totemlayer 0.1.21 → 0.1.25

package/bin/connected-agent-service.mjs

@@ -1,91 +1,132 @@
 import { setTimeout as sleep } from "node:timers/promises";
 import { runMissionAgentService } from "./mission-agent-service.mjs";
 import { runRuntime } from "./network-runtime.mjs";
+import { acquireMissionAgentSession } from "./mission-agent-session.mjs";
 
 // Both queues use the same verified identity and private profile. A stopped or
 // revoked connection cancels both consumers; Missions retains its own leases.
 export async function runConnectedAgentService(settings, dependencies = {}) {
-  const controller = new AbortController();
-  const signal = settings.signal
-    ? AbortSignal.any([settings.signal, controller.signal])
-    : controller.signal;
-  const emit = settings.emit ?? (() => {});
-  const phases = { messages: "starting", missions: settings.codexThreadId ? "waiting" : "starting" };
-  const blockers = {};
-  const report = (queue, event) => {
-    phases[queue] = event.type === "completed" ? "waiting" : event.type;
-    if (event.type === "blocked") blockers[queue] = { code: event.code, messageId: event.messageId };
-    else delete blockers[queue];
-    const values = Object.values(phases);
-    const type =
-      ["reconnecting", "starting", "blocked", "working"].find((phase) => values.includes(phase)) ??
-      "waiting";
-    const blocked = type === "blocked" ? blockers.messages ?? blockers.missions : undefined;
-    emit({ ...event, type, ...(blocked ?? {}) });
-  };
-  const messages = async () => {
-    let attempts = 0;
-    while (!signal.aborted) {
+  // Own the agent across both consumers before starting a second profile's probe.
+  const session =
+    settings.verifyReadiness && settings.client && settings.expectedAgentId
+      ? await acquireMissionAgentSession(
+          { baseUrl: settings.baseUrl, agentId: settings.expectedAgentId, signal: settings.signal },
+          settings.sessionLockDirectory ? { lockDirectory: settings.sessionLockDirectory } : {},
+        )
+      : null;
+  try {
+    const controller = new AbortController();
+    const signal = settings.signal
+      ? AbortSignal.any([settings.signal, controller.signal])
+      : controller.signal;
+    const emit = settings.emit ?? (() => {});
+    const phases = {
+      messages: "starting",
+      missions: settings.connectionOnly ? "waiting" : "starting",
+    };
+    let releaseMissions;
+    const messageReady = new Promise((resolve) => {
+      releaseMissions = resolve;
+    });
+    signal.addEventListener("abort", () => releaseMissions(false), { once: true });
+    if (signal.aborted) releaseMissions(false);
+    const report = (queue, event) => {
+      if (
+        [
+          "briefing_updated",
+          "file_overlap",
+          "session_visibility_unavailable",
+          "briefing_unavailable",
+        ].includes(event.type)
+      ) {
+        emit(event);
+        return;
+      }
+      phases[queue] = event.type === "completed" ? "waiting" : event.type;
+      const values = Object.values(phases);
+      const type =
+        ["reconnecting", "starting", "blocked", "working"].find((phase) =>
+          values.includes(phase),
+        ) ?? "waiting";
+      emit({ ...event, type });
+    };
+    const messages = async () => {
+      let attempts = 0;
+      while (!signal.aborted) {
+        try {
+          await (dependencies.runRuntime ?? runRuntime)({
+            ...settings,
+            signal,
+            stateDir: settings.stateDirectory,
+            allowAgents: [],
+            modelTimeoutMs: 900000,
+            replyTimeoutMs: 90000,
+            pollMs: settings.pollMs ?? 5000,
+            emit(event) {
+              if (event.type === "runtime_ready") emit(event);
+              else if (event.type === "runtime_reconnecting")
+                report("messages", { type: "reconnecting" });
+              else if (event.type === "runtime_resumed") report("messages", { type: "waiting" });
+              else if (event.type === "runtime_started") {
+                releaseMissions(true);
+                attempts = 0;
+                report("messages", { type: "waiting" });
+              } else if (event.type === "runtime_error")
+                report("messages", { type: "blocked", code: event.error?.code });
+              else if (["message_handled", "chat_completed"].includes(event.type))
+                report("messages", { type: "waiting" });
+            },
+          });
+          if (!signal.aborted) throw new Error("The message runtime stopped unexpectedly.");
+        } catch (error) {
+          if (signal.aborted) return;
+          if (
+            error.status === 401 ||
+            error.status === 403 ||
+            ["READINESS_PROBE_FAILED", "READINESS_UNSUPPORTED", "RUNTIME_SUPERSEDED"].includes(
+              error.code,
+            ) ||
+            error.code === "AGENT_IDENTITY_MISMATCH"
+          )
+            throw error;
+          report("messages", { type: "reconnecting" });
+          await sleep(
+            error.status === 429 ? 30000 : Math.min(30000, 1000 * 2 ** Math.min(attempts++, 5)),
+            undefined,
+            { signal },
+          );
+        }
+      }
+    };
+    const guarded = async (run) => {
       try {
-        await (dependencies.runRuntime ?? runRuntime)({
-          ...settings,
-          signal,
-          stateDir: settings.stateDirectory,
-          allowAgents: [],
-          adapterSettings: { ...settings.adapterSettings, diagnosticDirectory: settings.diagnosticDirectory },
-          modelTimeoutMs: 900000,
-          replyTimeoutMs: 90000,
-          pollMs: settings.pollMs ?? 5000,
-          emit(event) {
-            if (event.type === "runtime_started") {
-              attempts = 0;
-              report("messages", { type: "waiting" });
-            } else if (event.type === "runtime_error")
-              report("messages", { type: "blocked", code: event.error?.code, messageId: event.messageId });
-            else if (event.type === "message_started")
-              report("messages", { type: "working", messageId: event.data?.messageId });
-            else if (["message_handled", "chat_completed", "chat_queued"].includes(event.type))
-              report("messages", { type: "waiting" });
-          },
-        });
-        if (!signal.aborted) throw new Error("The message runtime stopped unexpectedly.");
+        await run();
       } catch (error) {
-        if (signal.aborted) return;
-        if (
-          error.status === 401 ||
-          error.status === 403 ||
-          error.code === "AGENT_IDENTITY_MISMATCH"
-        )
+        if (!signal.aborted) {
+          controller.abort();
           throw error;
-        report("messages", { type: "reconnecting" });
-        await sleep(
-          error.status === 429 ? 30000 : Math.min(30000, 1000 * 2 ** Math.min(attempts++, 5)),
-          undefined,
-          { signal },
-        );
-      }
-    }
-  };
-  const guarded = async (run) => {
-    try {
-      await run();
-    } catch (error) {
-      if (!signal.aborted) {
-        controller.abort();
-        throw error;
+        }
       }
-    }
-  };
-  const results = await Promise.allSettled([
-    guarded(messages),
-    ...(!settings.codexThreadId ? [guarded(() =>
-      (dependencies.runMissions ?? runMissionAgentService)({
-        ...settings,
-        signal,
-        emit: (event) => report("missions", event),
+    };
+    const results = await Promise.allSettled([
+      guarded(messages),
+      guarded(async () => {
+        // Do not dispatch business work while onboarding is still testing its adapter.
+        if (settings.connectionOnly) return;
+        if (settings.verifyReadiness && !(await messageReady)) return;
+        return (dependencies.runMissions ?? runMissionAgentService)(
+          {
+            ...settings,
+            signal,
+            emit: (event) => report("missions", event),
+          },
+          session ? { ownedSession: session } : {},
+        );
       }),
-    )] : []),
-  ]);
-  const failure = results.find((result) => result.status === "rejected");
-  if (failure) throw failure.reason;
+    ]);
+    const failure = results.find((result) => result.status === "rejected");
+    if (failure) throw failure.reason;
+  } finally {
+    await session?.release();
+  }
 }

