awnode 0.3.2__tar.gz → 0.3.4__tar.gz

awnode-0.3.4/CLAUDE.md

@@ -0,0 +1,2 @@
+See [llms.txt](llms.txt) for what this repo is, how to install it, and how it shows up in Claude Code.
+Full ecosystem: https://aitherium.com/llms.txt

{awnode-0.3.2 → awnode-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: awnode
-Version: 0.3.2
+Version: 0.3.4
 Summary: awnode — lightweight local gateway for AitherOS
 Project-URL: Homepage, https://aitherium.com
 Author-email: Aitherium <hello@aitherium.com>
@@ -11,7 +11,7 @@ Requires-Python: >=3.10
 Requires-Dist: awdk>=1.3.0
 Requires-Dist: fastapi>=0.109.0
 Requires-Dist: httpx>=0.26.0
-Requires-Dist: mcp<2.0.0,>=1.0.0
+Requires-Dist: mcp<3.0.0,>=1.0.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: uvicorn[standard]>=0.27.0
 Provides-Extra: all
@@ -32,7 +32,7 @@ Description-Content-Type: text/markdown
 
 **[Docs](https://aitherium.github.io/awnode/)**  ·  [Source](https://github.com/Aitherium/awnode)  ·  `pip install awnode`  ·  [The Aither World](https://aitherium.github.io/)
 
-> **The Aither World** is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. [awnix](https://github.com/Aitherium/awnix) is the Linux underneath it; **awnode** is one of its 65 bricks — each installs on its own, runs offline, and needs no account.
+> **The Aither World** is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. [awnix](https://github.com/Aitherium/awnix) is the Linux underneath it; **awnode** is one of its 67 bricks — each installs on its own, runs offline, and needs no account.
 >
 > **Start here:** Run it once and point one app at it instead of a vendor URL.
 
@@ -54,7 +54,7 @@ curl -fsSL https://launch.aitherium.com | bash
 ## Quick Start
 
 ```bash
-# Start with auto-detection (finds Genesis, vLLM, Ollama, or cloud)
+# Start with auto-detection (finds Genesis, vLLM, llama.cpp, LM Studio, Ollama, or cloud)
 awnode start
 
 # Run the published container
@@ -77,11 +77,18 @@ awnode deploy my-service --target docker --strategy rolling
 
 ## Backend Priority (auto mode)
 
+0. **Custom** (`AITHERNODE_CUSTOM_BACKEND_URL`) — your own OpenAI-compatible backend, when it answers
 1. **Genesis** (localhost:8001) — full AitherOS pipeline (context, memory, agents)
 2. **vLLM** (localhost:8120) — direct GPU inference (OpenAI-compatible)
-3. **Elysium** (cloud) — hosted AitherOS (requires API key)
-4. **Ollama** (localhost:11434) — local CPU/GPU inference
-5. **Standalone** — no LLM, tools-only mode
+3. **llama.cpp** (localhost:8200) / **Bonsai** (localhost:8092) — OpenAI-compatible llama.cpp servers
+4. **LM Studio** (127.0.0.1:1234) — LM Studio's local server (OpenAI-compatible; start it from LM Studio's Developer tab)
+5. **Elysium** (cloud) — hosted AitherOS (requires API key)
+6. **Ollama** (localhost:11434) — local CPU/GPU inference
+7. **Standalone** — no LLM, tools-only mode
+
+OpenAI-compatible backends (vLLM, llama.cpp, Bonsai, LM Studio, custom) are detected by a
+200 on `/v1/models`, never by `/health`, so an unrelated service on the same port is not
+mistaken for one.
 
 ## API
 
@@ -91,8 +98,25 @@ GET  /status          — Backend status (what's connected)
 POST /chat            — Chat (proxied to best backend)
 POST /deploy          — Deploy via AitherComet
 POST /connect         — Register with Elysium
+GET  /v1/models       — Models across the local OpenAI-compatible backends
+POST /v1/chat/completions — OpenAI-compatible chat, routed to the best backend
+GET  /mcp/tools       — Tool discovery
+POST /mcp             — MCP JSON-RPC 2.0: tools/list, tools/call
 ```
 
