totemlayer 0.1.6 → 0.1.12

package/bin/automatic-runtime.mjs

@@ -0,0 +1,131 @@
+import { opendir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { readAgentProfile } from "./agent-profile.mjs";
+import { agentStartMain, readAgentRuntimeStatus } from "./agent-runner.mjs";
+import {
+  privateDirectory,
+  privateRead,
+  privateWrite,
+  runtimeRoot,
+} from "./runtime-installation.mjs";
+import { resumeDeviceLogin } from "./device-login.mjs";
+
+export async function setAutomaticEnabled(profile, enabled) {
+  await privateWrite(join(profile.stateDirectory, "automatic.json"), { enabled });
+}
+export async function automaticEnabled(profile) {
+  try {
+    return (await privateRead(join(profile.stateDirectory, "automatic.json"))).enabled === true;
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    throw error;
+  }
+}
+export async function superviseOnce(env = process.env, options = {}) {
+  const directory = join(runtimeRoot(env), "runtime");
+  await Promise.resolve((options.resumeLogin ?? resumeDeviceLogin)({ directory }, env)).catch(
+    () => {},
+  );
+  let profiles;
+  try {
+    profiles = await opendir(join(runtimeRoot(env), "connections"));
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const results = [];
+  for await (const entry of profiles) {
+    if (!entry.isDirectory()) continue;
+    try {
+      const profile = await readAgentProfile(entry.name, { environment: env });
+      if (!(await automaticEnabled(profile))) continue;
+      const state = await (options.readStatus ?? readAgentRuntimeStatus)(profile);
+      if (state.running) continue;
+      // The run-local journal decides whether any interrupted work can safely resume.
+      await (options.start ?? agentStartMain)(["--profile", entry.name, "--background", "--json"], {
+        env,
+        automatic: true,
+        stdout: { write() {} },
+      });
+      results.push(entry.name);
+    } catch {
+      /* One offline/revoked connection cannot stop other profiles. */
+    }
+  }
+  return results;
+}
+export async function automaticRuntimeMain(env = process.env, options = {}) {
+  const directory = join(runtimeRoot(env), "runtime");
+  await privateDirectory(directory);
+  const lock = join(directory, "supervisor.lock");
+  await import("node:fs/promises").then(async ({ mkdir }) => {
+    try {
+      await mkdir(lock, { mode: 0o700 });
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const current = await privateRead(join(lock, "owner.json")).catch(() => null);
+      if (!current || !Number.isInteger(current.pid))
+        throw new Error("Another supervisor is starting. Wait before retrying.");
+      try {
+        process.kill(current.pid, 0);
+        throw new Error("The Totem supervisor is already running.");
+      } catch (failure) {
+        if (failure.code !== "ESRCH") throw failure;
+      }
+      await rm(lock, { recursive: true });
+      await mkdir(lock, { mode: 0o700 });
+    }
+  });
+  await privateWrite(join(lock, "owner.json"), { pid: process.pid });
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  process.once("SIGTERM", stop);
+  process.once("SIGINT", stop);
+  try {
+    while (!controller.signal.aborted && !options.signal?.aborted) {
+      let environment = { ...env };
+      try {
+        environment = {
+          ...environment,
+          ...(await privateRead(join(directory, "environment.json"))),
+        };
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      try {
+        environment = {
+          ...environment,
+          ...(await privateRead(join(directory, "provider-environment.json"))),
+        };
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+
+      await privateWrite(join(directory, "supervisor.json"), {
+        pid: process.pid,
+        updatedAt: new Date().toISOString(),
+      });
+      await superviseOnce(environment, options);
+      await sleep(options.intervalMs ?? 5000, undefined, {
+        signal: options.signal
+          ? AbortSignal.any([controller.signal, options.signal])
+          : controller.signal,
+      }).catch(() => {});
+    }
+  } finally {
+    process.removeListener("SIGTERM", stop);
+    process.removeListener("SIGINT", stop);
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+if (
+  process.argv[1] === fileURLToPath(import.meta.url) ||
+  process.argv[1]?.endsWith("/runtime/supervisor.mjs") ||
+  process.argv[1]?.endsWith("\\runtime\\supervisor.mjs")
+) {
+  await automaticRuntimeMain().catch(() => {
+    process.exitCode = 1;
+  });
+}

