viaim Daemon

Connects local Codex and Zhipu AutoClaw runtimes to viaim Agent Hub.

The daemon opens an outbound WebSocket to via-gateway. It does not expose a public listening port. The Gateway sends normalized Workspace/Space/Record scope plus the canonical server-side conversation snapshot; viaim records are never copied to the user's computer.

Install

Use the one-time command generated by the product. The installation command uses the public package's latest dist-tag so daemon fixes do not require a Gateway configuration change:

npm install --global \
  "@viaim-ai/agent-hub-daemon@latest" \
  && VIAIM_DAEMON_VIAIM_AUTH_KEY="<viaim-auth-key>" viaim-daemon install-service \
    --gateway-url "https://gateway.example.com" \
    --installation-token "<one-time-token>"

Build an auditable release artifact with pnpm pack:release -- /path/to/output, then publish the same package version before testing a newly generated installation command.

The one-time installation token is exchanged through POST /via-gateway/v1/agent-hub/daemon/register. Only the resulting machine id and daemon token are persisted. The long-lived connection uses an Authorization: Bearer ... header at /via-gateway/v1/agent-hub/daemon/connect; credentials are never placed in the WebSocket URL or service command line. They are stored separately in ~/.viaim-daemon/credentials.json; on Unix systems the daemon keeps its state directory at mode 0700 and this file at mode 0600.

The viaim auth key supplied by the product install command is written to skill-settings.json at viaim-records.auth_key with mode 0600. It is not added to service definitions, runtime environment variables, prompts, logs, or tool arguments.

Each agent.chat.input contains the current input, target agent, stable session_id, normalized scope, canonical conversation revision, and a single-run capability. The daemon maps (user, agent, session) to a local runtime session. A new or stale binding is rehydrated from canonical history; an unchanged binding receives only the current turn.

The package includes the standard viaim-records Skill, scope-specific system context, and the six supported CLI binaries. The Agent calls the local broker; the broker sends agent.tool.call to the Gateway, which authorizes and executes the viaim read or write and returns canonical readback. Capability nonces are revoked on completion, cancellation, or disconnect. A disconnected Gateway never causes a pending request to be replayed automatically.

Commands

viaim-daemon status
viaim-daemon doctor
viaim-daemon logs
viaim-daemon restart
viaim-daemon uninstall

State lives under ~/.viaim-daemon. Each locally detected runtime receives a stable opaque agent_id, derived from the machine identity; the product routes that ID without exposing a machine ID in Chat requests.