totemlayer 0.1.59 → 0.1.63

package/README.md

@@ -27,7 +27,7 @@ To configure execution later, rerun setup with `--provider` and the adapter's se
 
 ## Connect with automatic listener setup
 
-Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.59.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
+Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.63.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
 
 During browser sign-in, `totem_get_connection_status` reports progress. Normal tools appear after the approved identity is pinned privately. Codex verifies identity, startup and the saved chat callback before receiving work; reconnect preserves bindings and pauses. Missing capabilities leave work queued. A remote HTTP connector cannot install local software.
 
@@ -45,7 +45,7 @@ For a hosted connection, add these settings to your client's MCP configuration:
 For a local stdio connection, install the CLI with Node.js 22.14 or newer:
 
 ```sh
-npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.59.tgz
+npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.63.tgz
 ```
 
 Save your agent's connection key in a private file. Protect it with mode 0600 on macOS/Linux or your user's filesystem ACL on Windows. Configure these fields in your client's MCP settings:
@@ -64,7 +64,7 @@ Reload the client if needed, discover the available tools, and call `totem_get_i
 Run the guided installer on the host where your agent will execute work:
 
 ```sh
-npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.59.tgz totem install
+npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.63.tgz totem install
 ```
 
 The installer opens Totem sign-in and saves the approved connection privately. It checks your configured agent runtime, configures supported clients, and starts the listener when an authorized executor is available. The supervised listener is enabled by default for this setup and starts when you sign in to the computer on hosts with a supported user service manager. It recovers after a process exit and retries temporary connection failures. An explicit stop stays paused across restarts.
@@ -74,7 +74,7 @@ For manual setup, use `totem mcp install` with a supported client and the privat
 For a host without a browser:
 
 ```sh
-npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.59.tgz totem login --device-login --no-browser
+npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.63.tgz totem login --device-login --no-browser
 ```
 
 Open the printed link on your own device and compare the connection code. Preserve existing MCP entries; inspect conflicts before replacing them. If an executor is unavailable, the saved connection remains available while you complete runtime setup.

package/bin/agent-memory.mjs

@@ -1,3 +1,14 @@
+/** Explicit owner restrictions apply to tools, consolidation, and server checkpoints. */
+export function allowsMemoryWrites(text) {
+  const value = String(text ?? "")
+    .normalize("NFKC")
+    .replace(/\p{Cf}/gu, "")
+    .replace(/\s+/gu, " ");
+  return !/\bread[\s-]*only\b|\b(?:do\s+not|don['’]t|never|no)\b[^.!?;\n]{0,100}\b(?:memory|memories|remember|save|store)\b|\b(?:keep|leave|preserve)\b[^.!?;\n]{0,40}\bmemor(?:y|ies)\b[^.!?;\n]{0,30}\bunchanged\b/i.test(
+    value,
+  );
+}
+
 /** Fetch before each model turn. Missing support on an older host is explicit and compatible. */
 export async function agentMemoryPrompt(
   client,
@@ -44,7 +55,7 @@ export async function learnAgentMemory({
   signal,
   emit = () => {},
 }) {
-  if (!client.memory?.get || !client.memory?.update) return;
+  if (!allowsMemoryWrites(turn.user) || !client.memory?.get || !client.memory?.update) return;
   const stateKey = `memory:${key}`;
   let state = await journal.read(stateKey);
   if (state?.done) return;

package/bin/agent-profile.mjs

@@ -186,6 +186,10 @@ async function normalizedSettings(input, directory) {
     "commandArgs",
     "agentUrl",
     "agentTokenEnv",
+    "codePaths",
+    "inferenceOrigin",
+    "inferenceProtocol",
+    "inferenceTokenEnv",
     "ollamaUrl",
     "nimUrl",
     "codexThreadId",
@@ -299,7 +303,18 @@ async function normalizedSettings(input, directory) {
     repositoryRoots,
     stateDirectory,
     ...Object.fromEntries(
-      ["command", "commandArgs", "agentUrl", "agentTokenEnv", "ollamaUrl", "nimUrl"]
+      [
+        "command",
+        "commandArgs",
+        "agentUrl",
+        "agentTokenEnv",
+        "codePaths",
+        "inferenceOrigin",
+        "inferenceProtocol",
+        "inferenceTokenEnv",
+        "ollamaUrl",
+        "nimUrl",
+      ]
         .filter((key) => input[key] !== undefined)
         .map((key) => [key, input[key]]),
     ),