+The awconnect browser extension (its published ids, plus any in `AWNODE_EXTENSION_IDS`)
+may call `/health`, `/v1/models`, `/v1/chat/completions` and `POST /mcp`; every other
+route refuses an extension origin. The node stays loopback-bound and the
+loopback-or-enrolled-bearer gate still applies.
+
+**Tool scope.** By default `POST /mcp` serves only `read_file`, `list_directory` (both
+jailed to `AITHERNODE_FS_ROOT`) and `web_search`. `write_file`, `run_command` and every
+other tool need a direct loopback caller (no proxy/tunnel headers) that is either a local
+non-browser process sending `Authorization: Bearer <enrolled token or AITHER_MCP_KEY>`, or
+any loopback caller when the node owner sets `AWNODE_BROWSER_FULL_TOOLS=1`. A browser or
+extension origin, a tunnelled/remote request and an unauthenticated local process stay on
+the read-only set; for full tool access from an IDE use `awnode mcp`.
+
 ## Environment Variables
 
 | Variable | Default | Description |
@@ -100,6 +124,9 @@ POST /connect         — Register with Elysium
 | `AITHER_URL` | `http://localhost:8001` | Genesis URL |
 | `AITHER_VLLM_URL` | `http://localhost:8120` | vLLM URL |
 | `OLLAMA_HOST` | `http://localhost:11434` | Ollama URL |
+| `AITHERNODE_LMSTUDIO_URL` | `http://127.0.0.1:1234` | LM Studio server URL (`LMSTUDIO_URL` also read) |
+| `AWNODE_EXTENSION_IDS` | | Extra extension ids admitted on the extension routes (comma-separated) |
+| `AWNODE_BROWSER_FULL_TOOLS` | | `1` lets direct loopback callers (browser/extension included) run every tool without a credential; tunnelled/remote callers stay read-only |
 | `AITHER_API_KEY` | | API key for cloud/auth |
 | `AITHERNODE_MODE` | `auto` | Force mode: auto/local/cloud/standalone |
 | `AITHERNODE_PORT` | `8090` | Server port |
@@ -132,9 +159,11 @@ Each installs on its own, works offline, and needs no account.
 | [awgit](https://github.com/Aitherium/awgit) | that no one else is editing this file | a lease, refused at commit time if you do not hold it |
 | [awdelphi](https://github.com/Aitherium/awdelphi) | one agent's confident take on a decision | the round trace, the anonymity, and who dissents |
 | [awclassify](https://github.com/Aitherium/awclassify) | a filename, a folder, or whoever last touched it | doc_type, visibility, audience and topics, with the evidence lines that decided each |
+| [awdecide](https://github.com/Aitherium/awdecide) | a hosted classifier's probability that never learns whether it was right | the decision, its probability, and the calibration curve from your own resolved outcomes |
 | [awtoll](https://github.com/Aitherium/awtoll) | that your tooling is saving you context | the measured token cost of each tool call, and what the alternative cost |
 | [awseal](https://github.com/Aitherium/awseal) | that the artifact came from who you think | an Ed25519 seal — the key that verifies is not the key that forges |
 | [awshare](https://github.com/Aitherium/awshare) | that the download is intact | content-addressed bundles, verified on fetch |
+| [awsuite](https://github.com/Aitherium/awsuite) | that an agent holding your mailbox will not send on its own | every send, draft, upload and create returns a dry-run until confirm is true |
 | [awnest](https://github.com/Aitherium/awnest) | that there is a person on the other end | a verdict with evidence, where "we could not tell" is not "yes" |
 | [awrena](https://github.com/Aitherium/awrena) | a leaderboard someone can edit, and votes nobody counted | a scored duel with both answers kept, and a result bound to them |
 | [awnboard](https://github.com/Aitherium/awnboard) | a share link anyone who sees it can use | an invitation addressed to one person, for one gate, revocable |
@@ -196,9 +225,11 @@ Every repository here is public. Each publishes an `aither-manifest.json` beside
 | [awgit](https://github.com/Aitherium/awgit) | Semantic version control on top of git — edit-ops and leases | [docs](https://aitherium.github.io/awgit/) |
 | [awdelphi](https://github.com/Aitherium/awdelphi) | Anonymous multi-round expert panels — a converged answer with a trace | [docs](https://aitherium.github.io/awdelphi/) |
 | [awclassify](https://github.com/Aitherium/awclassify) | Classify any document -- what it is, who may read it, who it is for, what it is about | — |
+| [awdecide](https://github.com/Aitherium/awdecide) | One typed-decision contract -- choice / score / bool with a probability -- over a ladder of backends you already run (rules, tiny local models, an LLM's logprobs), fail-closed, with a Brier ledger that resolves every decision against its outcome | — |
 | [awtoll](https://github.com/Aitherium/awtoll) | What every tool call costs you in context, measured from your own transcripts | [docs](https://aitherium.github.io/awtoll/) |
 | [awseal](https://github.com/Aitherium/awseal) | Sign an artifact so a stranger can verify it | [docs](https://aitherium.github.io/awseal/) |
 | [awshare](https://github.com/Aitherium/awshare) | Publish an artifact and fetch it back verified | [docs](https://aitherium.github.io/awshare/) |
+| [awsuite](https://github.com/Aitherium/awsuite) | Your Google Workspace as agent tools, and no write happens without a yes | — |
 | [awdit](https://github.com/Aitherium/awdit) | An append-only audit trail whose gaps are DETECTABLE | [docs](https://aitherium.github.io/awdit/) |
 | [awbac](https://github.com/Aitherium/awbac) | Role-based access control that fails closed and explains itself | [docs](https://aitherium.github.io/awbac/) |
 | [awiam](https://github.com/Aitherium/awiam) | Who is this caller? A directory and session store that fails honestly | [docs](https://aitherium.github.io/awiam/) |
@@ -251,6 +282,8 @@ Every repository here is public. Each publishes an `aither-manifest.json` beside
 | [awsettings](https://github.com/Aitherium/awsettings) | Your agent's permissions and config, following you to the next machine | [docs](https://aitherium.github.io/awsettings/) |
 | [awavatar](https://github.com/Aitherium/awavatar) | One character spec in, a rigged, animated, multi-style avatar pack out | [docs](https://aitherium.github.io/awavatar/) |
 
