typeclaw 0.36.7 → 0.37.0

package/src/tunnels/providers/cloudflare-quick.ts

@@ -3,12 +3,14 @@ import type { Unsubscribe } from '@/stream'
 import { createLogRing, type LogLineSubscriber, type LogRing } from '../log-ring'
 import { extractQuickTunnelUrl } from '../quick-url-parser'
 import type { TunnelConfig, TunnelProviderHandle, TunnelState } from '../types'
+import { isUpstreamReachable, type UpstreamProbe } from '../upstream-probe'
 import { isBinaryNotFound, MISSING_BINARY_DETAIL } from './cloudflared-binary'
 
 const DEFAULT_BINARY = 'cloudflared'
 const DEFAULT_RESTART_BACKOFF_MS = [1_000, 2_000, 4_000, 10_000, 30_000]
 const DEFAULT_MAX_FAILURES_WITHOUT_URL = 10
 const DEFAULT_STOP_GRACE_MS = 5_000
+const DEFAULT_UPSTREAM_RECHECK_MS = 2_000
 
 export type CloudflareQuickProviderOptions = {
   config: TunnelConfig
@@ -18,6 +20,8 @@ export type CloudflareQuickProviderOptions = {
   restartBackoffMs?: number[]
   maxConsecutiveFailuresWithoutUrl?: number
   stopGraceMs?: number
+  probeUpstream?: UpstreamProbe
+  upstreamRecheckMs?: number
 }
 
 export type CloudflareQuickProviderHandle = TunnelProviderHandle & {
@@ -38,6 +42,8 @@ export function createCloudflareQuickProvider(options: CloudflareQuickProviderOp
   const restartBackoffMs = options.restartBackoffMs ?? DEFAULT_RESTART_BACKOFF_MS
   const maxConsecutiveFailuresWithoutUrl = options.maxConsecutiveFailuresWithoutUrl ?? DEFAULT_MAX_FAILURES_WITHOUT_URL
   const stopGraceMs = options.stopGraceMs ?? DEFAULT_STOP_GRACE_MS
+  const probeUpstream = options.probeUpstream ?? isUpstreamReachable
+  const upstreamRecheckMs = options.upstreamRecheckMs ?? DEFAULT_UPSTREAM_RECHECK_MS
   const logs = createLogRing()
   const state: TunnelState = {
     name: config.name,
@@ -53,12 +59,65 @@ export function createCloudflareQuickProvider(options: CloudflareQuickProviderOp
   let stopping = false
   let proc: ReturnType<typeof Bun.spawn> | null = null
   let retryTimer: ReturnType<typeof setTimeout> | null = null
+  let recheckTimer: ReturnType<typeof setTimeout> | null = null
   let restartFailuresWithoutUrl = 0
   let attemptEmittedUrl = false
+  let broadcastedUrl: string | null = null
+  // Identifies the current live cloudflared attempt. Bumped on every launch, on
+  // process exit, and on stop. A probe captures the generation it was started
+  // under; if the process exits (into restart backoff) or the tunnel is stopped
+  // while a probe is in flight, the resolved probe sees a stale generation and
+  // bails — so it can never mark a dead process's tunnel healthy.
+  let launchGeneration = 0
+
+  function clearRecheckTimer(): void {
+    if (recheckTimer !== null) {
+      clearTimeout(recheckTimer)
+      recheckTimer = null
+    }
+  }
+
+  // cloudflared emits the URL once, but the upstream service may still be
+  // booting. We broadcast the URL immediately (channel adapters need it) yet
+  // gate `healthy` on a real upstream probe, re-checking on an interval so the
+  // status flips to healthy the moment the service comes up — and surfaces a
+  // 502-explaining detail until then.
+  async function onQuickUrl(url: string, generation: number): Promise<void> {
+    if (generation !== launchGeneration) return
+    attemptEmittedUrl = true
+    restartFailuresWithoutUrl = 0
+    state.url = url
+    state.lastUrlAt = Date.now()
+    if (broadcastedUrl !== url) {
+      broadcastedUrl = url
+      onUrlChange(url)
+    }
+    await reprobeUpstream(generation)
+  }
+
+  async function reprobeUpstream(generation: number): Promise<void> {
+    if (generation !== launchGeneration || !started || stopping || state.url === null) return
+    const reachable = await probeUpstream(upstreamPort)
+    if (generation !== launchGeneration || !started || stopping || state.url === null) return
+    if (reachable) {
+      state.status = 'healthy'
+      state.detail = 'quick tunnel URL emitted; upstream reachable'
+      clearRecheckTimer()
+      return
+    }
+    state.status = 'unhealthy'
+    state.detail = `quick tunnel URL emitted but upstream 127.0.0.1:${upstreamPort} is not reachable (requests will 502)`
+    clearRecheckTimer()
+    recheckTimer = setTimeout(() => {
+      recheckTimer = null
+      void reprobeUpstream(generation)
+    }, upstreamRecheckMs)
+  }
 
