totemlayer 0.1.5 → 0.1.11

package/bin/docker-test-sandbox.mjs

@@ -36,7 +36,7 @@ export async function runDockerNodeTests(checkout, signal, runFile) {
         "--env",
         "TMPDIR=/tmp",
         "--mount",
-        `type=bind,source=${root},target=/workspace`,
+        `type=bind,source=${root},target=/workspace,readonly`,
         "--workdir",
         "/workspace",
         NODE_TEST_IMAGE,

package/bin/installation.mjs

@@ -0,0 +1,160 @@
+import { parseArgs } from "node:util";
+import { readFile, stat } from "node:fs/promises";
+import { privateRead, privateWrite } from "./runtime-installation.mjs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ensureInstalledRuntime, installRuntimeService } from "./runtime-installation.mjs";
+import { beginDeviceLogin } from "./device-login.mjs";
+import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
+
+export async function activateConnection(profile, env = process.env, options = {}) {
+  const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(env);
+  const { automaticEnabled, setAutomaticEnabled } = await import("./automatic-runtime.mjs");
+  const enabled = await automaticEnabled(profile);
+  if (enabled) await setAutomaticEnabled(profile, true);
+  const service = await (options.installService ?? installRuntimeService)(runtime, {
+    ...env,
+    ...(profile.agentTokenEnv ? { TOTEM_AGENT_TOKEN_ENV: profile.agentTokenEnv } : {}),
+  });
+  if (!enabled) return { state: "paused", ...service, entry: runtime.cli };
+  const { agentStartMain } = await import("./agent-runner.mjs");
+  await (options.start ?? agentStartMain)(
+    ["--profile", profile.profileName, "--background", "--json"],
+    { env, automatic: true, stdout: { write() {} } },
+  );
+  return { state: "running", ...service, entry: runtime.cli };
+}
+
+export async function installationMain(args = [], options = {}) {
+  const env = options.env ?? process.env;
+  const stdout = options.stdout ?? process.stdout;
+  const flags = parseArgs({
+    args,
+    strict: true,
+    options: {
+      provider: { type: "string" },
+      "agent-id": { type: "string" },
+      "base-url": { type: "string" },
+      "no-browser": { type: "boolean" },
+      help: { type: "boolean", short: "h" },
+      json: { type: "boolean" },
+    },
+  }).values;
+  if (flags.help) {
+    stdout.write(
+      "totem login [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser]\nConnect this installation once. Totem securely saves its connection and automatically runs and restarts the listener.\n",
+    );
+    return 0;
+  }
+  const environment = {
+    ...env,
+    ...(flags.provider ? { TOTEM_PROVIDER: flags.provider } : {}),
+    ...(flags["agent-id"] ? { TOTEM_AGENT_ID: flags["agent-id"] } : {}),
+    ...(flags["base-url"] ? { TOTEM_BASE_URL: flags["base-url"] } : {}),
+  };
+  const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(environment);
+  const service = await (options.installService ?? installRuntimeService)(runtime, environment);
+  if (environment.TOTEM_NETWORK_API_KEY || environment.TOTEM_NETWORK_API_KEY_FILE) {
+    const provider = await (options.detectProvider ?? detectInstalledProvider)(environment);
+    if (!provider) {
+      let key = environment.TOTEM_NETWORK_API_KEY;
+      if (!key && environment.TOTEM_NETWORK_API_KEY_FILE) {
+        const info = await stat(environment.TOTEM_NETWORK_API_KEY_FILE);
+        if (
+          !info.isFile() ||
+          info.size > 8192 ||
+          (process.platform !== "win32" && info.mode & 0o077)
+        )
+          throw new Error("Use a private connection key file.");
+        key = (await readFile(environment.TOTEM_NETWORK_API_KEY_FILE, "utf8")).trim();
+      }
+      if (!/^tn_(?:test|live)_[A-Za-z0-9_-]{43}$/.test(key ?? ""))
+        throw new Error("The connection key is invalid.");
+      await privateWrite(join(runtime.directory, "connection-ready.json"), {
+        key,
+        baseUrl: environment.TOTEM_BASE_URL ?? "https://totemlayer.com",
+        agentId: environment.TOTEM_AGENT_ID,
+      });
+      stdout.write(
+        "Totem's automatic runtime is installed. Install/sign in to your AI client, then run totem login again.\n",
+      );
+      return 1;
+    }
+    const { agentSetupMain } = await import("./agent-setup.mjs");
+    return agentSetupMain(
+      [
+        "--profile",
+        environment.TOTEM_AGENT_ID ?? "default",
+        ...(environment.TOTEM_AGENT_ID ? ["--agent-id", environment.TOTEM_AGENT_ID] : []),
+        ...(await providerArguments(provider, environment)),
+        ...(flags.json ? ["--json"] : []),
+      ],
+      {
+        ...options,
+        env: environment,
+        activateConnection: options.activateConnection ?? activateConnection,
+      },
+    );
+  }
+  try {
+    await privateRead(join(runtime.directory, "connection-ready.json"));
+    stdout.write(
+      "Your Totem connection is saved privately. Sign in to your AI client; the listener connects automatically.\n",
+    );
+    return 0;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  // An upgrade reuses private profiles and starts their existing connections.
+  const { opendir } = await import("node:fs/promises");
+  let saved = false;
+  try {
+    const profiles = await opendir(join(runtime.root, "connections"));
+    for await (const entry of profiles)
+      if (
+        entry.isDirectory() &&
+        (!environment.TOTEM_AGENT_ID || entry.name === environment.TOTEM_AGENT_ID)
+      )
+        saved = true;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (saved && options.forceLogin !== true) {
+    const report = { installed: true, connection: "saved", automatic: true, service };
+    stdout.write(
+      flags.json
+        ? JSON.stringify(report) + "\n"
+        : "Totem's automatic listener is installed and reuses your saved connections.\n",
+    );
+    return 0;
+  }
+  const connection = await (options.beginLogin ?? beginDeviceLogin)(runtime, environment, {
+    openBrowser: !flags["no-browser"] && environment.TOTEM_NO_BROWSER !== "1",
+  });
+  const report = {
+    installed: true,
+    connection: "sign_in_required",
+    automatic: true,
+    service,
+    ...connection,
+  };
+  stdout.write(
+    flags.json
+      ? JSON.stringify(report) + "\n"
+      : `Totem is installed. Connect your agent once at:\n${connection.url}\nConnection code: ${connection.code.match(/.{1,4}/g).join(" ")}\nThe listener starts automatically after you connect.\n`,
+  );
+  return 0;
+}
+export async function postinstallMain(env = process.env) {
+  if (env.TOTEM_AUTO_START === "0" || env.CI) return 0;
+  try {
+    return await installationMain([], { env });
+  } catch {
+    process.stdout.write(
+      "Totem is installed. Automatic connection setup needs attention; run totem login to finish it.\n",
+    );
+    return 0;
+  }
+}
+if (process.argv[1] === fileURLToPath(import.meta.url) && process.argv[2] === "--postinstall")
+  await postinstallMain();