package/bin/agent-runner.mjs

@@ -437,7 +437,16 @@ export async function runAgentSession(profile, options = {}) {
         })),
         provider: profile.client ?? profile.provider,
         adapterSettings: Object.fromEntries(
-          ["command", "commandArgs", "agentUrl", "agentTokenEnv"]
+          [
+            "command",
+            "commandArgs",
+            "agentUrl",
+            "agentTokenEnv",
+            "codePaths",
+            "inferenceOrigin",
+            "inferenceProtocol",
+            "inferenceTokenEnv",
+          ]
             .filter((key) => profile[key] !== undefined)
             .map((key) => [key, profile[key]]),
         ),
@@ -593,8 +602,8 @@ export async function agentStartMain(args, options = {}) {
           .map((name) => [name, environment[name]]),
       ),
     });
-    if (profile.agentTokenEnv && environment[profile.agentTokenEnv])
-      env[profile.agentTokenEnv] = environment[profile.agentTokenEnv];
+    for (const name of [profile.agentTokenEnv, profile.inferenceTokenEnv])
+      if (name && environment[name]) env[name] = environment[name];
     delete env.TOTEM_NETWORK_API_KEY_FILE;
     delete env.TOTEM_BASE_URL;
     if (["local", "hosted"].includes(environment.TOTEM_RUNTIME_HOST_KIND))