+**Built on** [REA (Reverse Engineer Anything)](https://github.com/morluto/rea) · [llama.cpp](https://github.com/ggml-org/llama.cpp) · [vLLM](https://github.com/vllm-project/vllm) · [ComfyUI](https://github.com/comfyanonymous/ComfyUI) · [CentOS Stream](https://www.centos.org/centos-stream/) · [Podman](https://github.com/containers/podman) · [Docker](https://github.com/moby/moby) · [LanceDB](https://github.com/lancedb/lancedb) · [WireGuard](https://www.wireguard.com/) · [FFmpeg](https://ffmpeg.org/) · [Blender + Rigify](https://www.blender.org/) · [headroom](https://github.com/headroomlabs-ai/headroom) · [SANA](https://github.com/NVlabs/Sana) · [Hunyuan3D](https://github.com/Tencent-Hunyuan/Hunyuan3D-2.1) · [repowise](https://github.com/repowise-dev/repowise) · [Playwright](https://github.com/microsoft/playwright) · [Chromium](https://www.chromium.org/) · [Next.js](https://github.com/vercel/next.js) · [React](https://github.com/facebook/react).
+
 <div id="aither-constellation" data-self="awnode"></div>
 <script src="aither-constellation.js"></script>
 

{awnode-0.3.2 → awnode-0.3.4}/README.md

@@ -4,7 +4,7 @@
 
 **[Docs](https://aitherium.github.io/awnode/)**  ·  [Source](https://github.com/Aitherium/awnode)  ·  `pip install awnode`  ·  [The Aither World](https://aitherium.github.io/)
 
-> **The Aither World** is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. [awnix](https://github.com/Aitherium/awnix) is the Linux underneath it; **awnode** is one of its 65 bricks — each installs on its own, runs offline, and needs no account.
+> **The Aither World** is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. [awnix](https://github.com/Aitherium/awnix) is the Linux underneath it; **awnode** is one of its 67 bricks — each installs on its own, runs offline, and needs no account.
 >
 > **Start here:** Run it once and point one app at it instead of a vendor URL.
 