package/bin/mcp-install.mjs

@@ -1,10 +1,11 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { stat } from "node:fs/promises";
-import { resolve } from "node:path";
+import { stat, lstat } from "node:fs/promises";
+import { resolve, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
+import { runtimeRoot } from "./runtime-installation.mjs";
 
 const DEFAULT_ORIGIN = "https://totemlayer.com";
 const DEFAULT_NAME = "totem-local";
@@ -131,19 +132,28 @@ export async function installTotemMcp(args, environment = process.env, runtime =
   ];
   const addArgs =
     options.client === "codex"
-      ? ["mcp", "add", options.name, ...envArgs, "--", process.execPath, SERVER_ENTRY, "mcp"]
+      ? [
+          "mcp",
+          "add",
+          options.name,
+          ...envArgs,
+          "--",
+          process.execPath,
+          runtime.serverEntry ?? SERVER_ENTRY,
+          "mcp",
+        ]
       : [
           "mcp",
           "add",
+          options.name,
           ...envArgs,
           "--scope",
           "user",
           "--transport",
           "stdio",
-          options.name,
           "--",
           process.execPath,
-          SERVER_ENTRY,
+          runtime.serverEntry ?? SERVER_ENTRY,
           "mcp",
         ];
   const added = runClient(command, addArgs, environment, runtime);
@@ -169,7 +179,26 @@ export function managedMcpName(profileName) {
     : `totem_${profileName.slice(0, 24)}_${createHash("sha256").update(profileName).digest("hex").slice(0, 32)}`;
 }
 