   async function launch(): Promise<void> {
     if (!started || stopping) return
 
+    const generation = ++launchGeneration
     attemptEmittedUrl = false
     state.status = 'starting'
     state.detail = 'starting cloudflared'
@@ -81,13 +140,7 @@ export function createCloudflareQuickProvider(options: CloudflareQuickProviderOp
     void pumpStderr(spawned.stderr, logs, (line) => {
       const url = extractQuickTunnelUrl(line)
       if (url === null) return
-      attemptEmittedUrl = true
-      restartFailuresWithoutUrl = 0
-      state.url = url
-      state.status = 'healthy'
-      state.lastUrlAt = Date.now()
-      state.detail = 'quick tunnel URL emitted'
-      onUrlChange(url)
+      void onQuickUrl(url, generation)
     })
 
     void spawned.exited.then((code) => {
@@ -99,6 +152,8 @@ export function createCloudflareQuickProvider(options: CloudflareQuickProviderOp
   }
 
   function handleExit(code: number): void {
+    launchGeneration += 1
+    clearRecheckTimer()
     if (!attemptEmittedUrl) restartFailuresWithoutUrl += 1
     if (restartFailuresWithoutUrl >= maxConsecutiveFailuresWithoutUrl) {
       state.status = 'permanently-failed'
@@ -127,6 +182,9 @@ export function createCloudflareQuickProvider(options: CloudflareQuickProviderOp
       if (!started && proc === null) return
       started = false
       stopping = true
+      broadcastedUrl = null
+      launchGeneration += 1
+      clearRecheckTimer()
       if (retryTimer !== null) {
         clearTimeout(retryTimer)
         retryTimer = null

package/src/tunnels/upstream-probe.ts

@@ -0,0 +1,25 @@
+import { createConnection } from 'node:net'
+
+// cloudflared allocates a public quick-tunnel URL even when nothing is
+// listening upstream, so a "healthy" tunnel can still 502 every request. We
+// probe the upstream ourselves before claiming health; refused connections,
+// timeouts, and socket errors all count as unreachable.
+export async function isUpstreamReachable(port: number, timeoutMs = 1_000): Promise<boolean> {
+  return new Promise((resolve) => {
+    let settled = false
+    const finish = (reachable: boolean): void => {
+      if (settled) return
+      settled = true
+      socket.destroy()
+      resolve(reachable)
+    }
+
+    const socket = createConnection({ host: '127.0.0.1', port })
+    socket.setTimeout(timeoutMs)
+    socket.once('connect', () => finish(true))
+    socket.once('timeout', () => finish(false))
+    socket.once('error', () => finish(false))
+  })
+}
+
+export type UpstreamProbe = (port: number) => Promise<boolean>

