@akon-labs/nexus-cli 0.1.0

package/dist/extensions/gitnexus/device-auth.js

@@ -0,0 +1,130 @@
+import { createHash } from "node:crypto";
+import { arch, hostname, platform, userInfo } from "node:os";
+import { APP_NAME, VERSION } from "../../config.js";
+export class DeviceAuthError extends Error {
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.name = "DeviceAuthError";
+        this.reason = reason;
+    }
+}
+/** Base URL of the hub's HTTP API, derived from the configured MCP endpoint. */
+export function hubApiBase(hubUrl) {
+    return hubUrl.replace(/\/mcp\/?$/, "").replace(/\/+$/, "");
+}
+/** Human-readable device label, so tokens are identifiable in the hub UI. */
+export function defaultDeviceName() {
+    try {
+        const host = hostname();
+        const user = userInfo().username;
+        return user ? `${user}@${host}` : host;
+    }
+    catch {
+        return "unknown-device";
+    }
+}
+/** Stable machine identity required by Hub device-token authentication. */
+export function deviceFingerprint() {
+    let username = "unknown-user";
+    try {
+        username = userInfo().username || username;
+    }
+    catch {
+        // Keep deterministic fallback.
+    }
+    const identity = `${hostname()}:${username}:${platform()}:${arch()}`;
+    return createHash("sha256").update(identity).digest("hex").slice(0, 16);
+}
+async function postJson(url, body, signal) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw new DeviceAuthError("Login cancelled", "timeout");
+        throw new DeviceAuthError(`Cannot reach the hub at ${url}: ${errorText(error)}`, "network");
+    }
+    const text = await response.text();
+    let data;
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new DeviceAuthError(`Hub returned a non-JSON response (HTTP ${response.status})`, "protocol");
+    }
+    return { status: response.status, data };
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Ask the hub to begin a device login. */
+export async function startDeviceAuth(hubUrl, options = {}) {
+    const { status, data } = await postJson(`${hubApiBase(hubUrl)}/auth/device/start`, {
+        agentName: APP_NAME,
+        agentVersion: VERSION,
+        deviceName: options.deviceName ?? defaultDeviceName(),
+        deviceFingerprint: options.deviceFingerprint ?? deviceFingerprint(),
+    }, options.signal);
+    if (status !== 200 || typeof data?.deviceCode !== "string" || typeof data?.userCode !== "string") {
+        throw new DeviceAuthError(data?.error ? String(data.error) : `Hub rejected the login request (HTTP ${status})`, "protocol");
+    }
+    return {
+        deviceCode: data.deviceCode,
+        userCode: data.userCode,
+        verificationUrl: String(data.verificationUrl ?? `${hubApiBase(hubUrl)}/device`),
+        verificationUrlComplete: typeof data.verificationUrlComplete === "string" ? data.verificationUrlComplete : undefined,
+        expiresIn: typeof data.expiresIn === "number" ? data.expiresIn : 600,
+        interval: typeof data.interval === "number" && data.interval > 0 ? data.interval : 5,
+    };
+}
+/**
+ * Poll until the user approves, the request dies, or the deadline passes.
+ *
+ * `sleep` is injectable so tests do not wait in real time.
+ */
+export async function pollDeviceAuth(hubUrl, start, options = {}) {
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = options.now ?? (() => Date.now());
+    const deadline = now() + start.expiresIn * 1000;
+    let intervalMs = start.interval * 1000;
+    while (true) {
+        if (options.signal?.aborted)
+            throw new DeviceAuthError("Login cancelled", "timeout");
+        await sleep(intervalMs);
+        // Re-check after sleeping: a request that expired while we waited should
+        // not cost the hub another round trip.
+        if (now() >= deadline)
+            break;
+        const { status, data } = await postJson(`${hubApiBase(hubUrl)}/auth/device/poll`, { deviceCode: start.deviceCode }, options.signal);
+        if (status === 200 && typeof data?.token === "string") {
+            return {
+                token: data.token,
+                hubUrl: typeof data.hubUrl === "string" ? data.hubUrl : hubUrl,
+                tokenId: typeof data.tokenId === "string" ? data.tokenId : undefined,
+            };
+        }
+        switch (data?.error) {
+            case "authorization_pending":
+                break;
+            case "slow_down":
+                // Back off to whatever the hub now advertises, or a second more.