-function managedArgs(profile, name) {
+async function installedServerEntry(profile, environment) {
+  if (!profile.stateDirectory) return SERVER_ENTRY;
+  const path = join(resolve(profile.stateDirectory, "../../../.."), "runtime", "totem.mjs");
+  try {
+    const info = await lstat(path);
+    if (
+      info.isFile() &&
+      !info.isSymbolicLink() &&
+      info.nlink === 1 &&
+      (!process.getuid || info.uid === process.getuid()) &&
+      (process.platform === "win32" || (info.mode & 0o777) === 0o600)
+    )
+      return path;
+  } catch {
+    /* Connections created without automatic installation retain their entry. */
+  }
+  return SERVER_ENTRY;
+}
+
+function managedArgs(profile, name, entry = SERVER_ENTRY) {
   const variables = [
     "--env",
     `TOTEM_BASE_URL=${profile.baseUrl}`,
@@ -177,24 +206,24 @@ function managedArgs(profile, name) {
     `TOTEM_NETWORK_API_KEY_FILE=${profile.credentialFile}`,
   ];
   return profile.client === "codex"
-    ? ["mcp", "add", name, ...variables, "--", process.execPath, SERVER_ENTRY, "mcp"]
+    ? ["mcp", "add", name, ...variables, "--", process.execPath, entry, "mcp"]
     : [
         "mcp",
         "add",
+        name,
         ...variables,
         "--scope",
         "user",
         "--transport",
         "stdio",
-        name,
         "--",
         process.execPath,
-        SERVER_ENTRY,
+        entry,
         "mcp",
       ];
 }
 
-function matchesManagedEntry(entry, profile, name) {
+function matchesManagedEntry(entry, profile, name, serverEntry = SERVER_ENTRY) {
   const transport = entry?.transport;
   const expectedEnvironment = {
     TOTEM_BASE_URL: profile.baseUrl,
@@ -209,7 +238,7 @@ function matchesManagedEntry(entry, profile, name) {
     ) &&
     transport?.type === "stdio" &&
     transport.command === process.execPath &&
-    JSON.stringify(transport.args) === JSON.stringify([SERVER_ENTRY, "mcp"]) &&
+    JSON.stringify(transport.args) === JSON.stringify([serverEntry, "mcp"]) &&
     transport.cwd == null &&
     (transport.env_vars == null ||
       (Array.isArray(transport.env_vars) && transport.env_vars.length === 0)) &&
@@ -279,10 +308,11 @@ function reconnectAdvice(profile, name) {
 }
 
