totemlayer 0.1.21 → 0.1.25

package/bin/installation.mjs

@@ -5,6 +5,11 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureInstalledRuntime, installRuntimeService } from "./runtime-installation.mjs";
 import { beginDeviceLogin } from "./device-login.mjs";
+import { resumeDeviceLogin } from "./device-login.mjs";
+import { beginBoundLogin } from "./bound-login.mjs";
+import { readAgentProfile } from "./agent-profile.mjs";
+import { readAgentRuntimeStatus } from "./agent-runner.mjs";
+import { setTimeout as sleep } from "node:timers/promises";
 import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
 
 export async function activateConnection(profile, env = process.env, options = {}) {
@@ -19,7 +24,7 @@ export async function activateConnection(profile, env = process.env, options = {
   if (!enabled) return { state: "paused", ...service, entry: runtime.cli };
   const { verifyExecutorReady } = await import("./executor-readiness.mjs");
   try {
-    await (options.verifyExecutor ?? verifyExecutorReady)(profile, env);
+    if (profile.codexThreadId) await (options.verifyExecutor ?? verifyExecutorReady)(profile, env);
   } catch (error) {
     return {
       state: "needs_attention",
@@ -31,42 +36,18 @@ export async function activateConnection(profile, env = process.env, options = {
     };
   }
   const { agentStartMain } = await import("./agent-runner.mjs");
-  const started = await (options.start ?? agentStartMain)(
+  const result = await (options.start ?? agentStartMain)(
     ["--profile", profile.profileName, "--background", "--json"],
     { env, automatic: true, stdout: { write() {} } },
   );
-  if (started !== 0)
-    return {
-      state: "needs_attention",
-      ...service,
-      entry: runtime.cli,
-      code: "WORKER_START_FAILED",
-    };
-  const { readAgentRuntimeStatus } = await import("./agent-runner.mjs");
-  const state = await (options.readStatus ?? readAgentRuntimeStatus)(profile);
-  if (
-    state.running &&
-    state.phase === "blocked" &&
-    ["INSPECTION_BLOCKED", "INSPECTION_LIMIT", "INSPECTION_UNSUPPORTED_FILE"].includes(state.blockerCode)
-  )
-    return {
-      state: "running",
-      ...service,
-      entry: runtime.cli,
-      phase: state.phase,
-      quarantinedMessage: true,
-      code: state.blockerCode,
-      message: "The listener is running. An unsafe message was quarantined; other messages can still be processed.",
-    };
-  if (!state.running || !["connected", "working", "waiting"].includes(state.phase))
-    return {
-      state: "needs_attention",
-      ...service,
-      entry: runtime.cli,
-      code: state.blockerCode ?? "WORKER_NOT_READY",
-      phase: state.phase,
-    };
-  return { state: "running", ...service, entry: runtime.cli };
+  if (result) throw new Error("The listener could not start. Check totem status for this profile.");
+  const status = await (options.readStatus ?? readAgentRuntimeStatus)(profile);
+  return {
+    state: status.ready ? "ready" : "needs_attention",
+    ready: Boolean(status.ready),
+    ...service,
+    entry: runtime.cli,
+  };
 }
 