+                intervalMs = typeof data.interval === "number" ? data.interval * 1000 : intervalMs + 1000;
+                break;
+            case "access_denied":
+                throw new DeviceAuthError("Login was denied in the browser", "access_denied");
+            case "expired_token":
+                throw new DeviceAuthError("The login code expired or was already used", "expired_token");
+            default:
+                throw new DeviceAuthError(data?.error ? String(data.error) : `Unexpected hub response (HTTP ${status})`, "protocol");
+        }
+    }
+    throw new DeviceAuthError("Timed out waiting for approval", "timeout");
+}
+//# sourceMappingURL=device-auth.js.map

package/dist/extensions/gitnexus/device-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/device-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAuCpD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAChC,MAAM,CAA6C;IAE5D,YAAY,OAAe,EAAE,MAAiC,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAAA,CACrB;CACD;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,MAAc,EAAU;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAAA,CAC3D;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,GAAW;IAC3C,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACjC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,gBAAgB,CAAC;IACzB,CAAC;AAAA,CACD;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,GAAW;IAC3C,IAAI,QAAQ,GAAG,cAAc,CAAC;IAC9B,IAAI,CAAC;QACJ,QAAQ,GAAG,QAAQ,EAAE,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,+BAA+B;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAAA,CACxE;AAED,KAAK,UAAU,QAAQ,CACtB,GAAW,EACX,IAAa,EACb,MAA+B,EACU;IACzC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC7E,MAAM,IAAI,eAAe,CAAC,2BAA2B,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,eAAe,CAAC,0CAA0C,QAAQ,CAAC,MAAM,GAAG,EAAE,UAAU,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAAA,CACzC;AAED,SAAS,SAAS,CAAC,KAAc,EAAU;IAC1C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC9D;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,MAAc,EACd,OAAO,GAA8E,EAAE,EAC5D;IAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACtC,GAAG,UAAU,CAAC,MAAM,CAAC,oBAAoB,EACzC;QACC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE;QACrD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,iBAAiB,EAAE;KACnE,EACD,OAAO,CAAC,MAAM,CACd,CAAC;IAEF,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,IAAI,eAAe,CACxB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wCAAwC,MAAM,GAAG,EACpF,UAAU,CACV,CAAC;IACH,CAAC;IAED,OAAO;QACN,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/E,uBAAuB,EACtB,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;QAC5F,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;QACpE,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KACpF,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,MAAc,EACd,KAAsB,EACtB,OAAO,GAIH,EAAE,EACsB;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IAEvC,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,yEAAyE;QACzE,uCAAuC;QACvC,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM;QAE7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACtC,GAAG,UAAU,CAAC,MAAM,CAAC,mBAAmB,EACxC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAChC,OAAO,CAAC,MAAM,CACd,CAAC;QAEF,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC9D,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aACpE,CAAC;QACH,CAAC;QAED,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC;YACrB,KAAK,uBAAuB;gBAC3B,MAAM;YACP,KAAK,WAAW;gBACf,iEAAiE;gBACjE,UAAU,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1F,MAAM;YACP,KAAK,eAAe;gBACnB,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,eAAe,CAAC,CAAC;YAC/E,KAAK,eAAe;gBACnB,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,eAAe,CAAC,CAAC;YAC1F;gBACC,MAAM,IAAI,eAAe,CACxB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iCAAiC,MAAM,GAAG,EAC7E,UAAU,CACV,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;AAAA,CACvE","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { arch, hostname, platform, userInfo } from \"node:os\";\nimport { APP_NAME, VERSION } from \"../../config.ts\";\n\n/**\n * Device authorization client for hub login.