package/typeclaw.schema.json

@@ -20,84 +20,158 @@
       "additionalProperties": {
         "anyOf": [
           {
-            "type": "string",
-            "enum": [
-              "openai/gpt-5.4-nano",
-              "openai/gpt-5.4-mini",
-              "openai/gpt-5.4",
-              "openai/gpt-5.5",
-              "openai-codex/gpt-5.4-mini",
-              "openai-codex/gpt-5.4",
-              "openai-codex/gpt-5.5",
-              "anthropic/claude-haiku-4-5",
-              "anthropic/claude-sonnet-4-6",
-              "anthropic/claude-opus-4-7",
-              "anthropic/claude-opus-4-8",
-              "fireworks/accounts/fireworks/routers/kimi-k2p6-turbo",
-              "zai/glm-4.5-air",
-              "zai/glm-4.6",
-              "zai/glm-4.7",
-              "zai-coding/glm-4.5-air",
-              "zai-coding/glm-4.7",
-              "zai-coding/glm-5",
-              "zai-coding/glm-5-turbo",
-              "zai-coding/glm-5.1",
-              "xai/grok-4.3",
-              "xai/grok-4.20-0309-reasoning",
-              "xai/grok-4.20-0309-non-reasoning",
-              "xai/grok-build-0.1",
-              "minimax/MiniMax-M3",
-              "minimax/MiniMax-M2.7",
-              "minimax/MiniMax-M2.5",
-              "minimax/MiniMax-M2.1",
-              "minimax/MiniMax-M2",
-              "deepseek/deepseek-v4-flash",
-              "deepseek/deepseek-v4-pro"
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "openai/gpt-5.4-nano",
+                  "openai/gpt-5.4-mini",
+                  "openai/gpt-5.4",
+                  "openai/gpt-5.5",
+                  "openai-codex/gpt-5.4-mini",
+                  "openai-codex/gpt-5.4",
+                  "openai-codex/gpt-5.5",
+                  "anthropic/claude-haiku-4-5",
+                  "anthropic/claude-sonnet-4-6",
+                  "anthropic/claude-opus-4-7",
+                  "anthropic/claude-opus-4-8",
+                  "fireworks/accounts/fireworks/routers/kimi-k2p6-turbo",
+                  "zai/glm-4.5-air",
+                  "zai/glm-4.6",
+                  "zai/glm-4.7",
+                  "zai-coding/glm-4.5-air",
+                  "zai-coding/glm-4.7",
+                  "zai-coding/glm-5",
+                  "zai-coding/glm-5-turbo",
+                  "zai-coding/glm-5.1",
+                  "xai/grok-4.3",
+                  "xai/grok-4.20-0309-reasoning",
+                  "xai/grok-4.20-0309-non-reasoning",
+                  "xai/grok-build-0.1",
+                  "minimax/MiniMax-M3",
+                  "minimax/MiniMax-M2.7",
+                  "minimax/MiniMax-M2.5",
+                  "minimax/MiniMax-M2.1",
+                  "minimax/MiniMax-M2",
+                  "deepseek/deepseek-v4-flash",
+                  "deepseek/deepseek-v4-pro",
+                  "moonshot/kimi-k2.7-code",
+                  "moonshot/kimi-k2.6",
+                  "moonshot/kimi-k2.5",
+                  "moonshot-coding/kimi-for-coding"
+                ]
+              },
+              {
+                "type": "string"
+              }
             ]
           },
           {
             "minItems": 1,
             "type": "array",
             "items": {
-              "type": "string",
-              "enum": [
-                "openai/gpt-5.4-nano",
-                "openai/gpt-5.4-mini",
-                "openai/gpt-5.4",
-                "openai/gpt-5.5",
-                "openai-codex/gpt-5.4-mini",
-                "openai-codex/gpt-5.4",
-                "openai-codex/gpt-5.5",
-                "anthropic/claude-haiku-4-5",
-                "anthropic/claude-sonnet-4-6",
-                "anthropic/claude-opus-4-7",
-                "anthropic/claude-opus-4-8",
-                "fireworks/accounts/fireworks/routers/kimi-k2p6-turbo",
-                "zai/glm-4.5-air",
-                "zai/glm-4.6",
-                "zai/glm-4.7",
-                "zai-coding/glm-4.5-air",
-                "zai-coding/glm-4.7",
-                "zai-coding/glm-5",
-                "zai-coding/glm-5-turbo",