 export async function inspectManagedTotemMcp(profile, environment = process.env, runtime = {}) {
+  const serverEntry = await installedServerEntry(profile, environment);
   const inspected = await inspectEntry(profile, localClientEnvironment(environment), runtime);
   if (
     inspected.state === "present" &&
-    matchesManagedEntry(inspected.entry, profile, inspected.name)
+    matchesManagedEntry(inspected.entry, profile, inspected.name, serverEntry)
   )
     return {
       name: inspected.name,
@@ -308,6 +338,7 @@ export async function installManagedTotemMcp(
   environment = process.env,
   runtime = {},
 ) {
+  const serverEntry = await installedServerEntry(profile, environment);
   if (!["codex", "claude"].includes(profile.client))
     fail("Choose an existing AI app for MCP setup.");
   try {
@@ -337,11 +368,14 @@ export async function installManagedTotemMcp(
           name,
         ],
         safeEnvironment,
-        runtime,
+        { ...runtime, serverEntry },
       );
       if (profile.client === "codex") {
         const after = await inspectEntry(profile, safeEnvironment, runtime);
-        if (after.state !== "present" || !matchesManagedEntry(after.entry, profile, name))
+        if (
+          after.state !== "present" ||
+          !matchesManagedEntry(after.entry, profile, name, serverEntry)
+        )
           return {
             name,
             state: "needs_attention",
@@ -361,7 +395,10 @@ export async function installManagedTotemMcp(
       };
     }
   }
-  if (inspected.state === "present" && matchesManagedEntry(inspected.entry, profile, name))
+  if (
+    inspected.state === "present" &&
+    matchesManagedEntry(inspected.entry, profile, name, serverEntry)
+  )
     return {
       name,
       state: "configured_unverified",
@@ -371,7 +408,21 @@ export async function installManagedTotemMcp(
     previousProfile?.profileName === profile.profileName &&
     previousProfile.client === profile.client &&
     inspected.state === "present" &&
-    matchesManagedEntry(inspected.entry, previousProfile, name);
+    matchesManagedEntry(
+      inspected.entry,
+      previousProfile,
+      name,
+      inspected.entry?.transport?.args?.[0],
+    ) &&
+    (inspected.entry.transport.args[0] === SERVER_ENTRY ||
+      new RegExp(
+        `^${runtimeRoot(environment)
+          .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+          .replaceAll(
+            "\\\\",
+            "[\\\\/]",
+          )}[\\\\/]runtime-packages[\\\\/]\\d+\\.\\d+\\.\\d+[\\\\/]node_modules[\\\\/]totemlayer[\\\\/]bin[\\\\/]totem\\.mjs$`,
+      ).test(inspected.entry.transport.args[0]));
   if (!ownsPrevious)
     return {
       name,
@@ -380,10 +431,15 @@ export async function installManagedTotemMcp(
     };
   // Codex add can update this exact named entry. No remove occurs: unsupported client
   // versions fail safely, and an exact read-back is required before reporting an update.
-  const updated = await managedCall(profile, managedArgs(profile, name), safeEnvironment, runtime);
+  const updated = await managedCall(
+    profile,
+    managedArgs(profile, name, serverEntry),
+    safeEnvironment,
+    runtime,
+  );
   if (updated.status === 0) {
     const after = await inspectEntry(profile, safeEnvironment, runtime);
-    if (after.state === "present" && matchesManagedEntry(after.entry, profile, name))
+    if (after.state === "present" && matchesManagedEntry(after.entry, profile, name, serverEntry))
       return {
         name,
         state: "updated_unverified",

package/bin/mcp.mjs

@@ -8,7 +8,7 @@ import * as z from "zod/v4";
 import { Totem } from "./sdk/index.js";
 import { inspectLocalRepository, verifyLocalRepoClaim } from "./repository.mjs";
 
-const VERSION = "0.1.5";
+const VERSION = "0.1.6";
 const MAX_KEY_BYTES = 8 * 1024;
 const MAX_ATTACHMENT_BYTES = 2 * 1024 * 1024;
 const collaborationSchema = z
@@ -148,6 +148,61 @@ export function createTotemMcpServer(config) {
     () => client.agent(),
   );
 
+  register(
+    server,
+    "totem_list_missions",
+    {
+      title: "List assigned missions",
+      description:
+        "Discover durable missions this authenticated agent can participate in. Offline agents must connect their own runtime to execute work.",
+      inputSchema: z.object({}),
+      annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+    },
+    () => client.missions.list(),
+  );
+
+  register(
+    server,
+    "totem_get_mission",
+    {
+      title: "Inspect a mission",
+      description:
+        "Read the mission team, dependencies, owner-approved infrastructure scope, results, and receipts before delegating work.",
+      inputSchema: z.object({ missionId: z.uuid() }),
+      annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+    },
+    ({ missionId }) => client.missions.get(missionId),
+  );
+
+  register(
+    server,
+    "totem_delegate_mission_task",
+    {
+      title: "Delegate a mission task",
+      description:
+        "The mission coordinator assigns a child task to a consented member. Infrastructure deployment requires the selected executor and an approved review dependency; verification depends on a completed deployment. This does not grant permissions or wake an offline agent.",
+      inputSchema: z.object({
+        missionId: z.uuid(),
+        ownerMemberId: z.uuid(),
+        parentWorkItemId: z.uuid(),
+        dependsOnIds: z.array(z.uuid()).min(1).max(40),
+        kind: z.enum([
+          "engineering",
+          "code",
+          "review",
+          "infrastructure_deploy",
+          "infrastructure_verify",
+        ]),
+        objective: z.string().min(1).max(10000),
+        requiredOutput: z.string().min(1).max(10000),
+        idempotencyKey: z.string().min(1).max(128),
+      }),
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+    },
+    ({ missionId, kind, idempotencyKey, ...input }) =>
+      client.missions.assign(missionId, { ...input, metadata: { kind } }, { idempotencyKey }),
+  );
+
   if (localRepositoryTools)
     register(
       server,