package/bin/inference-broker.mjs

@@ -0,0 +1,361 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { readPrivateRuntimeJson } from "./mission-agent-session.mjs";
+
+export function isolationError(code, message) {
+  return Object.assign(new Error(message), { status: 422, code });
+}
+
+async function privateAuth(path) {
+  try {
+    return await readPrivateRuntimeJson(path, 32768);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw isolationError(
+      "PROVIDER_AUTH_REQUIRED",
+      "The provider's private authentication needs attention.",
+    );
+  }
+}
+
+/** Provider secrets stay in this parent process; never copy them into an agent home. */
+export async function inferenceAuthority(provider, environment = process.env, options = {}) {
+  if (provider === "codex") {
+    if (environment.OPENAI_API_KEY)
+      return {
+        protocol: "responses",
+        origin: "https://api.openai.com",
+        prefix: "/v1",
+        headers: { authorization: `Bearer ${environment.OPENAI_API_KEY}` },
+      };
+    const auth = await privateAuth(
+      join(environment.CODEX_HOME ?? join(environment.HOME ?? homedir(), ".codex"), "auth.json"),
+    );
+    if (auth?.OPENAI_API_KEY)
+      return {
+        protocol: "responses",
+        origin: "https://api.openai.com",
+        prefix: "/v1",
+        headers: { authorization: `Bearer ${auth.OPENAI_API_KEY}` },
+      };
+    if (typeof auth?.tokens?.access_token === "string" && auth.tokens.access_token)
+      return {
+        protocol: "responses",
+        origin: "https://chatgpt.com",
+        prefix: "/backend-api/codex",
+        headers: {
+          authorization: `Bearer ${auth.tokens.access_token}`,
+          ...(typeof auth.tokens.account_id === "string"
+            ? { "chatgpt-account-id": auth.tokens.account_id }
+            : {}),
+        },
+      };
+  }
+  if (provider === "claude") {
+    if (environment.ANTHROPIC_API_KEY)
+      return {
+        protocol: "anthropic",
+        origin: "https://api.anthropic.com",
+        prefix: "/v1",
+        headers: { "x-api-key": environment.ANTHROPIC_API_KEY, "anthropic-version": "2023-06-01" },
+      };
+    let token = environment.CLAUDE_CODE_OAUTH_TOKEN;
+    if (!token) {
+      const auth = await privateAuth(
+        join(
+          environment.CLAUDE_CONFIG_DIR ?? join(environment.HOME ?? homedir(), ".claude"),
+          ".credentials.json",
+        ),
+      );
+      token = auth?.claudeAiOauth?.accessToken;
+    }
+    if (!token && (options.platform ?? process.platform) === "darwin") {
+      try {
+        // Keychain output stays in the trusted parent. No refresh credential is
+        // copied into the child, its files, or inference request bodies.
+        const readKeychain =
+          options.readKeychain ??
+          (async () => {
+            const result = await promisify(execFile)(
+              "/usr/bin/security",
+              ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
+              {
+                timeout: 10000,
+                maxBuffer: 32768,
+                env: { PATH: "/usr/bin:/bin" },
+              },
+            );
+            return result.stdout;
+          });
+        token = JSON.parse(await readKeychain())?.claudeAiOauth?.accessToken;
+      } catch {
+        /* Missing, locked, or unavailable credentials need owner attention. */
+      }
+    }
+    if (typeof token === "string" && token)
+      return {
+        protocol: "anthropic",
+        origin: "https://api.anthropic.com",
+        prefix: "/v1",
+        headers: {
+          authorization: `Bearer ${token}`,
+          "anthropic-version": "2023-06-01",
+          "anthropic-beta": "oauth-2025-04-20",
+        },
+      };
+  }
+  throw isolationError(
+    "PROVIDER_AUTH_REQUIRED",
+    "Configure the selected provider's API key or supported private login in the parent runtime. Provider credentials are never passed to the isolated agent.",
+  );
+}
+
+function plainText(value, type) {
+  if (typeof value === "string") return value;
+  if (!Array.isArray(value))
+    throw isolationError("INFERENCE_REQUEST_DENIED", "Only text inference is allowed.");
+  return value.map((item) => {
+    if (
+      !item ||
+      !["text", "input_text", "output_text"].includes(item.type) ||
+      typeof item.text !== "string"
+    )
+      throw isolationError("INFERENCE_REQUEST_DENIED", "Only text inference is allowed.");
+    return { type: type ?? item.type, text: item.text };
+  });
+}
+
+/** Reconstruct the data-plane request: no server tools, uploads, URLs, or account history. */
+export function inferenceRequest(protocol, input, selectedModel) {
+  if (
+    !input ||
+    typeof input !== "object" ||
+    Array.isArray(input) ||
+    input.previous_response_id ||
+    input.conversation ||
+    input.prompt ||
+    input.background
+  )
+    throw isolationError(
+      "INFERENCE_REQUEST_DENIED",
+      "Persistent provider state is unavailable in this session.",
+    );
+  if (
+    typeof input.model !== "string" ||
+    !input.model ||
+    (selectedModel && selectedModel !== "default" && input.model !== selectedModel)
+  )
+    throw isolationError(
+      "INFERENCE_REQUEST_DENIED",
+      "The requested model is outside this session.",
+    );
+  const body = { model: input.model, stream: input.stream === true };
+  for (const key of [
+    "temperature",
+    "top_p",
+    "max_tokens",
+    "max_output_tokens",
+    "reasoning",
+    "text",
+    "output_config",
+    "thinking",
+  ])
+    if (input[key] !== undefined) body[key] = input[key];
+  if (protocol === "responses") {
+    body.store = false;
+    body.tools = [];
+    body.tool_choice = "none";
+    if (input.instructions !== undefined) {
+      if (typeof input.instructions !== "string")
+        throw isolationError("INFERENCE_REQUEST_DENIED", "Text instructions are required.");
+      body.instructions = input.instructions;
+    }
+    if (typeof input.input === "string") body.input = input.input;
+    // New Codex clients place tool declarations in input as well as tools.
+    // Discard the catalog; calls, results and provider handles still fail below.
+    else if (Array.isArray(input.input))
+      body.input = input.input
+        .filter((message) => message?.type !== "additional_tools")
+        .map((message) => {
+          if (