@@ -26,7 +26,7 @@ curl -fsSL https://launch.aitherium.com | bash
 ## Quick Start
 
 ```bash
-# Start with auto-detection (finds Genesis, vLLM, Ollama, or cloud)
+# Start with auto-detection (finds Genesis, vLLM, llama.cpp, LM Studio, Ollama, or cloud)
 awnode start
 
 # Run the published container
@@ -49,11 +49,18 @@ awnode deploy my-service --target docker --strategy rolling
 
 ## Backend Priority (auto mode)
 
+0. **Custom** (`AITHERNODE_CUSTOM_BACKEND_URL`) — your own OpenAI-compatible backend, when it answers
 1. **Genesis** (localhost:8001) — full AitherOS pipeline (context, memory, agents)
 2. **vLLM** (localhost:8120) — direct GPU inference (OpenAI-compatible)
-3. **Elysium** (cloud) — hosted AitherOS (requires API key)
-4. **Ollama** (localhost:11434) — local CPU/GPU inference
-5. **Standalone** — no LLM, tools-only mode
+3. **llama.cpp** (localhost:8200) / **Bonsai** (localhost:8092) — OpenAI-compatible llama.cpp servers
+4. **LM Studio** (127.0.0.1:1234) — LM Studio's local server (OpenAI-compatible; start it from LM Studio's Developer tab)
+5. **Elysium** (cloud) — hosted AitherOS (requires API key)
+6. **Ollama** (localhost:11434) — local CPU/GPU inference
+7. **Standalone** — no LLM, tools-only mode
+
+OpenAI-compatible backends (vLLM, llama.cpp, Bonsai, LM Studio, custom) are detected by a
+200 on `/v1/models`, never by `/health`, so an unrelated service on the same port is not
+mistaken for one.
 
 ## API
 
@@ -63,8 +70,25 @@ GET  /status          — Backend status (what's connected)
 POST /chat            — Chat (proxied to best backend)
 POST /deploy          — Deploy via AitherComet
 POST /connect         — Register with Elysium
+GET  /v1/models       — Models across the local OpenAI-compatible backends
+POST /v1/chat/completions — OpenAI-compatible chat, routed to the best backend
+GET  /mcp/tools       — Tool discovery
+POST /mcp             — MCP JSON-RPC 2.0: tools/list, tools/call
 ```
 
+The awconnect browser extension (its published ids, plus any in `AWNODE_EXTENSION_IDS`)
+may call `/health`, `/v1/models`, `/v1/chat/completions` and `POST /mcp`; every other
+route refuses an extension origin. The node stays loopback-bound and the
+loopback-or-enrolled-bearer gate still applies.
+
+**Tool scope.** By default `POST /mcp` serves only `read_file`, `list_directory` (both
+jailed to `AITHERNODE_FS_ROOT`) and `web_search`. `write_file`, `run_command` and every
+other tool need a direct loopback caller (no proxy/tunnel headers) that is either a local
+non-browser process sending `Authorization: Bearer <enrolled token or AITHER_MCP_KEY>`, or
+any loopback caller when the node owner sets `AWNODE_BROWSER_FULL_TOOLS=1`. A browser or
+extension origin, a tunnelled/remote request and an unauthenticated local process stay on
+the read-only set; for full tool access from an IDE use `awnode mcp`.
+
 ## Environment Variables
 