-                "zai-coding/glm-5.1",
-                "xai/grok-4.3",
-                "xai/grok-4.20-0309-reasoning",
-                "xai/grok-4.20-0309-non-reasoning",
-                "xai/grok-build-0.1",
-                "minimax/MiniMax-M3",
-                "minimax/MiniMax-M2.7",
-                "minimax/MiniMax-M2.5",
-                "minimax/MiniMax-M2.1",
-                "minimax/MiniMax-M2",
-                "deepseek/deepseek-v4-flash",
-                "deepseek/deepseek-v4-pro"
+              "anyOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "openai/gpt-5.4-nano",
+                    "openai/gpt-5.4-mini",
+                    "openai/gpt-5.4",
+                    "openai/gpt-5.5",
+                    "openai-codex/gpt-5.4-mini",
+                    "openai-codex/gpt-5.4",
+                    "openai-codex/gpt-5.5",
+                    "anthropic/claude-haiku-4-5",
+                    "anthropic/claude-sonnet-4-6",
+                    "anthropic/claude-opus-4-7",
+                    "anthropic/claude-opus-4-8",
+                    "fireworks/accounts/fireworks/routers/kimi-k2p6-turbo",
+                    "zai/glm-4.5-air",
+                    "zai/glm-4.6",
+                    "zai/glm-4.7",
+                    "zai-coding/glm-4.5-air",
+                    "zai-coding/glm-4.7",
+                    "zai-coding/glm-5",
+                    "zai-coding/glm-5-turbo",
+                    "zai-coding/glm-5.1",
+                    "xai/grok-4.3",
+                    "xai/grok-4.20-0309-reasoning",
+                    "xai/grok-4.20-0309-non-reasoning",
+                    "xai/grok-build-0.1",
+                    "minimax/MiniMax-M3",
+                    "minimax/MiniMax-M2.7",
+                    "minimax/MiniMax-M2.5",
+                    "minimax/MiniMax-M2.1",
+                    "minimax/MiniMax-M2",
+                    "deepseek/deepseek-v4-flash",
+                    "deepseek/deepseek-v4-pro",
+                    "moonshot/kimi-k2.7-code",
+                    "moonshot/kimi-k2.6",
+                    "moonshot/kimi-k2.5",
+                    "moonshot-coding/kimi-for-coding"
+                  ]
+                },
+                {
+                  "type": "string"
+                }
               ]
             }
           }
         ]
       }
     },
+    "customModels": {
+      "default": {},
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "minLength": 1
+      },
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "reasoning": {
+            "type": "boolean"
+          },
+          "input": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "contextWindow": {
+            "type": "number"
+          },
+          "maxTokens": {
+            "type": "number"
+          },
+          "cost": {
+            "type": "object",
+            "properties": {
+              "input": {
+                "type": "number"
+              },
+              "output": {
+                "type": "number"
+              },
+              "cacheRead": {
+                "type": "number"
+              },
+              "cacheWrite": {
+                "type": "number"
+              }
+            },
+            "additionalProperties": {}
+          }
+        },
+        "additionalProperties": {}
+      }
+    },
     "mounts": {
       "default": [],
       "type": "array",
@@ -1632,7 +1706,10 @@
         "injectionBudgetBytes": 16384,
         "minIdleDeltaLines": 3,
         "spawnTimeoutMs": 50000,
-        "retrievalSpawnTimeoutMs": 30000
+        "retrievalSpawnTimeoutMs": 30000,
+        "vector": {
+          "enabled": false
+        }
       },
       "type": "object",
       "properties": {
@@ -1680,6 +1757,18 @@
               "minLength": 1
             }
           }
+        },
+        "vector": {
+          "default": {
+            "enabled": false
+          },
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "default": false,
+              "type": "boolean"
+            }
+          }
         }
       }
     },

package/src/bundled-plugins/agent-browser/dashboard-discovery.ts

@@ -1,170 +0,0 @@
-// Discovers the actual port the agent-browser dashboard daemon is listening
-// on. Necessary because the previous design hardcoded 4849 in the proxy and
-// trusted the shim to force upstream onto that port — but the shim is bypass-
-// able (someone runs `bunx agent-browser dashboard --port 9999`, the binary
-// gets invoked from a path that isn't shimmed, an old container leaves a
-// stale daemon, etc.). The proxy now consults this module to find the
-// dashboard wherever it actually is.
-//
-// Two-stage discovery, fastest signal first:
-//
-//   1. Hint file at PORT_HINT_PATH. The shim writes the port it asked
-//      upstream to bind to (via the rewritten --port). If the file exists,
-//      points at a port, AND that port currently has a LISTEN socket we
-//      can fast-probe with HEAD /api/sessions, we use it. Zero I/O on the
-//      hot path beyond a small file read.
-//
-//   2. Fallback: read the dashboard's own pidfile at DASHBOARD_PID_PATH
-//      (written by upstream itself). If the PID is alive, scan
-//      /proc/<pid>/fd for socket inodes, cross-reference with /proc/net/tcp
-//      to find LISTEN sockets owned by that PID, drop the proxy's own port,
-//      probe each remaining port with HEAD /api/sessions, return the
-//      first that responds 2xx. Linux-only, which is fine — typeclaw runs
-//      in a Linux container.
-//
-// The fallback is what makes "agent uses other port" work when the shim
-// doesn't catch the call. Without it, the proxy is stuck at whatever port
-// it was configured with and silently 502s on a moved dashboard.
-
-import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs'
-
-export const PORT_HINT_PATH = '/tmp/typeclaw-agent-browser-upstream-port'
-export const DASHBOARD_PID_PATH = '/root/.agent-browser/dashboard.pid'
-const DEFAULT_PROBE_TIMEOUT_MS = 250
-
-export type DiscoveryOptions = {
-  hintPath?: string
-  pidPath?: string
-  excludePort?: number
-  fetchImpl?: typeof fetch
-  probeTimeoutMs?: number
-  procfs?: ProcFs
-}
-
-export type ProcFs = {
-  pidExists: (pid: number) => boolean
-  listenInodesForPid: (pid: number) => Set<string>
-  listenSockets: () => Array<{ port: number; inode: string }>
-}
-
-export async function discoverDashboardPort(opts: DiscoveryOptions = {}): Promise<number | null> {
-  const hintPath = opts.hintPath ?? PORT_HINT_PATH
-  const pidPath = opts.pidPath ?? DASHBOARD_PID_PATH
-  const fetcher = opts.fetchImpl ?? fetch
-  const probeTimeout = opts.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS
-  const procfs = opts.procfs ?? defaultProcFs()
-
-  const hint = readPortHint(hintPath)
-  if (hint !== null && (await isDashboardPort(hint, fetcher, probeTimeout))) return hint
-
-  const pidContents = readPidFile(pidPath)
-  if (pidContents === null) return null
-  if (!procfs.pidExists(pidContents)) return null
-
-  const pidInodes = procfs.listenInodesForPid(pidContents)
-  const candidates: number[] = []
-  for (const socket of procfs.listenSockets()) {
-    if (!pidInodes.has(socket.inode)) continue
-    if (opts.excludePort !== undefined && socket.port === opts.excludePort) continue
-    candidates.push(socket.port)
-  }
-
-  for (const port of candidates) {
-    if (await isDashboardPort(port, fetcher, probeTimeout)) return port
-  }
-  return null
-}
-
-export function writePortHint(port: number, hintPath: string = PORT_HINT_PATH): void {
-  Bun.write(hintPath, String(port))
-}
-
-function readPortHint(path: string): number | null {
-  try {
-    const raw = readFileSync(path, 'utf-8').trim()
-    const port = Number(raw)
-    if (!Number.isInteger(port) || port < 1 || port > 65_535) return null
-    return port
-  } catch {
-    return null
-  }
-}
-
-function readPidFile(path: string): number | null {
-  try {
-    const raw = readFileSync(path, 'utf-8').trim()
-    const pid = Number(raw)
-    if (!Number.isInteger(pid) || pid < 1) return null
-    return pid
-  } catch {
-    return null
-  }
-}
-
-async function isDashboardPort(port: number, fetcher: typeof fetch, timeoutMs: number): Promise<boolean> {
-  const ctrl = new AbortController()
-  const timer = setTimeout(() => ctrl.abort(), timeoutMs)
-  try {
-    const res = await fetcher(`http://127.0.0.1:${port}/api/sessions`, {
-      method: 'GET',
-      signal: ctrl.signal,
-    })
-    return res.ok
-  } catch {
-    return false
-  } finally {
-    clearTimeout(timer)
-  }
-}
-
-function defaultProcFs(): ProcFs {
-  return {
-    pidExists: (pid) => existsSync(`/proc/${pid}`),
-    listenInodesForPid: (pid) => {
-      const inodes = new Set<string>()
-      const fdDir = `/proc/${pid}/fd`
-      let entries: string[]
-      try {
-        entries = readdirSync(fdDir)
-      } catch {
-        return inodes
-      }
-      for (const entry of entries) {
-        try {
-          const target = readlinkSync(`${fdDir}/${entry}`)
-          const match = target.match(/^socket:\[(\d+)\]$/)
-          if (match) inodes.add(match[1]!)
-        } catch {
-          continue
-        }
-      }
-      return inodes
-    },
-    listenSockets: () => {
-      const out: Array<{ port: number; inode: string }> = []
-      for (const file of ['/proc/net/tcp', '/proc/net/tcp6']) {
-        let raw: string
-        try {
-          raw = readFileSync(file, 'utf-8')
-        } catch {
-          continue
-        }
-        const lines = raw.split('\n').slice(1)
-        for (const line of lines) {
-          const cols = line.trim().split(/\s+/)
-          if (cols.length < 10) continue
-          if (cols[3] !== '0A') continue
-          const local = cols[1] ?? ''
-          const colonIdx = local.lastIndexOf(':')
-          if (colonIdx < 0) continue
-          const port = Number.parseInt(local.slice(colonIdx + 1), 16)
-          if (!Number.isInteger(port) || port < 1 || port > 65_535) continue
-          const inode = cols[9]
-          if (inode === undefined) continue
-          out.push({ port, inode })
-        }
-      }
-      return out
-    },
-  }
-}