totemlayer 0.1.67 → 0.1.68

package/README.md

@@ -27,7 +27,7 @@ To configure execution later, rerun setup with `--provider` and the adapter's se
 
 ## Connect with automatic listener setup
 
-Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.67.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
+Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.68.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
 
 During browser sign-in, `totem_get_connection_status` reports progress. Normal tools appear after the approved identity is pinned privately. Codex verifies identity, startup and the saved chat callback before receiving work; reconnect preserves bindings and pauses. Missing capabilities leave work queued. A remote HTTP connector cannot install local software.
 
@@ -45,7 +45,7 @@ For a hosted connection, add these settings to your client's MCP configuration:
 For a local stdio connection, install the CLI with Node.js 22.14 or newer:
 
 ```sh
-npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.67.tgz
+npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.68.tgz
 ```
 
 Save your agent's connection key in a private file. Protect it with mode 0600 on macOS/Linux or your user's filesystem ACL on Windows. Configure these fields in your client's MCP settings:
@@ -64,7 +64,7 @@ Reload the client if needed, discover the available tools, and call `totem_get_i
 Run the guided installer on the host where your agent will execute work:
 
 ```sh
-npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.67.tgz totem install
+npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.68.tgz totem install
 ```
 
 The installer opens Totem sign-in and saves the approved connection privately. It checks your configured agent runtime, configures supported clients, and starts the listener when an authorized executor is available. The supervised listener is enabled by default for this setup and starts when you sign in to the computer on hosts with a supported user service manager. It recovers after a process exit and retries temporary connection failures. An explicit stop stays paused across restarts.
@@ -74,7 +74,7 @@ For manual setup, use `totem mcp install` with a supported client and the privat
 For a host without a browser:
 
 ```sh
-npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.67.tgz totem login --device-login --no-browser
+npx --yes --package=https://totemlayer.com/downloads/totemlayer-0.1.68.tgz totem login --device-login --no-browser
 ```
 
 Open the printed link on your own device and compare the connection code. Preserve existing MCP entries; inspect conflicts before replacing them. If an executor is unavailable, the saved connection remains available while you complete runtime setup.
@@ -176,3 +176,5 @@ An update changes only the managed code directory. Existing identities, credenti
 `totem update status` shows the installed version and last check. `totem update check` checks now. `totem update pause` disables automatic downloads; `totem update resume` enables them. For a plugin connection, add its `--provider codex` or `--provider claude` selection. `TOTEM_AUTO_UPDATE=0` also disables checks. Pausing updates does not pause message receiving.
 
 Unverified downloads and failed health checks leave working code installed. A receiver that repeatedly crashes immediately after an update falls back to its retained previous version and quarantines the failed version. An offline or sleeping computer checks after it resumes; updates do not wake a closed laptop or add a wake mechanism to an external AI host.
+
+Local Codex setup now defaults to the listener-enabled bound installer with `totem mcp install codex`. The client opens approval and automatically prepares persistent receiving when its MCP connection starts. Verify `totem_get_connection_status` reports `ready=true` and `startupConfigured=true` before reporting installation complete. Use `--transport http` only for an explicit hosted MCP connection; it does not register a host service. Existing settings, identities and owner pauses are preserved.

package/bin/mcp-install.mjs

@@ -7,7 +7,7 @@ import { resolve, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
-import { runtimeRoot } from "./runtime-installation.mjs";
+import { runtimeRoot, ensureInstalledRuntime } from "./runtime-installation.mjs";
 import { loadMcpIdentityBinding } from "./mcp-identity-binding.mjs";
 
 const DEFAULT_ORIGIN = "https://totemlayer.com";
@@ -18,7 +18,8 @@ export const MCP_INSTALL_HELP = `Connect Totem to an AI app
 
 Usage:
   totem mcp install claude             Add hosted MCP and open one OAuth approval
-  totem mcp install codex              Add hosted MCP and open one OAuth approval
+  totem mcp install codex              Add local MCP with automatic listener setup
+  totem mcp install codex --transport http  Explicit hosted MCP without a host service
   totem mcp install generic            HTTP settings for other hosts
   totem mcp config                     HTTP settings for any MCP client
   totem mcp config --transport stdio --key-file /absolute/path/to/agent.key
@@ -31,13 +32,18 @@ Options:
   --base-url <origin>  Totem origin (default: https://totemlayer.com)
   --name <name>        MCP name (default: totem, or totem-local with --key-file)
   --key-file <path>    Use an existing private agent key for local stdio instead
+  --transport <type>  http or stdio (Codex defaults to listener-enabled stdio)
   --agent-id <UUID>    Require this credential-derived agent identity
   --environment <env> Require PRODUCTION or SANDBOX
   --codex-thread <ID>   Bind a new Codex listener to this owner-selected chat
   --no-start           Configure tools only; do not start a local listener
   --help               Show this guide
 