+            !message ||
+            (message.type && message.type !== "message") ||
+            !["user", "assistant", "system", "developer"].includes(message.role)
+          )
+            throw isolationError(
+              "INFERENCE_REQUEST_DENIED",
+              "Provider objects and tools cannot enter this session.",
+            );
+          return { type: "message", role: message.role, content: plainText(message.content) };
+        });
+    else throw isolationError("INFERENCE_REQUEST_DENIED", "Text input is required.");
+  } else if (protocol === "anthropic" || protocol === "chat") {
+    body.tools = [];
+    if (protocol === "anthropic" && input.system !== undefined)
+      body.system = plainText(input.system, "text");
+    if (!Array.isArray(input.messages))
+      throw isolationError("INFERENCE_REQUEST_DENIED", "Text messages are required.");
+    body.messages = input.messages.map((message) => {
+      if (
+        !(
+          protocol === "anthropic"
+            ? ["user", "assistant"]
+            : ["user", "assistant", "system", "developer"]
+        ).includes(message?.role)
+      )
+        throw isolationError("INFERENCE_REQUEST_DENIED", "Unsupported message role.");
+      return { role: message.role, content: plainText(message.content, "text") };
+    });
+    body.max_tokens ??= 4096;
+  } else throw isolationError("INFERENCE_REQUEST_DENIED", "Unsupported inference protocol.");
+  return body;
+}
+
+/** Each broker is private, short-lived, pinned to one account, and has no tool API. */
+export async function startInferenceBroker({
+  authority,
+  model,
+  socketPath,
+  signal,
+  fetcher = fetch,
+  maxRequests = 12,
+  timeoutMs = 120000,
+}) {
+  const origin = new URL(authority.origin);
+  if (
+    origin.protocol !== "https:" ||
+    origin.username ||
+    origin.password ||
+    origin.pathname !== "/" ||
+    origin.search ||
+    origin.hash ||
+    !["responses", "anthropic", "chat"].includes(authority.protocol) ||
+    !/^\/[A-Za-z0-9/_-]+$/.test(authority.prefix)
+  )
+    throw isolationError(
+      "INFERENCE_CONFIG_INVALID",
+      "Choose a pinned HTTPS inference origin and API prefix.",
+    );
+  const token = randomBytes(32).toString("hex");
+  const stop = new AbortController();
+  const sessionSignal = signal ? AbortSignal.any([signal, stop.signal]) : stop.signal;
+  let requests = 0;
+  const server = createServer(async (request, response) => {
+    const deny = (status = 403) => {
+      if (!response.headersSent) response.writeHead(status, { "content-type": "application/json" });
+      response.end('{"error":"INFERENCE_REQUEST_DENIED"}');
+    };
+    try {
+      const supplied =
+        request.headers.authorization?.replace(/^Bearer /u, "") ?? request.headers["x-api-key"];
+      if (
+        typeof supplied !== "string" ||
+        Buffer.byteLength(supplied) !== Buffer.byteLength(token) ||
+        !timingSafeEqual(Buffer.from(supplied), Buffer.from(token)) ||
+        request.method !== "POST" ||
+        !request.url?.startsWith("/") ||
+        request.url.startsWith("//") ||
+        ++requests > maxRequests ||
+        sessionSignal.aborted
+      )
+        return deny();
+      const url = new URL(request.url, "http://127.0.0.1");
+      const operation =
+        authority.protocol === "responses"
+          ? url.pathname === "/v1/responses"
+            ? "/responses"
+            : null
+          : authority.protocol === "chat"
+            ? url.pathname === "/v1/chat/completions"
+              ? "/chat/completions"
+              : null
+            : ["/v1/messages", "/v1/messages/count_tokens"].includes(url.pathname)
+              ? url.pathname.slice(3)
+              : null;
+      if (!operation || (url.search && url.search !== "?beta=true")) return deny();
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of request) {
+        if ((size += chunk.length) > 2 * 1024 * 1024) return deny(413);
+        chunks.push(chunk);
+      }
+      const body = inferenceRequest(
+        authority.protocol,
+        JSON.parse(Buffer.concat(chunks).toString("utf8")),
+        model,
+      );
+      if (operation.endsWith("/count_tokens")) {
+        for (const name of [
+          "max_tokens",
+          "max_output_tokens",
+          "stream",
+          "output_config",
+          "temperature",
+          "top_p",
+        ])
+          delete body[name];
+      }
+      const upstream = await fetcher(
+        `${origin.origin}${authority.prefix}${operation}${url.search}`,
+        {
+          method: "POST",
+          redirect: "error",
+          signal: AbortSignal.any([sessionSignal, AbortSignal.timeout(timeoutMs)]),
+          headers: { "content-type": "application/json", ...authority.headers },
+          body: JSON.stringify(body),
+        },
+      );
+      if (!upstream.ok) {
+        await upstream.body?.cancel();
+        return deny(502);
+      }
+      response.writeHead(200, {
+        "content-type": upstream.headers.get("content-type") ?? "application/json",
+        "cache-control": "no-store",
+      });
+      let received = 0;
+      for await (const chunk of upstream.body) {
+        if ((received += chunk.length) > 8 * 1024 * 1024) {
+          response.destroy();
+          break;
+        }
+        if (!response.write(chunk))
+          await new Promise((resolve) => {
+            response.once("drain", resolve);
+            response.once("close", resolve);
+          });
+        if (response.destroyed) break;
+      }
+      response.end();
+    } catch {
+      if (response.headersSent) response.destroy();
+      else deny(502);
+    }
+  });
+  server.requestTimeout = Math.min(timeoutMs, 120000);
+  server.maxConnections = 8;
+  server.headersTimeout = 10000;
+  server.on("connect", (_request, socket) => socket.destroy());
+  server.on("upgrade", (_request, socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    if (socketPath) server.listen(socketPath, resolve);
+    else server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  return {
+    token,
+    socketPath,
+    port: typeof address === "object" ? address.port : null,
+    baseUrl: typeof address === "object" ? `http://127.0.0.1:${address.port}` : null,
+    async close() {
+      stop.abort();
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    },
+  };
+}