package/bin/device-login.mjs

@@ -2,10 +2,11 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { privateRead, privateWrite } from "./runtime-installation.mjs";
+import { privateRead, privateWrite, privateDirectory } from "./runtime-installation.mjs";
+import { mkdir, rm, rename } from "node:fs/promises";
 import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
 
-function origin(value) {
+export function origin(value) {
   const url = new URL(value ?? "https://totemlayer.com");
   if (
     url.username ||
@@ -42,7 +43,9 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
     !pending ||
     pending.baseUrl !== baseUrl ||
     pending.requestedAgentId !== env.TOTEM_AGENT_ID ||
+    pending.connectionId !== env.TOTEM_CONNECTION_ID ||
     pending.provider !== (env.TOTEM_PROVIDER ?? "auto") ||
+    pending.redirectUri !== options.binding?.redirectUri ||
     new Date(pending.expiresAt) <= new Date()
   ) {
     const result = await request(
@@ -55,6 +58,13 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
           deviceName: hostname().slice(0, 100),
           provider: env.TOTEM_PROVIDER ?? "auto",
           ...(env.TOTEM_AGENT_ID ? { agentId: env.TOTEM_AGENT_ID } : {}),
+          ...(env.TOTEM_CONNECTION_ID ? { connectionId: env.TOTEM_CONNECTION_ID } : {}),
+          ...(options.binding
+            ? {
+                bindingChallenge: options.binding.challenge,
+                redirectUri: options.binding.redirectUri,
+              }
+            : {}),
         }),
       },
       options.fetch,
@@ -70,11 +80,18 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
       ...result,
       baseUrl,
       requestedAgentId: env.TOTEM_AGENT_ID,
+      connectionId: env.TOTEM_CONNECTION_ID,
       provider: env.TOTEM_PROVIDER ?? "auto",
+      replace: Boolean(options.replace),
+      ...(options.binding
+        ? { redirectUri: options.binding.redirectUri, verifier: options.binding.verifier }
+        : {}),
     };
     await privateWrite(join(runtime.directory, "connection-request.json"), pending);
   }
-  const url = `${baseUrl}/connect?code=${pending.code}`;
+  const url = pending.connectionId
+    ? `${baseUrl}/connections/${pending.connectionId}/accept?code=${pending.code}`
+    : `${baseUrl}/connect?code=${pending.code}`;
   if (options.openBrowser !== false) {
     const command =
       process.platform === "darwin"
@@ -86,10 +103,45 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
       () => {},
     );
   }
-  return { url, code: pending.code, expiresAt: pending.expiresAt };
+  return { id: pending.id, url, code: pending.code, expiresAt: pending.expiresAt };
 }
 