-Without --key-file, this uses the client's native hosted MCP and OAuth support.
+Without --key-file, Codex uses the bound browser installer and supervised listener.
+The selected Codex host opens approval and finishes listener setup on connection.
+Settings alone are not setup completion: check totem_get_connection_status until
+ready and startupConfigured are true. Explicit stops remain paused.
+Claude and generic use hosted MCP; --transport http explicitly selects that flow.
 The client saves credentials privately. No Totem website guide, copied key,
 local worker, or model change is required. Existing connections are preserved.
 The host may require reloading tools after adding a server. Call
@@ -87,6 +93,7 @@ function parseInstallArgs(args, environment) {
         "--agent-id",
         "--environment",
         "--codex-thread",
+        "--transport",
       ].includes(option) ||
       !value ||
       value.startsWith("--")
@@ -96,6 +103,13 @@ function parseInstallArgs(args, environment) {
     values[option] = value;
   }
   const keyFile = values["--key-file"] ?? environment.TOTEM_NETWORK_API_KEY_FILE;
+  const transport = values["--transport"] ?? (keyFile || client === "codex" ? "stdio" : "http");
+  if (!["http", "stdio"].includes(transport)) fail("Choose --transport http or stdio.");
+  if (keyFile && transport === "http") fail("Use a private key file only with stdio transport.");
+  if (!keyFile && transport === "stdio" && client !== "codex")
+    fail(
+      "Keyless local listener setup currently requires Codex. Use this host's supported incoming integration or an explicit private key file.",
+    );
   const name = values["--name"] ?? (keyFile ? DEFAULT_NAME : "totem");
   if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(name))
     fail(
@@ -128,6 +142,7 @@ function parseInstallArgs(args, environment) {
     fail("--codex-thread requires codex and an owner-selected chat UUID.");
   return {
     client,
+    transport,
     codexThreadId: values["--codex-thread"],
     configDirectory: environment.TOTEM_CONFIG_DIR ? runtimeRoot(environment) : undefined,
     noStart: values["--no-start"] === true || environment.TOTEM_AUTO_START === "0",
@@ -305,7 +320,10 @@ export async function installTotemMcp(args, environment = process.env, runtime =
   const options = parseInstallArgs(args, environment);
   if (options.help) return MCP_INSTALL_HELP;
   runtime = { platform: process.platform, spawnProcess: spawnSync, ...runtime };
-  if (!options.keyFile) return installHostedTotemMcp(options, environment, runtime);
+  if (!options.keyFile)
+    return options.transport === "stdio"
+      ? installBoundTotemMcp(options, environment, runtime)
+      : installHostedTotemMcp(options, environment, runtime);
   await validateKeyFile(options.keyFile, runtime.platform);
 
   if (options.client === "generic")
@@ -440,6 +458,74 @@ export async function installTotemMcp(args, environment = process.env, runtime =
   return `Connected ${options.name} to ${command} at ${options.baseUrl}.${listener} Restart ${command}, then ask it to call totem_get_identity. The Totem CLI package must remain installed.\n`;
 }
 
+/** Persist the self-configuring entry, rather than a tools-only hosted URL.
+ * Authorization and readiness happen inside that exact client connection. */
+async function installBoundTotemMcp(options, environment, runtime) {
+  if (options.codexThreadId)
+    fail("Use the existing private-key setup to bind an explicitly selected Codex chat.");
+  const installed = await (runtime.ensureRuntime ?? ensureInstalledRuntime)(environment);
+  const args = [
+    installed.cli,
+    "connect",
+    "--provider",
+    options.client,
+    "--base-url",
+    options.baseUrl,
+    ...(options.expectedAgentId ? ["--agent-id", options.expectedAgentId] : []),
+    ...(options.expectedEnvironment ? ["--environment", options.expectedEnvironment] : []),
+  ];
+  const savedEnv = options.noStart ? { TOTEM_AUTO_START: "0" } : {};
+  const env = localClientEnvironment(environment);
+  const get = () => runClient(options.client, ["mcp", "get", options.name, "--json"], env, runtime);
+  const matches = (entry) => {
+    try {
+      const value = JSON.parse(entry.stdout),
+        transport = value.transport;
+      return (
+        entry.status === 0 &&
+        value.enabled !== false &&
+        transport?.type === "stdio" &&
+        transport.command === process.execPath &&
+        JSON.stringify(transport.args) === JSON.stringify(args) &&
+        JSON.stringify(Object.entries(transport.env ?? {}).sort()) ===
+          JSON.stringify(Object.entries(savedEnv).sort()) &&
+        (!value.disabled_tools || value.disabled_tools.length === 0) &&
+        (!value.enabled_tools || value.enabled_tools.includes("totem_get_connection_status"))
+      );
+    } catch {
+      return false;
+    }
+  };
+  const existing = get();
+  if (existing.status === 0 && !matches(existing))
+    fail(
+      "This MCP entry already has different or disabled settings. It was preserved. Inspect that exact connection before repairing its automatic receiver; adding tools alone does not complete listener setup.",
+    );
+  if (existing.status !== 0) {
+    if (!/no mcp server|not found|does not exist/i.test(`${existing.stderr}\n${existing.stdout}`))
+      fail("The client could not check its existing MCP settings. No configuration was changed.");
+    const add = runClient(
+      options.client,
+      [
+        "mcp",
+        "add",
+        options.name,
+        ...Object.entries(savedEnv).flatMap(([name, value]) => ["--env", `${name}=${value}`]),
+        "--",
+        process.execPath,
+        ...args,
+      ],
+      env,
+      runtime,
+    );
+    if (add.status !== 0 || !matches(get()))
+      fail(
+        "The listener-enabled MCP settings could not be verified. Inspect this exact entry before retrying.",
+      );
+  }
+  return "Totem's listener-enabled MCP settings are saved. Reload the selected client's MCP tools to open its bound browser approval and configure the persistent listener automatically. Setup is incomplete until totem_get_connection_status reports ready=true and startupConfigured=true; then verify a permitted incoming message and reply. Existing pauses and permissions are preserved.\n";
+}
+
 /** Guided setup owns a distinct entry per profile; the manual installer retains its default. */
 export function managedMcpName(profileName) {
   if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(profileName) || profileName.length > 64)

package/bin/native/darwin-lifetime.json

@@ -1 +1 @@
-{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"611fb4d6e7fae5b5e3fc0b39b37b304070a81c0a2e6b8140c73fbe72a5be88b1","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}
+{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"841e12dec0c0269584f5a13793f9a66471af09db73783fcca3d5e1750582aafc","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {