npm - volute - Versions diffs - 0.49.0 → 0.51.0 - Mend

volute 0.49.0 → 0.51.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (224) hide show

package/dist/web-assets/index.html CHANGED Viewed

@@ -8,8 +8,8 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Averia+Serif+Libre:wght@300;400;700&family=Fira+Code:wght@300;400;500;600&family=Averia+Sans+Libre:ital,wght@0,300;0,400;0,500;0,600;1,400&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-CKlqUkyG.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BostMFoR.css">
+    <script type="module" crossorigin src="/assets/index-CrxBwnzp.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BOyJ4Gqs.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/xai-P42CRCZA.js ADDED Viewed

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+import "./chunk-K3NQKI34.js";
+// packages/daemon/src/lib/oauth/xai.ts
+import {
+  pollOAuthDeviceCodeFlow,
+  registerOAuthProvider
+} from "@earendil-works/pi-ai/oauth";
+var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+var XAI_ISSUER = "https://auth.x.ai";
+var XAI_DISCOVERY_URL = `${XAI_ISSUER}/.well-known/openid-configuration`;
+var FALLBACK_DEVICE_ENDPOINT = `${XAI_ISSUER}/oauth2/device/code`;
+var FALLBACK_TOKEN_ENDPOINT = `${XAI_ISSUER}/oauth2/token`;
+function validateXaiUrl(url) {
+  const u = new URL(url);
+  if (u.hostname !== "auth.x.ai" || u.protocol !== "https:") {
+    throw new Error(`Refusing non-xAI OAuth endpoint: ${url}`);
+  }
+  return u.toString();
+}
+async function discoverEndpoints(signal) {
+  try {
+    const res = await fetch(XAI_DISCOVERY_URL, { signal });
+    if (res.ok) {
+      const doc = await res.json();
+      if (doc.device_authorization_endpoint && doc.token_endpoint) {
+        return {
+          deviceEndpoint: validateXaiUrl(doc.device_authorization_endpoint),
+          tokenEndpoint: validateXaiUrl(doc.token_endpoint)
+        };
+      }
+    }
+  } catch {
+  }
+  return { deviceEndpoint: FALLBACK_DEVICE_ENDPOINT, tokenEndpoint: FALLBACK_TOKEN_ENDPOINT };
+}
+function credentialsFromTokenResponse(raw) {
+  const json = raw ?? {};
+  if (!json.access_token || typeof json.expires_in !== "number") {
+    throw new Error("xAI token response missing access_token/expires_in");
+  }
+  return {
+    access: json.access_token,
+    // A refresh grant may omit refresh_token; the caller merges the old one.
+    refresh: json.refresh_token ?? "",
+    expires: Date.now() + json.expires_in * 1e3
+  };
+}
+async function login(callbacks) {
+  const { deviceEndpoint, tokenEndpoint } = await discoverEndpoints(callbacks.signal);
+  const deviceRes = await fetch(deviceEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: XAI_OAUTH_CLIENT_ID, scope: XAI_OAUTH_SCOPE }),
+    signal: callbacks.signal
+  });
+  if (!deviceRes.ok) {
+    throw new Error(`xAI device authorization failed: HTTP ${deviceRes.status}`);
+  }
+  const device = await deviceRes.json();
+  callbacks.onDeviceCode({
+    userCode: device.user_code,
+    verificationUri: device.verification_uri_complete ?? device.verification_uri,
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in
+  });
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in,
+    signal: callbacks.signal,
+    poll: async () => {
+      const res = await fetch(tokenEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: device.device_code,
+          client_id: XAI_OAUTH_CLIENT_ID
+        }),
+        signal: callbacks.signal
+      });
+      if (res.ok) {
+        return { status: "complete", value: credentialsFromTokenResponse(await res.json()) };
+      }
+      const body = await res.json().catch(() => ({}));
+      if (body.error === "authorization_pending") return { status: "pending" };
+      if (body.error === "slow_down") return { status: "slow_down" };
+      return { status: "failed", message: body.error ?? `HTTP ${res.status}` };
+    }
+  });
+}
+async function refreshToken(credentials) {
+  const { tokenEndpoint } = await discoverEndpoints();
+  const res = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: credentials.refresh,
+      client_id: XAI_OAUTH_CLIENT_ID
+    })
+  });
+  if (!res.ok) throw new Error(`xAI token refresh failed: HTTP ${res.status}`);
+  const next = credentialsFromTokenResponse(await res.json());
+  if (!next.refresh) next.refresh = credentials.refresh;
+  return next;
+}
+var xaiOAuthProvider = {
+  id: "xai",
+  name: "xAI (Grok)",
+  usesCallbackServer: false,
+  login,
+  refreshToken,
+  getApiKey: (credentials) => credentials.access
+};
+var registered = false;
+function registerXaiOAuthProvider() {
+  if (registered) return;
+  registerOAuthProvider(xaiOAuthProvider);
+  registered = true;
+}
+export {
+  XAI_OAUTH_CLIENT_ID,
+  XAI_OAUTH_SCOPE,
+  registerXaiOAuthProvider,
+  validateXaiUrl,
+  xaiOAuthProvider
+};