package/bin/cloud-bootstrap.mjs

@@ -0,0 +1,64 @@
+import { agentSetupMain, agentStatusMain } from "./agent-setup.mjs";
+import { agentStartMain } from "./agent-runner.mjs";
+import { installationMain } from "./installation.mjs";
+
+/** Run from the cloud environment's startup command; secrets stay in its store. */
+export async function cloudBootstrapMain(args = [], options = {}) {
+  const env = options.env ?? process.env;
+  const output = options.stdout ?? process.stdout;
+  if (args.includes("--help")) {
+    output.write(
+      "totem cloud setup [--provider codex|claude|qwen-local|command|http] [--repo-root <checkout>] [--install-mcp]\nProvision TOTEM_NETWORK_API_KEY or TOTEM_NETWORK_API_KEY_FILE and TOTEM_AGENT_ID in the environment secret/settings store. The setup command verifies the exact identity, saves a private profile, and starts its message and Mission worker.\n",
+    );
+    return 0;
+  }
+  if (!env.TOTEM_NETWORK_API_KEY && !env.TOTEM_NETWORK_API_KEY_FILE) {
+    const loginArgs = ["--no-browser"];
+    const selected = args.indexOf("--provider");
+    if (selected >= 0 && args[selected + 1]) loginArgs.push("--provider", args[selected + 1]);
+    if (args.includes("--json")) loginArgs.push("--json");
+    return installationMain(loginArgs, options);
+  }
+  const profile = env.TOTEM_AGENT_ID ?? "default";
+  const setup = [
+    "--profile",
+    profile,
+    ...(env.TOTEM_AGENT_ID ? ["--agent-id", env.TOTEM_AGENT_ID] : []),
+    "--base-url",
+    env.TOTEM_BASE_URL ?? "https://totemlayer.com",
+    "--json",
+    ...args,
+  ];
+
+  if (await agentSetupMain(setup, options)) return 1;
+  let readiness;
+  const probe = {
+    ...options,
+    stdout: {
+      write(value) {
+        output.write(value);
+        try {
+          readiness = JSON.parse(value);
+        } catch {
+          /* Only status JSON is inspected. */
+        }
+      },
+    },
+  };
+  if (await agentStatusMain(["--profile", profile, "--json"], probe)) return 1;
+  if (readiness?.checks?.model?.state !== "available") {
+    output.write(
+      JSON.stringify({
+        ok: false,
+        error: {
+          code: "CLOUD_EXECUTOR_UNAVAILABLE",
+          message:
+            "The cloud connection is saved, but its selected executor is unavailable. Install and authenticate that executor before startup.",
+        },
+      }) + "\n",
+    );
+    return 1;
+  }
+  if (await agentStartMain(["--profile", profile, "--background", "--json"], options)) return 1;
+  return agentStatusMain(["--profile", profile, "--json"], options);
+}

package/bin/connected-agent-service.mjs

@@ -0,0 +1,84 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { runMissionAgentService } from "./mission-agent-service.mjs";
+import { runRuntime } from "./network-runtime.mjs";
+
+// Both queues use the same verified identity and private profile. A stopped or
+// revoked connection cancels both consumers; Missions retains its own leases.
+export async function runConnectedAgentService(settings, dependencies = {}) {
+  const controller = new AbortController();
+  const signal = settings.signal
+    ? AbortSignal.any([settings.signal, controller.signal])
+    : controller.signal;
+  const emit = settings.emit ?? (() => {});
+  const phases = { messages: "starting", missions: "starting" };
+  const report = (queue, event) => {
+    phases[queue] = event.type === "completed" ? "waiting" : event.type;
+    const values = Object.values(phases);
+    const type =
+      ["reconnecting", "starting", "blocked", "working"].find((phase) => values.includes(phase)) ??
+      "waiting";
+    emit({ ...event, type });
+  };
+  const messages = async () => {
+    let attempts = 0;
+    while (!signal.aborted) {
+      try {
+        await (dependencies.runRuntime ?? runRuntime)({
+          ...settings,
+          signal,
+          stateDir: settings.stateDirectory,
+          allowAgents: [],
+          modelTimeoutMs: 900000,
+          replyTimeoutMs: 90000,
+          pollMs: settings.pollMs ?? 5000,
+          emit(event) {
+            if (event.type === "runtime_started") {
+              attempts = 0;
+              report("messages", { type: "waiting" });
+            } else if (event.type === "runtime_error")
+              report("messages", { type: "blocked", code: event.error?.code });
+            else if (["message_handled", "chat_completed"].includes(event.type))
+              report("messages", { type: "waiting" });
+          },
+        });
+        if (!signal.aborted) throw new Error("The message runtime stopped unexpectedly.");
+      } catch (error) {
+        if (signal.aborted) return;
+        if (
+          error.status === 401 ||
+          error.status === 403 ||
+          error.code === "AGENT_IDENTITY_MISMATCH"
+        )
+          throw error;
+        report("messages", { type: "reconnecting" });
+        await sleep(
+          error.status === 429 ? 30000 : Math.min(30000, 1000 * 2 ** Math.min(attempts++, 5)),
+          undefined,
+          { signal },
+        );
+      }
+    }
+  };
+  const guarded = async (run) => {
+    try {
+      await run();
+    } catch (error) {
+      if (!signal.aborted) {
+        controller.abort();
+        throw error;
+      }
+    }
+  };
+  const results = await Promise.allSettled([
+    guarded(messages),
+    guarded(() =>
+      (dependencies.runMissions ?? runMissionAgentService)({
+        ...settings,
+        signal,
+        emit: (event) => report("missions", event),
+      }),
+    ),
+  ]);
+  const failure = results.find((result) => result.status === "rejected");
+  if (failure) throw failure.reason;
+}