 export async function installationMain(args = [], options = {}) {
@@ -78,15 +59,19 @@ export async function installationMain(args = [], options = {}) {
     options: {
       provider: { type: "string" },
       "agent-id": { type: "string" },
+      "connection-id": { type: "string" },
       "base-url": { type: "string" },
       "no-browser": { type: "boolean" },
+      "device-login": { type: "boolean" },
+      reauthorize: { type: "boolean" },
+      "host-kind": { type: "string" },
       help: { type: "boolean", short: "h" },
       json: { type: "boolean" },
     },
   }).values;
   if (flags.help) {
     stdout.write(
-      "totem login [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser]\nConnect this installation once. Totem securely saves its connection and automatically runs and restarts the listener.\n",
+      "totem install [--agent-id UUID] [--connection-id UUID] [--host-kind local|hosted] [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser] [--device-login]\nWith --connection-id, prepare the host and use one informed Accept action for peer approval and listener startup. The browser must reach this host's loopback callback (remote hosts require a tunnel). Standalone login uses explicit owner authorization. Headless --device-login uses code comparison and cannot replace the connection-bound Accept flow. Hosted labels an already provisioned, authorized host; it does not provision hosting.\n",
     );
     return 0;
   }
@@ -94,8 +79,32 @@ export async function installationMain(args = [], options = {}) {
     ...env,
     ...(flags.provider ? { TOTEM_PROVIDER: flags.provider } : {}),
     ...(flags["agent-id"] ? { TOTEM_AGENT_ID: flags["agent-id"] } : {}),
+    ...(flags["connection-id"] ? { TOTEM_CONNECTION_ID: flags["connection-id"] } : {}),
     ...(flags["base-url"] ? { TOTEM_BASE_URL: flags["base-url"] } : {}),
+    ...(flags["host-kind"] ? { TOTEM_RUNTIME_HOST_KIND: flags["host-kind"] } : {}),
   };
+  if (
+    environment.TOTEM_RUNTIME_HOST_KIND &&
+    !["local", "hosted"].includes(environment.TOTEM_RUNTIME_HOST_KIND)
+  )
+    throw new Error(
+      "Choose --host-kind local or hosted. Hosted mode labels an already provisioned, explicitly authorized host; it does not provision one.",
+    );
+  if (
+    environment.TOTEM_CONNECTION_ID &&
+    !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(environment.TOTEM_CONNECTION_ID)
+  )
+    throw new Error("Choose a valid connection request ID.");
+  if (
+    environment.TOTEM_CONNECTION_ID &&
+    (flags["device-login"] ||
+      environment.TOTEM_NETWORK_API_KEY ||
+      environment.TOTEM_NETWORK_API_KEY_FILE ||
+      flags.reauthorize)
+  )
+    throw new Error(
+      "Prepare connection acceptance with the bound browser installer on this host. Headless and credential replacement use their explicit repair flows.",
+    );
   const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(environment);
   const service = await (options.installService ?? installRuntimeService)(runtime, environment);
   if (environment.TOTEM_NETWORK_API_KEY || environment.TOTEM_NETWORK_API_KEY_FILE) {
@@ -129,6 +138,7 @@ export async function installationMain(args = [], options = {}) {
       [
         "--profile",
         environment.TOTEM_AGENT_ID ?? "default",
+        ...(flags.reauthorize ? ["--replace"] : []),
         ...(environment.TOTEM_AGENT_ID ? ["--agent-id", environment.TOTEM_AGENT_ID] : []),
         ...(await providerArguments(provider, environment)),
         ...(flags.json ? ["--json"] : []),
@@ -140,61 +150,94 @@ export async function installationMain(args = [], options = {}) {
       },
     );
   }
-  try {
-    await privateRead(join(runtime.directory, "connection-ready.json"));
+  const activate = async (name) => {
+    const profile = await (options.readProfile ?? readAgentProfile)(name, { environment });
+    return (options.activateConnection ?? activateConnection)(profile, environment, options);
+  };
+  const reportActivation = (status) => {
     stdout.write(
-      "Your Totem connection is saved privately. Sign in to your AI client; the listener connects automatically.\n",
+      flags.json
+        ? JSON.stringify(status) + "\n"
+        : status.ready
+          ? "Ready. The listener passed its controlled receive, wake and reply check. This host must remain awake and online.\n"
+          : `Runtime ${status.state}. Run totem status for diagnostics; an installed or paused listener is not ready.\n`,
     );
-    return 0;
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    return status.ready ? 0 : 1;
+  };
+  if (environment.TOTEM_CONNECTION_ID) {
+    for (const file of ["connection-ready.json", "connection-request.json"]) {
+      const pending = await privateRead(join(runtime.directory, file)).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+      if (
+        pending &&
+        pending.connectionId !== environment.TOTEM_CONNECTION_ID &&
+        (file === "connection-ready.json" || Date.parse(pending.expiresAt) > Date.now())
+      )
+        throw new Error(
+          "Another host authorization is pending. Finish or explicitly cancel that setup before preparing this connection; no saved identity was replaced.",
+        );
+    }
+  }
+  const resume = options.resumeLogin ?? resumeDeviceLogin;
+  const loginOptions = { ...options, replace: Boolean(flags.reauthorize) };
+  if (flags.reauthorize) {
+    const reset = await resume(runtime, environment, { ...loginOptions, reset: true });
+    if (reset?.state !== "reset") {
+      stdout.write(
+        "Another installer is saving this connection. Wait for it to finish before reauthorizing.\n",
+      );
+      return 1;
+    }
+  }
+  const staged = flags.reauthorize
+    ? undefined
+    : await resume(runtime, environment, loginOptions).catch((error) => {
+        if (error.message?.includes("authorization expired")) return undefined;
+        throw error;
+      });
+  if (staged?.state === "connected") return reportActivation(await activate(staged.profile));
+  if (staged?.state === "executor_needed") {
+    stdout.write(
+      "Authorization is saved privately. Sign in to an installed Codex or Claude client, or configure a supported local/custom adapter, then retry totem login. The listener is not ready.\n",
+    );
+    return 1;
   }
   // An upgrade reuses private profiles and starts their existing connections.