 | Variable | Default | Description |
@@ -72,6 +96,9 @@ POST /connect         — Register with Elysium
 | `AITHER_URL` | `http://localhost:8001` | Genesis URL |
 | `AITHER_VLLM_URL` | `http://localhost:8120` | vLLM URL |
 | `OLLAMA_HOST` | `http://localhost:11434` | Ollama URL |
+| `AITHERNODE_LMSTUDIO_URL` | `http://127.0.0.1:1234` | LM Studio server URL (`LMSTUDIO_URL` also read) |
+| `AWNODE_EXTENSION_IDS` | | Extra extension ids admitted on the extension routes (comma-separated) |
+| `AWNODE_BROWSER_FULL_TOOLS` | | `1` lets direct loopback callers (browser/extension included) run every tool without a credential; tunnelled/remote callers stay read-only |
 | `AITHER_API_KEY` | | API key for cloud/auth |
 | `AITHERNODE_MODE` | `auto` | Force mode: auto/local/cloud/standalone |
 | `AITHERNODE_PORT` | `8090` | Server port |
@@ -104,9 +131,11 @@ Each installs on its own, works offline, and needs no account.
 | [awgit](https://github.com/Aitherium/awgit) | that no one else is editing this file | a lease, refused at commit time if you do not hold it |
 | [awdelphi](https://github.com/Aitherium/awdelphi) | one agent's confident take on a decision | the round trace, the anonymity, and who dissents |
 | [awclassify](https://github.com/Aitherium/awclassify) | a filename, a folder, or whoever last touched it | doc_type, visibility, audience and topics, with the evidence lines that decided each |
+| [awdecide](https://github.com/Aitherium/awdecide) | a hosted classifier's probability that never learns whether it was right | the decision, its probability, and the calibration curve from your own resolved outcomes |
 | [awtoll](https://github.com/Aitherium/awtoll) | that your tooling is saving you context | the measured token cost of each tool call, and what the alternative cost |
 | [awseal](https://github.com/Aitherium/awseal) | that the artifact came from who you think | an Ed25519 seal — the key that verifies is not the key that forges |
 | [awshare](https://github.com/Aitherium/awshare) | that the download is intact | content-addressed bundles, verified on fetch |
+| [awsuite](https://github.com/Aitherium/awsuite) | that an agent holding your mailbox will not send on its own | every send, draft, upload and create returns a dry-run until confirm is true |
 | [awnest](https://github.com/Aitherium/awnest) | that there is a person on the other end | a verdict with evidence, where "we could not tell" is not "yes" |
 | [awrena](https://github.com/Aitherium/awrena) | a leaderboard someone can edit, and votes nobody counted | a scored duel with both answers kept, and a result bound to them |
 | [awnboard](https://github.com/Aitherium/awnboard) | a share link anyone who sees it can use | an invitation addressed to one person, for one gate, revocable |
@@ -168,9 +197,11 @@ Every repository here is public. Each publishes an `aither-manifest.json` beside
 | [awgit](https://github.com/Aitherium/awgit) | Semantic version control on top of git — edit-ops and leases | [docs](https://aitherium.github.io/awgit/) |
 | [awdelphi](https://github.com/Aitherium/awdelphi) | Anonymous multi-round expert panels — a converged answer with a trace | [docs](https://aitherium.github.io/awdelphi/) |
 | [awclassify](https://github.com/Aitherium/awclassify) | Classify any document -- what it is, who may read it, who it is for, what it is about | — |
+| [awdecide](https://github.com/Aitherium/awdecide) | One typed-decision contract -- choice / score / bool with a probability -- over a ladder of backends you already run (rules, tiny local models, an LLM's logprobs), fail-closed, with a Brier ledger that resolves every decision against its outcome | — |
 | [awtoll](https://github.com/Aitherium/awtoll) | What every tool call costs you in context, measured from your own transcripts | [docs](https://aitherium.github.io/awtoll/) |
 | [awseal](https://github.com/Aitherium/awseal) | Sign an artifact so a stranger can verify it | [docs](https://aitherium.github.io/awseal/) |
 | [awshare](https://github.com/Aitherium/awshare) | Publish an artifact and fetch it back verified | [docs](https://aitherium.github.io/awshare/) |
+| [awsuite](https://github.com/Aitherium/awsuite) | Your Google Workspace as agent tools, and no write happens without a yes | — |
 | [awdit](https://github.com/Aitherium/awdit) | An append-only audit trail whose gaps are DETECTABLE | [docs](https://aitherium.github.io/awdit/) |
 | [awbac](https://github.com/Aitherium/awbac) | Role-based access control that fails closed and explains itself | [docs](https://aitherium.github.io/awbac/) |
 | [awiam](https://github.com/Aitherium/awiam) | Who is this caller? A directory and session store that fails honestly | [docs](https://aitherium.github.io/awiam/) |
@@ -223,6 +254,8 @@ Every repository here is public. Each publishes an `aither-manifest.json` beside
 | [awsettings](https://github.com/Aitherium/awsettings) | Your agent's permissions and config, following you to the next machine | [docs](https://aitherium.github.io/awsettings/) |
 | [awavatar](https://github.com/Aitherium/awavatar) | One character spec in, a rigged, animated, multi-style avatar pack out | [docs](https://aitherium.github.io/awavatar/) |
 
