(ctx) {
     bindingsWakeTimer.unref?.();
   }
 
+  function scheduleCredentialSync(reason) {
+    credentialsWakeTimer = clearDebounce(credentialsWakeTimer);
+    credentialsWakeTimer = setTimeout(() => {
+      credentialsWakeTimer = null;
+      void syncCredentials(reason);
+    }, CREDENTIALS_WAKE_DEBOUNCE_MS);
+    credentialsWakeTimer.unref?.();
+  }
+
   async function reportHostCapabilitiesNow() {
     const entries = await Promise.all(Object.entries(ctx.runtimes || {})
       .filter(([, runtime]) => typeof runtime?.health === 'function')
@@ -1028,6 +941,7 @@ export function createTiclawkAdapter(ctx) {
       void refreshBindings('wake.hello')
         .then(() => requestDrain('wake.hello'))
         .catch(() => {});
+      void syncCredentials('wake.hello');
       void reportHostCapabilitiesNow();
       return;
     }
@@ -1049,6 +963,17 @@ export function createTiclawkAdapter(ctx) {
       scheduleRefreshAndDrain('wake.bindings.changed');
       return;
     }
+    if (event?.type === 'credentials.changed') {
+      lastCredentialsWakeAt = Date.now();
+      debugLog('ticlawk-wake', 'credentials.changed', {
+        credentialId: event.credential_id || null,
+        name: event.name || null,
+        status: event.status || null,
+        reason: event.reason || null,
+      });
+      scheduleCredentialSync('wake.credentials.changed');
+      return;
+    }
     if (event?.type === 'auth.revoked') {
       wakeState.lastError = 'auth revoked';
       debugError('ticlawk-wake', 'auth.revoked', {});
@@ -1248,6 +1173,7 @@ export function createTiclawkAdapter(ctx) {
       // was dropped in X1; no cron has replaced it. Rare in practice;
       // when it happens the fix is a one-row UPDATE in supabase.
       await refreshBindings('startup');
+      await syncCredentials('startup');
       await requestDrain('startup');
       connectWakeSocket();
       startAuditTimers();

package/src/adapters/ticlawk/wake-client.mjs

@@ -165,7 +165,7 @@ export class TiclawkWakeClient {
       return;
     }
 
-    if (type === 'jobs.available' || type === 'bindings.changed') {
+    if (type === 'jobs.available' || type === 'bindings.changed' || type === 'credentials.changed') {
       this.onEvent?.(msg);
       return;
     }