package/bin/mission-agent-service.mjs

@@ -1,3 +1,4 @@
+import { createLocalStaticProvider } from "./mission-infrastructure.mjs";
 import { randomUUID } from "node:crypto";
 import { readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -18,14 +19,34 @@ import {
 import { repositoryIdFromRemote } from "./repository.mjs";
 
 const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i;
-const STAGES = new Set(["proposal", "engineering", "decision", "code", "review", "handoff"]);
-const REPOSITORY_STAGES = new Set(["engineering", "code", "review"]);
+const STAGES = new Set([
+  "proposal",
+  "engineering",
+  "decision",
+  "code",
+  "review",
+  "handoff",
+  "infrastructure_deploy",
+  "infrastructure_verify",
+]);
+const REPOSITORY_STAGES = new Set([
+  "engineering",
+  "code",
+  "review",
+  "infrastructure_deploy",
+  "infrastructure_verify",
+]);
 const TERMINAL = new Set(["completed", "canceled", "failed"]);
 const RECOVERABLE = new Set([
   "ready",
   "result_settling",
   "local_test_failure_settling",
   "claiming",
+  "infra_source",
+  "infra_source_dispatched",
+  "infra_source_settling",
+  "infra_reserved",
+  "infra_dispatched",
 ]);
 const CHECKPOINT_BYTES = 2 * 1024 * 1024;
 
@@ -129,6 +150,7 @@ export async function runMissionAgentService(
     nimUrl,
     ollamaUrl,
     reasoning = false,
+    adapterSettings = {},
     stateDirectory = join(homedir(), ".totem", "missions"),
     pollMs = 5000,
     signal,
@@ -210,11 +232,21 @@ export async function runMissionAgentService(
   };
   const workerStateDirectory = join(resolve(stateDirectory), "mission-agents", session.key);
   const directory = join(workerStateDirectory, agent.id);
+  let infrastructureProvider;
   try {
     await ensurePrivateRuntimeDirectory(resolve(stateDirectory));
     await ensurePrivateRuntimeDirectory(join(resolve(stateDirectory), "mission-agents"));
     await ensurePrivateRuntimeDirectory(workerStateDirectory);
     await ensurePrivateRuntimeDirectory(directory);
+    const getInfrastructureProvider = async () => {
+      infrastructureProvider ??= await createLocalStaticProvider({
+        directory: join(workerStateDirectory, "local-static"),
+      });
+      return infrastructureProvider;
+    };
+    // Restore persisted releases on startup without repeating their deployment operations.
+    if ((await readdir(workerStateDirectory)).includes("local-static"))
+      await getInfrastructureProvider();
     const checkpointPath = join(directory, `discovery-${session.key}.json`);
     const state = await loadCheckpoint(checkpointPath, origin, agent.id);
     const persist = () => saveCheckpoint(checkpointPath, state);
@@ -276,9 +308,14 @@ export async function runMissionAgentService(
         nimUrl,
         ollamaUrl,
         reasoning,
+        adapterSettings,
         signal,
         candidateWorkItem: workItem,
         recoveryOnly,
+        infrastructureProvider:
+          recoveryOnly || workItem?.metadata?.kind?.startsWith("infrastructure_")
+            ? await getInfrastructureProvider()
+            : undefined,
         emit(event) {
           const type =
             event.type === "work_started"
@@ -435,6 +472,7 @@ export async function runMissionAgentService(
       }
     }
   } finally {
+    await infrastructureProvider?.close();
     await session.release();
     report({ type: "stopped" });
   }