+**Built on** [REA (Reverse Engineer Anything)](https://github.com/morluto/rea) · [llama.cpp](https://github.com/ggml-org/llama.cpp) · [vLLM](https://github.com/vllm-project/vllm) · [ComfyUI](https://github.com/comfyanonymous/ComfyUI) · [CentOS Stream](https://www.centos.org/centos-stream/) · [Podman](https://github.com/containers/podman) · [Docker](https://github.com/moby/moby) · [LanceDB](https://github.com/lancedb/lancedb) · [WireGuard](https://www.wireguard.com/) · [FFmpeg](https://ffmpeg.org/) · [Blender + Rigify](https://www.blender.org/) · [headroom](https://github.com/headroomlabs-ai/headroom) · [SANA](https://github.com/NVlabs/Sana) · [Hunyuan3D](https://github.com/Tencent-Hunyuan/Hunyuan3D-2.1) · [repowise](https://github.com/repowise-dev/repowise) · [Playwright](https://github.com/microsoft/playwright) · [Chromium](https://www.chromium.org/) · [Next.js](https://github.com/vercel/next.js) · [React](https://github.com/facebook/react).
+
 <div id="aither-constellation" data-self="awnode"></div>
 <script src="aither-constellation.js"></script>
 

{awnode-0.3.2 → awnode-0.3.4}/awnode/__init__.py

@@ -17,4 +17,4 @@ Install:
     aithernode status              # Check what's connected
 """
 
-__version__ = "0.3.2"
+__version__ = "0.3.4"

{awnode-0.3.2 → awnode-0.3.4}/awnode/_doctor.py

@@ -23,7 +23,7 @@ import sys
 #: package cannot read the registry, and a doctor that guessed at the family
 #: would go stale in silence. Regenerate to update.
 SELF = 'awnode'
-FAMILY = ['awask', 'awavatar', 'awbac', 'awbrain', 'awbrowse', 'awclassify', 'awdecide', 'awdeck', 'awdelphi', 'awdit', 'awembed', 'awevolve', 'awfind', 'awflow', 'awfocus', 'awgit', 'awgraph', 'awgym', 'awiam', 'awkno', 'awm', 'awmail', 'awmine', 'awnboard', 'awnest', 'awnet', 'awpool', 'awpredict', 'awprism', 'awprove', 'awreason', 'awrecover', 'awrecurse', 'awrelay', 'awrena', 'awrepl', 'awreport', 'awresearch', 'awrise', 'awrouter', 'awrtifact', 'awrun', 'awscreen', 'awseal', 'awsettings', 'awshare', 'awsprite', 'awstorage', 'awswarm', 'awtax', 'awtoll', 'awtunnel', 'awvision', 'awvoice', 'awwall', 'gawbbonet']
+FAMILY = ['awask', 'awavatar', 'awbac', 'awbrain', 'awbrowse', 'awcams', 'awclassify', 'awdecide', 'awdeck', 'awdelphi', 'awdit', 'awembed', 'awevolve', 'awfind', 'awflow', 'awfocus', 'awgit', 'awgraph', 'awgym', 'awiam', 'awkno', 'awm', 'awmail', 'awmine', 'awnboard', 'awnest', 'awnet', 'awpool', 'awpredict', 'awprism', 'awprove', 'awreason', 'awrecover', 'awrecurse', 'awrelay', 'awrena', 'awrepl', 'awreport', 'awresearch', 'awrise', 'awrouter', 'awrtifact', 'awrun', 'awscope', 'awscreen', 'awseal', 'awsettings', 'awshare', 'awsprite', 'awstorage', 'awsuite', 'awswarm', 'awtax', 'awtoll', 'awtunnel', 'awvision', 'awvoice', 'awwall', 'gawbbonet']
 PAIRS_WITH = ['adk']
 
 #: This brick's OWN config, read out of its source at generation time.
@@ -33,7 +33,7 @@ PAIRS_WITH = ['adk']
 #: platform-wide vars it also touches would be noise, and a doctor that floods
 #: gets ignored.
 ENV_REQUIRED = []
-ENV_OPTIONAL = ['AITHERNODE_ALLOWED_ORIGINS', 'AITHERNODE_BIND_HOST', 'AITHERNODE_CUSTOM_BACKEND_API_KEY', 'AITHERNODE_CUSTOM_BACKEND_MODEL', 'AITHERNODE_CUSTOM_BACKEND_URL', 'AITHERNODE_FS_ROOT', 'AITHERNODE_MODE', 'AITHERNODE_PORT', 'AITHERNODE_PROXY_MAP', 'AITHERNODE_PROXY_TOKEN', 'AITHERNODE_SERVICE_HOST', 'AITHERNODE_TRUSTED_PROXIES', 'AWNODE_EXTENSION_IDS']
+ENV_OPTIONAL = ['AITHERNODE_ALLOWED_ORIGINS', 'AITHERNODE_BIND_HOST', 'AITHERNODE_CUSTOM_BACKEND_API_KEY', 'AITHERNODE_CUSTOM_BACKEND_MODEL', 'AITHERNODE_CUSTOM_BACKEND_URL', 'AITHERNODE_FS_ROOT', 'AITHERNODE_LMSTUDIO_URL', 'AITHERNODE_MODE', 'AITHERNODE_PORT', 'AITHERNODE_PROXY_MAP', 'AITHERNODE_PROXY_TOKEN', 'AITHERNODE_SERVICE_HOST', 'AITHERNODE_TRUSTED_PROXIES', 'AWNODE_EXTENSION_IDS', 'AWNODE_IN_CONTAINER']
 