   const { opendir } = await import("node:fs/promises");
-  let saved = false;
-  const savedProfiles = [];
+  const saved = [];
   try {
     const profiles = await opendir(join(runtime.root, "connections"));
     for await (const entry of profiles)
       if (
         entry.isDirectory() &&
         (!environment.TOTEM_AGENT_ID || entry.name === environment.TOTEM_AGENT_ID)
-      ) {
-        saved = true;
-        savedProfiles.push(entry.name);
-      }
+      )
+        saved.push(entry.name);
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  if (saved && options.forceLogin !== true) {
-    const { readAgentProfile } = await import("./agent-profile.mjs");
+  if (
+    saved.length &&
+    options.forceLogin !== true &&
+    !flags.reauthorize &&
+    !environment.TOTEM_CONNECTION_ID
+  ) {
     const results = [];
-    for (const name of savedProfiles) {
-      const profile = await readAgentProfile(name, { environment });
-      results.push({
-        profile: name,
-        ...(await (options.activateConnection ?? activateConnection)(profile, environment)),
-      });
-    }
-    const ready = results.every((result) => ["running", "paused"].includes(result.state));
-    const report = {
+    for (const name of saved) results.push({ profile: name, ...(await activate(name)) });
+    return reportActivation({
       installed: true,
-      connection: "saved",
-      automatic: true,
-      ready,
+      ready: results.every((r) => r.ready),
+      state: results.every((r) => r.ready) ? "ready" : "needs_attention",
       profiles: results,
       service,
-    };
-    stdout.write(
-      flags.json
-        ? JSON.stringify(report) + "\n"
-        : ready
-          ? "Totem's automatic listener reuses your saved connections; startup checks passed.\n"
-          : "Totem is installed, but an agent failed its startup check. Run totem status to inspect it.\n",
-    );
-    return ready ? 0 : 1;
+    });
   }
-  const connection = await (options.beginLogin ?? beginDeviceLogin)(runtime, environment, {
+  const connection = await (
+    options.beginLogin ?? (flags["device-login"] ? beginDeviceLogin : beginBoundLogin)
+  )(runtime, environment, {
+    ...options,
+    replace: Boolean(flags.reauthorize),
     openBrowser: !flags["no-browser"] && environment.TOTEM_NO_BROWSER !== "1",
   });
   const report = {
@@ -202,19 +245,75 @@ export async function installationMain(args = [], options = {}) {
     connection: "sign_in_required",
     automatic: true,
     service,
-    ...connection,
+    url: connection.url,
+    ...(flags["device-login"] ? { code: connection.code } : {}),
+    ready: false,
   };
   stdout.write(
     flags.json
       ? JSON.stringify(report) + "\n"
-      : `Totem is installed. Connect your agent once at:\n${connection.url}\nConnection code: ${connection.code.match(/.{1,4}/g).join(" ")}\nThe listener starts automatically after you connect.\n`,
+      : `${environment.TOTEM_CONNECTION_ID ? "Accept the peer connection and connect this host in one action:" : "Authorize your agent in the installer browser:"}\n${connection.url}\n${flags["device-login"] ? `Compare this code before approving: ${connection.code.match(/.{1,4}/g).join(" ")}\n` : ""}Waiting for authorization and the controlled listener check.\n`,
   );
-  return 0;
+  try {
+    const deadline = Math.min(
+      Date.parse(connection.expiresAt),
+      Date.now() + (options.loginTimeoutMs ?? 600000),
+    );
+    while (Date.now() < deadline && !options.signal?.aborted) {
+      const result = await resume(runtime, environment, loginOptions);
+      if (result?.state === "connected") return reportActivation(await activate(result.profile));
+      const receipt = await privateRead(join(runtime.directory, "connection-last.json")).catch(
+        (error) => {
+          if (error.code !== "ENOENT") throw error;
+        },
+      );
+      if (receipt?.requestId === connection.id && receipt.profile)
+        return reportActivation(await activate(receipt.profile));
+      if (result?.state === "executor_needed") {
+        stdout.write(
+          "Authorization saved. Sign in to an installed AI client or configure a supported adapter, then run totem login again. Runtime is not ready.\n",
+        );
+        return 1;
+      }
+      // The supervisor may have saved the profile while this installer was polling.
+      const pending = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+        (error) => {
+          if (error.code !== "ENOENT") throw error;
+        },
+      );
+      const name = environment.TOTEM_AGENT_ID ?? pending?.requestedAgentId;
+      if (name && !environment.TOTEM_CONNECTION_ID) {
+        const profile = await (options.readProfile ?? readAgentProfile)(name, {
+          environment,
+        }).catch((error) => {
+          if (error.code !== "AGENT_PROFILE_NOT_FOUND") throw error;
+        });
+        if (profile)
+          return reportActivation(
+            await (options.activateConnection ?? activateConnection)(profile, environment, options),
+          );
+      }
+      await (options.sleep ?? sleep)(3000, undefined, { signal: options.signal });
+    }
+    stdout.write(
+      "Setup is not ready yet. Run totem login again to resume securely; inspect totem status for any saved profile.\n",
+    );
+    return 1;
+  } finally {
+    connection.close?.();
+  }
 }
-export async function postinstallMain(env = process.env) {
+export async function postinstallMain(env = process.env, options = {}) {
   if (env.TOTEM_AUTO_START === "0" || env.CI) return 0;
   try {
-    return await installationMain([], { env });
+    // npm may hide lifecycle output. Prepare reception without opening a separate
+    // credential-consent page before the user reaches informed peer acceptance.
+    const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(env);
+    await (options.installService ?? installRuntimeService)(runtime, env);
+    (options.stdout ?? process.stdout).write(
+      "Totem runtime prepared. Run totem install, or prepare the host from a peer request and use its single Accept action. No new runtime credential has been granted.\n",
+    );
+    return 0;
   } catch {
     process.stdout.write(
       "Totem is installed. Automatic connection setup needs attention; run totem login to finish it.\n",