package/bin/device-login.mjs

@@ -0,0 +1,168 @@
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { privateRead, privateWrite } from "./runtime-installation.mjs";
+import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
+
+function origin(value) {
+  const url = new URL(value ?? "https://totemlayer.com");
+  if (
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname !== "/" ||
+    (url.protocol !== "https:" &&
+      !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+  )
+    throw new Error("Choose an HTTPS Totem origin or local development origin.");
+  return url.origin;
+}
+async function request(baseUrl, path, options = {}, fetcher = fetch) {
+  const response = await fetcher(baseUrl + path, {
+    ...options,
+    redirect: "error",
+    signal: AbortSignal.timeout(15000),
+  });
+  const result = await response.json();
+  if (!response.ok && response.status !== 410)
+    throw new Error("Totem could not complete this installation request.");
+  return result;
+}
+export async function beginDeviceLogin(runtime, env = process.env, options = {}) {
+  const baseUrl = origin(env.TOTEM_BASE_URL);
+  let pending;
+  try {
+    pending = await privateRead(join(runtime.directory, "connection-request.json"));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (
+    !pending ||
+    pending.baseUrl !== baseUrl ||
+    pending.requestedAgentId !== env.TOTEM_AGENT_ID ||
+    pending.provider !== (env.TOTEM_PROVIDER ?? "auto") ||
+    new Date(pending.expiresAt) <= new Date()
+  ) {
+    const result = await request(
+      baseUrl,
+      "/api/installations",
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          deviceName: hostname().slice(0, 100),
+          provider: env.TOTEM_PROVIDER ?? "auto",
+          ...(env.TOTEM_AGENT_ID ? { agentId: env.TOTEM_AGENT_ID } : {}),
+        }),
+      },
+      options.fetch,
+    );
+    if (
+      !/^[a-f0-9-]{36}$/.test(result.id) ||
+      !/^[A-Za-z0-9_-]{43}$/.test(result.token) ||
+      !/^[A-Z2-9]{12}$/.test(result.code) ||
+      !Number.isFinite(Date.parse(result.expiresAt))
+    )
+      throw new Error("Totem returned an invalid installation request.");
+    pending = {
+      ...result,
+      baseUrl,
+      requestedAgentId: env.TOTEM_AGENT_ID,
+      provider: env.TOTEM_PROVIDER ?? "auto",
+    };
+    await privateWrite(join(runtime.directory, "connection-request.json"), pending);
+  }
+  const url = `${baseUrl}/connect?code=${pending.code}`;
+  if (options.openBrowser !== false) {
+    const command =
+      process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+          ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]]
+          : ["xdg-open", [url]];
+    await (options.execute ?? promisify(execFile))(command[0], command[1], { timeout: 5000 }).catch(
+      () => {},
+    );
+  }
+  return { url, code: pending.code, expiresAt: pending.expiresAt };
+}
+
+export async function resumeDeviceLogin(runtime, env = process.env, options = {}) {
+  let staged;
+  try {
+    staged = await privateRead(join(runtime.directory, "connection-ready.json"));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (!staged) {
+    let pending;
+    try {
+      pending = await privateRead(join(runtime.directory, "connection-request.json"));
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+
+    const result = await request(
+      origin(pending.baseUrl),
+      `/api/installations/${pending.id}`,
+      { headers: { "x-totem-installation-token": pending.token } },
+      options.fetch,
+    );
+    if (result.status !== "approved") return;
+    if (
+      !/^[a-f0-9-]{36}$/.test(result.agentId) ||
+      !/^tn_(?:test|live)_[A-Za-z0-9_-]{43}$/.test(result.key)
+    )
+      throw new Error("Totem returned an invalid connection.");
+    staged = {
+      agentId: result.agentId,
+      key: result.key,
+      baseUrl: pending.baseUrl,
+      requestId: pending.id,
+      token: pending.token,
+    };
+    // Persist privately before acknowledging, so an interrupted setup never loses the key.
+    await privateWrite(join(runtime.directory, "connection-ready.json"), staged);
+  }
+  if (staged.requestId) {
+    const receipt = await request(
+      staged.baseUrl,
+      `/api/installations/${staged.requestId}`,
+      { method: "POST", headers: { "x-totem-installation-token": staged.token } },
+      options.fetch,
+    );
+    if (receipt.status !== "completed")
+      throw new Error("This connection expired before it was saved. Run totem login again.");
+    delete staged.requestId;
+    delete staged.token;
+    await privateWrite(join(runtime.directory, "connection-ready.json"), staged);
+  }
+  const provider = await (options.detectProvider ?? detectInstalledProvider)(env);
+  if (!provider) return { state: "executor_needed" };
+  const { agentSetupMain } = await import("./agent-setup.mjs");
+  const status = await (options.setup ?? agentSetupMain)(
+    [
+      "--profile",
+      staged.agentId ?? "default",
+      ...(staged.agentId ? ["--agent-id", staged.agentId] : []),
+      "--base-url",
+      origin(staged.baseUrl),
+      ...(await providerArguments(provider, env)),
+      "--no-start",
+      "--json",
+    ],
+    {
+      env: { ...env, TOTEM_NETWORK_API_KEY: staged.key },
+      stdout: { write() {} },
+      stderr: { write() {} },
+    },
+  );
+  if (status) throw new Error("The approved connection could not be saved.");
+  const { rm } = await import("node:fs/promises");
+  await rm(join(runtime.directory, "connection-ready.json"));
+  await rm(join(runtime.directory, "connection-request.json"), { force: true });
+  return { state: "connected", profile: staged.agentId };
+}