 
 def _installed(mod: str) -> "str | None":

{awnode-0.3.2 → awnode-0.3.4}/awnode/cli.py

@@ -12,6 +12,7 @@ awnode CLI
     awnode mcp --transport sse # Start MCP server (HTTP SSE)
     awnode mcp-config          # Output .mcp.json config snippet
     awnode deploy <service>    # Deploy via AitherComet
+    awnode pair-mode           # Let a device you own find this one on the Wi-Fi (5 min)
 """
 
 import argparse
@@ -41,6 +42,15 @@ def main():
     if sys.argv[1:2] == ["hub"]:
         from awnode.hub import main as hub_main
         return hub_main(sys.argv[2:])
+    # `awnode pair-mode ...` -- advertise this box on the LAN for 5 minutes so a device that
+    # is already the owner's can approve it (adk/lan_pair.py; Phase 2 of device join).
+    if sys.argv[1:2] == ["pair-mode"]:
+        try:
+            from adk.lan_pair import main as pair_mode_main
+        except ImportError as exc:
+            print(f"pair-mode needs a newer awdk (pip install -U awdk): {exc}")
+            return 1
+        return pair_mode_main(sys.argv[2:])
     # License entitlement gate (logs tier, wires metering quotas; never blocks unless
     # AITHER_LICENSE_REQUIRE=1). adk must be importable for this to apply.
     try:
@@ -166,6 +176,14 @@ def main():
 
     args = parser.parse_args()
 
+    # Once-a-day PyPI check for a newer awnode (awnode/update_check.py): a cached
+    # notice prints now, a stale cache refreshes on a daemon thread. Skipped for
+    # the stdio MCP server, whose client owns the terminal. AWNODE_NO_UPDATE_CHECK=1
+    # turns it off.
+    if args.command and args.command != "mcp":
+        from awnode.update_check import cli_start_check
+        cli_start_check()
+
     if args.command == "start":
         if args.cloud:
             os.environ["AITHERNODE_MODE"] = "cloud"
@@ -178,6 +196,7 @@ def main():
         if args.genesis_url:
             os.environ["AITHER_URL"] = args.genesis_url
         os.environ["AITHERNODE_PORT"] = str(args.port)
+        os.environ["AITHERNODE_BIND_HOST"] = str(args.host)  # the startup bind warning reads this env
 
         import uvicorn
         uvicorn.run(
@@ -329,11 +348,15 @@ async def _doctor(*, emit_json: bool = False, timeout: float = 3.0) -> int:
         "genesis": os.environ.get("AITHER_URL", "http://localhost:8001"),
         "vllm": os.environ.get("AITHER_VLLM_URL", "http://localhost:8120"),
         "ollama": os.environ.get("OLLAMA_HOST", "http://localhost:11434"),
+        # LM Studio has no /health; its OpenAI-compatible /v1/models is the liveness surface.
+        "lmstudio": os.environ.get(
+            "AITHERNODE_LMSTUDIO_URL", os.environ.get("LMSTUDIO_URL", "http://127.0.0.1:1234")
+        ),
         "gateway": os.environ.get("AITHER_CLOUD_URL", "https://gateway.aitherium.com"),
     }
     async with httpx.AsyncClient(timeout=timeout) as client:
         for name, url in backends.items():
-            health_path = "/api/tags" if name == "ollama" else "/health"
+            health_path = {"ollama": "/api/tags", "lmstudio": "/v1/models"}.get(name, "/health")
             try:
                 r = await client.get(url.rstrip("/") + health_path)
                 if r.status_code < 500:
@@ -397,6 +420,22 @@ async def _status():
         icon = "+" if status == "UP" else "-"
         print(f"  [{icon}] {name:12s} {url:40s} {status}")
 