 export async function resumeDeviceLogin(runtime, env = process.env, options = {}) {
+  await privateDirectory(runtime.directory);
+  const lock = join(runtime.directory, "login.lock");
+  try {
+    await mkdir(lock, { mode: 0o700 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const owner = await privateRead(join(lock, "owner.json")).catch(() => null);
+    if (owner && Number.isSafeInteger(owner.pid) && owner.pid > 0) {
+      try {
+        process.kill(owner.pid, 0);
+      } catch (failure) {
+        if (failure.code === "ESRCH") await rm(lock, { recursive: true });
+      }
+    }
+    return { state: "setup_in_progress" };
+  }
+  try {
+    await privateWrite(join(lock, "owner.json"), { pid: process.pid });
+    if (options.reset) {
+      for (const name of ["connection-ready.json", "connection-request.json"])
+        await rename(
+          join(runtime.directory, name),
+          join(runtime.directory, `${name}.reauthorize-${Date.now()}`),
+        ).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+        });
+      return { state: "reset" };
+    }
+    return await resumeLoginLocked(runtime, env, options);
+  } finally {
+    await rm(lock, { recursive: true });
+  }
+}
+
+async function resumeLoginLocked(runtime, env, options) {
   let staged;
   try {
     staged = await privateRead(join(runtime.directory, "connection-ready.json"));
@@ -111,6 +163,8 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       { headers: { "x-totem-installation-token": pending.token } },
       options.fetch,
     );
+    if (result.status === "expired")
+      throw new Error("This installer authorization expired. Run totem login again.");
     if (result.status !== "approved") return;
     if (
       !/^[a-f0-9-]{36}$/.test(result.agentId) ||
@@ -119,9 +173,12 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       throw new Error("Totem returned an invalid connection.");
     staged = {
       agentId: result.agentId,
+      ...(result.connectionId ? { connectionId: result.connectionId } : {}),
       key: result.key,
       baseUrl: pending.baseUrl,
       requestId: pending.id,
+      installationId: pending.id,
+      replace: Boolean(pending.replace),
       token: pending.token,
     };
     // Persist privately before acknowledging, so an interrupted setup never loses the key.
@@ -140,8 +197,36 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
     delete staged.token;
     await privateWrite(join(runtime.directory, "connection-ready.json"), staged);
   }
-  const provider = await (options.detectProvider ?? detectInstalledProvider)(env);
-  if (!provider) return { state: "executor_needed" };
+  const reportFailure = async (errorCode) => {
+    const pending = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+      () => null,
+    );
+    if (pending && pending.id === staged.installationId)
+      await request(
+        origin(pending.baseUrl),
+        `/api/installations/${pending.id}/runtime`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-totem-installation-token": pending.token,
+          },
+          body: JSON.stringify({ errorCode }),
+        },
+        options.fetch,
+      ).catch(() => {});
+  };
+  let provider;
+  try {
+    provider = await (options.detectProvider ?? detectInstalledProvider)(env);
+  } catch (error) {
+    await reportFailure("UNSUPPORTED_ADAPTER");
+    throw error;
+  }
+  if (!provider) {
+    await reportFailure("PROVIDER_AUTH_REQUIRED");
+    return { state: "executor_needed" };
+  }
   const { agentSetupMain } = await import("./agent-setup.mjs");
   const status = await (options.setup ?? agentSetupMain)(
     [
@@ -152,6 +237,8 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       origin(staged.baseUrl),
       ...(await providerArguments(provider, env)),
       "--no-start",
+      ...(staged.connectionId ? ["--no-mcp"] : []),
+      ...(options.replace || staged.replace ? ["--replace"] : []),
       "--json",
     ],
     {
@@ -160,9 +247,21 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       stderr: { write() {} },
     },
   );
-  if (status) throw new Error("The approved connection could not be saved.");
-  const { rm } = await import("node:fs/promises");
+  if (status) {
+    await reportFailure("LISTENER_START_FAILED");
+    throw new Error("The approved connection could not be saved.");
+  }
+  await privateWrite(join(runtime.directory, "connection-last.json"), {
+    requestId: staged.installationId,
+    profile: staged.agentId,
+  });
   await rm(join(runtime.directory, "connection-ready.json"));
-  await rm(join(runtime.directory, "connection-request.json"), { force: true });
+  const current = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+    (error) => {
+      if (error.code !== "ENOENT") throw error;
+    },
+  );
+  if (current?.id === staged.installationId)
+    await rm(join(runtime.directory, "connection-request.json"), { force: true });
   return { state: "connected", profile: staged.agentId };
 }