package/bin/isolated-agent-entry.mjs

@@ -0,0 +1,35 @@
+// Linux's private network namespace can reach only this relay and the parent broker socket.
+import { createServer } from "node:net";
+import { createConnection } from "node:net";
+import { spawn } from "node:child_process";
+
+const config = JSON.parse(process.env.AGENT_SESSION_CONFIG);
+const server = createServer();
+const sockets = new Set();
+server.on("connection", (socket) => {
+  sockets.add(socket);
+  const parent = createConnection(config.socketPath);
+  socket.pipe(parent).pipe(socket);
+  parent.on("error", () => socket.destroy());
+  socket.on("error", () => parent.destroy());
+  socket.on("close", () => {
+    sockets.delete(socket);
+    parent.destroy();
+  });
+});
+await new Promise((resolve) => server.listen(16443, "127.0.0.1", resolve));
+const env = { ...process.env };
+delete env.AGENT_SESSION_CONFIG;
+const child = spawn(config.command, config.args, {
+  env,
+  cwd: config.cwd,
+  stdio: "inherit",
+  shell: false,
+});
+const stop = (code) => {
+  process.exitCode = code ?? 1;
+  for (const socket of sockets) socket.destroy();
+  server.close();
+};
+child.on("error", () => stop(1));
+child.on("exit", stop);