+    # Enrollment: a dead or expiring token is the most common silent failure (sync,
+    # register and heartbeat all 401), so say it here in plain words.
+    try:
+        from awnode.sync import WorkspaceSyncClient
+        sc = WorkspaceSyncClient()
+        sc._load_local_state()
+        if sc._tenant_scoped_token:
+            exp = sc._token_expires_at or "unknown"
+            if sc.token_expired():
+                print(f"  [-] Enrollment   token EXPIRED ({exp}) -- re-enroll: "
+                      "awnode connect --enroll-token=TOKEN")
+            else:
+                print(f"  [+] Enrollment   token valid until {exp}")
+    except Exception:
+        pass
+
     # Check for running Node
     try:
         async with httpx.AsyncClient(timeout=2.0) as c:
@@ -578,9 +617,8 @@ async def _connect(
 
     # Resolve portal URL
     if not portal_url:
-        portal_url = os.environ.get(
-            "AITHER_CLOUD_URL", "https://portal.aitherium.com"
-        )
+        # api.aitherium.com is the live app host (Veil); portal.* is retired.
+        portal_url = os.environ.get("AITHER_CLOUD_URL", "https://api.aitherium.com")
 
     aither_home = Path(os.environ.get("AITHER_HOME", str(Path.home() / ".aither")))
     state_file = aither_home / "sync_state.json"
@@ -610,7 +648,15 @@ async def _connect(
                                 pass
                         state["tenant_scoped_token"] = workspace_token
                         state["node_id"] = node_id
-                        state_file.write_text(json.dumps(state, indent=2))
+                        # Recorded so the node can say "re-enroll" before the 30-day
+                        # token dies, instead of 401ing silently afterwards.
+                        if data.get("expires_at"):
+                            state["tenant_scoped_token_expires_at"] = data["expires_at"]
+                        # 0600 from the first byte: this file holds a bearer token,
+                        # and write_text() created it at the default umask.
+                        fd = os.open(state_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+                        with os.fdopen(fd, "w") as fh:
+                            fh.write(json.dumps(state, indent=2))
                         print(
                             f"✓ Token saved for node {node_id} "
                             f"(expires {data.get('expires_at', '?')})"

{awnode-0.3.2 → awnode-0.3.4}/awnode/hub.py

@@ -371,6 +371,9 @@ class Hub:
         self.cache_path = state_dir / "tools-cache.json"
         self.tool_cache: Dict[str, List[dict]] = self._load_cache()
         self.errors: Dict[str, str] = {}
+        # When each error was recorded. An error used to be permanent: one transient
+        # start failure hid that brick's tools in every session until the hub restarted.
+        self.error_at: Dict[str, float] = {}
         self.started_at = time.time()
         self.stop_event = threading.Event()
 
@@ -446,8 +449,10 @@ class Hub:
                 c.start()
             except ChildError as exc:
                 self.errors[brick] = str(exc)
+                self.error_at[brick] = time.monotonic()
                 raise
             self.errors.pop(brick, None)
+            self.error_at.pop(brick, None)
             self.children[key] = c
             self._learn(brick, c.tools)
             log("started %s for %s (pid %s)" % (brick, project_dir,
@@ -510,10 +515,24 @@ class Hub:
                 tools.append(t if exposed == orig else {**t, "name": exposed})
         return tools, table
 
+    #: How long a brick's start failure suppresses retries.
+    ERROR_COOLDOWN_S = 300.0
+
+    def _error_fresh(self, brick: str) -> bool:
+        """True while a recorded error is younger than the cooldown."""
+        if brick not in self.errors:
+            return False
+        at = self.error_at.get(brick)
+        if at is not None and time.monotonic() - at >= self.ERROR_COOLDOWN_S:
+            self.errors.pop(brick, None)
+            self.error_at.pop(brick, None)
+            return False
+        return True
+
     def ensure_tool_cache(self, project_dir: str, timeout: float = 90.0) -> None:
         """Learn the tool list of every brick not yet in the cache (in parallel)."""
         missing = [b for b in self.order if not self.tool_cache.get(b)
-                   and b not in self.errors]
+                   and not self._error_fresh(b)]
         if not missing:
             return
         threads = []