package/drizzle/0014_system_events.sql ADDED Viewed

@@ -0,0 +1,26 @@
+-- System events: environment → mind traffic (replaces mind_notices).
+-- No sender, no reply target; a separate stream from chat.
+CREATE TABLE IF NOT EXISTS `system_events` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`mind` text NOT NULL,
+	`type` text NOT NULL,
+	`body` text NOT NULL,
+	`meta` text,
+	`delivery` text NOT NULL DEFAULT 'immediate',
+	`session` text NOT NULL DEFAULT 'main',
+	`created_at` text NOT NULL DEFAULT (datetime('now')),
+	`delivered_at` text,
+	`reflection` text
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_system_events_mind` ON `system_events` (`mind`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_system_events_mind_delivery` ON `system_events` (`mind`, `delivery`, `delivered_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_system_events_mind_type` ON `system_events` (`mind`, `type`);
+--> statement-breakpoint
+-- Deliberately discards any pending mind_notices rows at upgrade: notice rows were
+-- transient (deleted after delivery), so losing an undelivered failure notice across
+-- an upgrade is acceptable — no data migration is performed.
+DROP TABLE IF EXISTS `mind_notices`;

package/drizzle/0015_rename_session_to_thread.sql ADDED Viewed

@@ -0,0 +1,12 @@
+-- Rename the routing "session" column to "thread" on turns, mind_history,
+-- delivery_queue, and system_events. The routing sense of "session" is renamed
+-- to "thread" (issue #493); auth sessions and SDK transcript files keep "session".
+ALTER TABLE `turns` RENAME COLUMN `session` TO `thread`;--> statement-breakpoint
+ALTER TABLE `mind_history` RENAME COLUMN `session` TO `thread`;--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_mind_history_session`;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_mind_history_thread` ON `mind_history` (`thread`);--> statement-breakpoint
+ALTER TABLE `delivery_queue` RENAME COLUMN `session` TO `thread`;--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_delivery_queue_mind_session`;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_delivery_queue_mind_thread` ON `delivery_queue` (`mind`, `thread`);--> statement-breakpoint
+-- system_events is created by 0014 on this same train, so the rename is always valid.
+ALTER TABLE `system_events` RENAME COLUMN `session` TO `thread`;

package/drizzle/0016_brain_to_human.sql ADDED Viewed

@@ -0,0 +1,4 @@
+-- Retire the "brain" user_type in favour of "human" (issue #493). Human users
+-- were stored as user_type = 'brain'; migrate live rows so prefixes and profile
+-- cards render [human]. Mind, system, and puppet types are unchanged.
+UPDATE `users` SET `user_type` = 'human' WHERE `user_type` = 'brain';

package/drizzle/0017_event_history_rows.sql ADDED Viewed

@@ -0,0 +1,9 @@
+-- System events are not messages. They were recorded in mind_history as `inbound` rows,
+-- so every history surface rendered them as chat with a phantom sender ("user"), and minds
+-- read them as messages they were expected to reply to. Retype the delivered-event rows so
+-- the timeline and `volute mind history` can render them as system markers instead.
+--
+-- The `event:<type>:<id>` channel is written only by recordEventRow, so it identifies
+-- these rows exactly. Turn linkage (turn_id / trigger_event_id) is untouched — the linkers
+-- match both types, so reflection capture keeps working for historical turns.
+UPDATE `mind_history` SET `type` = 'event' WHERE `type` = 'inbound' AND `channel` LIKE 'event:%';