package/bin/installation.mjs

@@ -0,0 +1,160 @@
+import { parseArgs } from "node:util";
+import { readFile, stat } from "node:fs/promises";
+import { privateRead, privateWrite } from "./runtime-installation.mjs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ensureInstalledRuntime, installRuntimeService } from "./runtime-installation.mjs";
+import { beginDeviceLogin } from "./device-login.mjs";
+import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
+
+export async function activateConnection(profile, env = process.env, options = {}) {
+  const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(env);
+  const { automaticEnabled, setAutomaticEnabled } = await import("./automatic-runtime.mjs");
+  const enabled = await automaticEnabled(profile);
+  if (enabled) await setAutomaticEnabled(profile, true);
+  const service = await (options.installService ?? installRuntimeService)(runtime, {
+    ...env,
+    ...(profile.agentTokenEnv ? { TOTEM_AGENT_TOKEN_ENV: profile.agentTokenEnv } : {}),
+  });
+  if (!enabled) return { state: "paused", ...service, entry: runtime.cli };
+  const { agentStartMain } = await import("./agent-runner.mjs");
+  await (options.start ?? agentStartMain)(
+    ["--profile", profile.profileName, "--background", "--json"],
+    { env, automatic: true, stdout: { write() {} } },
+  );
+  return { state: "running", ...service, entry: runtime.cli };
+}
+
+export async function installationMain(args = [], options = {}) {
+  const env = options.env ?? process.env;
+  const stdout = options.stdout ?? process.stdout;
+  const flags = parseArgs({
+    args,
+    strict: true,
+    options: {
+      provider: { type: "string" },
+      "agent-id": { type: "string" },
+      "base-url": { type: "string" },
+      "no-browser": { type: "boolean" },
+      help: { type: "boolean", short: "h" },
+      json: { type: "boolean" },
+    },
+  }).values;
+  if (flags.help) {
+    stdout.write(
+      "totem login [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser]\nConnect this installation once. Totem securely saves its connection and automatically runs and restarts the listener.\n",
+    );
+    return 0;
+  }
+  const environment = {
+    ...env,
+    ...(flags.provider ? { TOTEM_PROVIDER: flags.provider } : {}),
+    ...(flags["agent-id"] ? { TOTEM_AGENT_ID: flags["agent-id"] } : {}),
+    ...(flags["base-url"] ? { TOTEM_BASE_URL: flags["base-url"] } : {}),
+  };
+  const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(environment);
+  const service = await (options.installService ?? installRuntimeService)(runtime, environment);
+  if (environment.TOTEM_NETWORK_API_KEY || environment.TOTEM_NETWORK_API_KEY_FILE) {
+    const provider = await (options.detectProvider ?? detectInstalledProvider)(environment);
+    if (!provider) {
+      let key = environment.TOTEM_NETWORK_API_KEY;
+      if (!key && environment.TOTEM_NETWORK_API_KEY_FILE) {
+        const info = await stat(environment.TOTEM_NETWORK_API_KEY_FILE);
+        if (
+          !info.isFile() ||
+          info.size > 8192 ||
+          (process.platform !== "win32" && info.mode & 0o077)
+        )
+          throw new Error("Use a private connection key file.");
+        key = (await readFile(environment.TOTEM_NETWORK_API_KEY_FILE, "utf8")).trim();