package/bin/mission-agent-service.mjs

@@ -7,6 +7,7 @@ import { setTimeout as sleep } from "node:timers/promises";
 
 import {
   acquireMissionAgentSession,
+  assertMissionAgentSession,
   ensurePrivateRuntimeDirectory,
   missionAgentOrigin,
   readPrivateRuntimeJson,
@@ -26,6 +27,7 @@ const STAGES = new Set([
   "code",
   "review",
   "handoff",
+  "workspace_report",
   "infrastructure_deploy",
   "infrastructure_verify",
 ]);
@@ -213,10 +215,14 @@ export async function runMissionAgentService(
       emit({ type: "stopped" });
       return;
     }
-    session = await acquireMissionAgentSession(
-      { baseUrl: origin, agentId: agent.id, signal },
-      dependencies.session,
-    );
+    if (dependencies.ownedSession) {
+      assertMissionAgentSession(dependencies.ownedSession, origin, agent.id);
+      session = dependencies.ownedSession;
+    } else
+      session = await acquireMissionAgentSession(
+        { baseUrl: origin, agentId: agent.id, signal },
+        dependencies.session,
+      );
   } catch (error) {
     if (!signal?.aborted) throw error;
     emit({ type: "stopped" });
@@ -273,6 +279,7 @@ export async function runMissionAgentService(
       return false;
     };
     const bindingFor = async (mission, kind, recovery = false) => {
+      if (kind === "workspace_report") return null;
       if (!mission.repository && !REPOSITORY_STAGES.has(kind)) return null;
       const root = mission.repository && bindings.get(mission.repository.url);
       if (!root) {
@@ -317,6 +324,17 @@ export async function runMissionAgentService(
             ? await getInfrastructureProvider()
             : undefined,
         emit(event) {
+          if (
+            [
+              "briefing_updated",
+              "file_overlap",
+              "session_visibility_unavailable",
+              "briefing_unavailable",
+            ].includes(event.type)
+          ) {
+            emit({ ...event, missionId });
+            return;
+          }
           const type =
             event.type === "work_started"
               ? "working"
@@ -473,7 +491,7 @@ export async function runMissionAgentService(
     }
   } finally {
     await infrastructureProvider?.close();
-    await session.release();
+    if (!dependencies.ownedSession) await session.release();
     report({ type: "stopped" });
   }
 }