package/drizzle/0018_api_tokens.sql ADDED Viewed

@@ -0,0 +1,20 @@
+-- Durable, hashed, revocable per-user API credentials.
+--
+-- Keyed to a `users` row rather than a mind name, so the same token type serves
+-- external minds (users rows with user_type "mind" and no minds registry row)
+-- and, later, external humans. Only the SHA-256 hash is stored; revocation is a
+-- row DELETE, and the FK cascade drops a user's tokens along with the user.
+--
+-- Orthogonal to the in-memory native-mind token map: these survive a restart.
+CREATE TABLE IF NOT EXISTS `api_tokens` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`user_id` integer NOT NULL REFERENCES `users`(`id`) ON DELETE CASCADE,
+	`token_hash` text NOT NULL,
+	`label` text,
+	`created_at` text NOT NULL DEFAULT (datetime('now'))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `idx_api_tokens_hash` ON `api_tokens` (`token_hash`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_api_tokens_user` ON `api_tokens` (`user_id`);

package/drizzle/meta/_journal.json CHANGED Viewed

@@ -99,6 +99,41 @@
       "when": 1775800000000,
       "tag": "0013_variant_purpose",
       "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1775900000000,
+      "tag": "0014_system_events",
+      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1776000000000,
+      "tag": "0015_rename_session_to_thread",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "6",
+      "when": 1776100000000,
+      "tag": "0016_brain_to_human",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1776200000000,
+      "tag": "0017_event_history_rows",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "6",
+      "when": 1776300000000,
+      "tag": "0018_api_tokens",
+      "breakpoints": true
     }
   ]
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "volute",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "CLI for creating and managing self-modifying AI minds powered by the Claude Agent SDK",
   "type": "module",
   "license": "MIT",
@@ -66,44 +66,44 @@
     "db:migrate": "drizzle-kit migrate"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.56",
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@hono/node-server": "^2.0.6",
+    "@anthropic-ai/sandbox-runtime": "^0.0.65",
+    "@earendil-works/pi-ai": "^0.80.6",
+    "@hono/node-server": "^2.0.8",
     "@hono/zod-validator": "^0.8.0",
     "@libsql/client": "^0.17.4",
     "@slack/bolt": "^4.7.3",
-    "adm-zip": "^0.5.17",
+    "adm-zip": "^0.6.0",
     "bcryptjs": "^3.0.3",
-    "cron-parser": "^5.6.0",
-    "discord.js": "^14.26.4",
+    "cron-parser": "^5.6.2",
+    "discord.js": "^14.26.5",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.26",
-    "isomorphic-dompurify": "^2.36.0",
+    "hono": "^4.12.30",
+    "isomorphic-dompurify": "^3.18.0",
     "libsql": "^0.5.29",
     "replicate": "^1.4.0",
-    "sharp": "^0.35.2",
+    "sharp": "^0.35.3",
     "telegraf": "^4.16.3",
-    "undici": "^6.24.1",
+    "undici": "^7.28.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.197",
-    "@biomejs/biome": "2.5.0",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.207",
+    "@biomejs/biome": "2.5.3",
+    "@earendil-works/pi-coding-agent": "^0.80.6",
+    "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "@types/adm-zip": "^0.5.8",
-    "@types/node": "^26.0.0",
-    "dompurify": "^3.4.11",
+    "@types/node": "^26.1.1",
+    "dompurify": "3.4.11",
     "drizzle-kit": "^0.31.10",
     "knip": "^6.26.0",
-    "lefthook": "^2.1.9",
-    "marked": "^18.0.5",
-    "svelte": "^5.56.3",
-    "svelte-check": "4.7.1",
+    "lefthook": "^2.1.10",
+    "marked": "^18.0.6",
+    "svelte": "^5.56.4",
+    "svelte-check": "4.7.2",
     "tsup": "^8.5.1",
-    "tsx": "^4.22.4",
+    "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.1.4"
   },
   "overrides": {
     "esrap": "2.2.11"