+      }
+      if (!/^tn_(?:test|live)_[A-Za-z0-9_-]{43}$/.test(key ?? ""))
+        throw new Error("The connection key is invalid.");
+      await privateWrite(join(runtime.directory, "connection-ready.json"), {
+        key,
+        baseUrl: environment.TOTEM_BASE_URL ?? "https://totemlayer.com",
+        agentId: environment.TOTEM_AGENT_ID,
+      });
+      stdout.write(
+        "Totem's automatic runtime is installed. Install/sign in to your AI client, then run totem login again.\n",
+      );
+      return 1;
+    }
+    const { agentSetupMain } = await import("./agent-setup.mjs");
+    return agentSetupMain(
+      [
+        "--profile",
+        environment.TOTEM_AGENT_ID ?? "default",
+        ...(environment.TOTEM_AGENT_ID ? ["--agent-id", environment.TOTEM_AGENT_ID] : []),
+        ...(await providerArguments(provider, environment)),
+        ...(flags.json ? ["--json"] : []),
+      ],
+      {
+        ...options,
+        env: environment,
+        activateConnection: options.activateConnection ?? activateConnection,
+      },
+    );
+  }
+  try {
+    await privateRead(join(runtime.directory, "connection-ready.json"));
+    stdout.write(
+      "Your Totem connection is saved privately. Sign in to your AI client; the listener connects automatically.\n",
+    );
+    return 0;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  // An upgrade reuses private profiles and starts their existing connections.
+  const { opendir } = await import("node:fs/promises");
+  let saved = false;
+  try {
+    const profiles = await opendir(join(runtime.root, "connections"));
+    for await (const entry of profiles)
+      if (
+        entry.isDirectory() &&
+        (!environment.TOTEM_AGENT_ID || entry.name === environment.TOTEM_AGENT_ID)
+      )
+        saved = true;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (saved && options.forceLogin !== true) {
+    const report = { installed: true, connection: "saved", automatic: true, service };
+    stdout.write(
+      flags.json
+        ? JSON.stringify(report) + "\n"
+        : "Totem's automatic listener is installed and reuses your saved connections.\n",
+    );
+    return 0;
+  }
+  const connection = await (options.beginLogin ?? beginDeviceLogin)(runtime, environment, {
+    openBrowser: !flags["no-browser"] && environment.TOTEM_NO_BROWSER !== "1",
+  });
+  const report = {
+    installed: true,
+    connection: "sign_in_required",
+    automatic: true,
+    service,
+    ...connection,
+  };
+  stdout.write(
+    flags.json
+      ? JSON.stringify(report) + "\n"
+      : `Totem is installed. Connect your agent once at:\n${connection.url}\nConnection code: ${connection.code.match(/.{1,4}/g).join(" ")}\nThe listener starts automatically after you connect.\n`,
+  );
+  return 0;
+}
+export async function postinstallMain(env = process.env) {
+  if (env.TOTEM_AUTO_START === "0" || env.CI) return 0;
+  try {
+    return await installationMain([], { env });
+  } catch {
+    process.stdout.write(
+      "Totem is installed. Automatic connection setup needs attention; run totem login to finish it.\n",
+    );
+    return 0;
+  }
+}
+if (process.argv[1] === fileURLToPath(import.meta.url) && process.argv[2] === "--postinstall")
+  await postinstallMain();