\n *\n * The CLI cannot receive a browser redirect, so it starts a request, shows the\n * user a short code, and polls until they approve it in the web app. The hub\n * mints the token on the first successful poll, so it exists in plaintext only\n * in that one response and in the local auth file.\n *\n * Protocol shape follows RFC 8628, and the hub returns its error codes\n * verbatim so callers branch on a stable string rather than prose.\n */\n\nexport interface DeviceAuthStart {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUrl: string;\n\tverificationUrlComplete?: string;\n\t/** Seconds until the request expires. */\n\texpiresIn: number;\n\t/** Seconds the CLI must wait between polls. */\n\tinterval: number;\n}\n\nexport interface DeviceAuthResult {\n\ttoken: string;\n\thubUrl: string;\n\ttokenId?: string;\n}\n\nexport type DeviceAuthFailure =\n\t/** The user rejected the code in the browser. */\n\t| \"access_denied\"\n\t/** The request expired, was already used, or never existed. */\n\t| \"expired_token\"\n\t/** The CLI gave up waiting. */\n\t| \"timeout\";\n\nexport class DeviceAuthError extends Error {\n\treadonly reason: DeviceAuthFailure | \"network\" | \"protocol\";\n\n\tconstructor(message: string, reason: DeviceAuthError[\"reason\"]) {\n\t\tsuper(message);\n\t\tthis.name = \"DeviceAuthError\";\n\t\tthis.reason = reason;\n\t}\n}\n\n/** Base URL of the hub's HTTP API, derived from the configured MCP endpoint. */\nexport function hubApiBase(hubUrl: string): string {\n\treturn hubUrl.replace(/\\/mcp\\/?$/, \"\").replace(/\\/+$/, \"\");\n}\n\n/** Human-readable device label, so tokens are identifiable in the hub UI. */\nexport function defaultDeviceName(): string {\n\ttry {\n\t\tconst host = hostname();\n\t\tconst user = userInfo().username;\n\t\treturn user ? `${user}@${host}` : host;\n\t} catch {\n\t\treturn \"unknown-device\";\n\t}\n}\n\n/** Stable machine identity required by Hub device-token authentication. */\nexport function deviceFingerprint(): string {\n\tlet username = \"unknown-user\";\n\ttry {\n\t\tusername = userInfo().username || username;\n\t} catch {\n\t\t// Keep deterministic fallback.\n\t}\n\tconst identity = `${hostname()}:${username}:${platform()}:${arch()}`;\n\treturn createHash(\"sha256\").update(identity).digest(\"hex\").slice(0, 16);\n}\n\nasync function postJson(\n\turl: string,\n\tbody: unknown,\n\tsignal: AbortSignal | undefined,\n): Promise<{ status: number; data: any }> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify(body),\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal?.aborted) throw new DeviceAuthError(\"Login cancelled\", \"timeout\");\n\t\tthrow new DeviceAuthError(`Cannot reach the hub at ${url}: ${errorText(error)}`, \"network\");\n\t}\n\n\tconst text = await response.text();\n\tlet data: any;\n\ttry {\n\t\tdata = text ? JSON.parse(text) : {};\n\t} catch {\n\t\tthrow new DeviceAuthError(`Hub returned a non-JSON response (HTTP ${response.status})`, \"protocol\");\n\t}\n\treturn { status: response.status, data };\n}\n\nfunction errorText(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\n/** Ask the hub to begin a device login. */\nexport async function startDeviceAuth(\n\thubUrl: string,\n\toptions: { deviceName?: string; deviceFingerprint?: string; signal?: AbortSignal } = {},\n): Promise<DeviceAuthStart> {\n\tconst { status, data } = await postJson(\n\t\t`${hubApiBase(hubUrl)}/auth/device/start`,\n\t\t{\n\t\t\tagentName: APP_NAME,\n\t\t\tagentVersion: VERSION,\n\t\t\tdeviceName: options.deviceName ?? defaultDeviceName(),\n\t\t\tdeviceFingerprint: options.deviceFingerprint ?? deviceFingerprint(),\n\t\t},\n\t\toptions.signal,\n\t);\n\n\tif (status !== 200 || typeof data?.deviceCode !== \"string\" || typeof data?.userCode !== \"string\") {\n\t\tthrow new DeviceAuthError(\n\t\t\tdata?.error ? String(data.error) : `Hub rejected the login request (HTTP ${status})`,\n\t\t\t\"protocol\",\n\t\t);\n\t}\n\n\treturn {\n\t\tdeviceCode: data.deviceCode,\n\t\tuserCode: data.userCode,\n\t\tverificationUrl: String(data.verificationUrl ?? `${hubApiBase(hubUrl)}/device`),\n\t\tverificationUrlComplete:\n\t\t\ttypeof data.verificationUrlComplete === \"string\" ? data.verificationUrlComplete : undefined,\n\t\texpiresIn: typeof data.expiresIn === \"number\" ? data.expiresIn : 600,\n\t\tinterval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n\t};\n}\n\n/**\n * Poll until the user approves, the request dies, or the deadline passes.\n *\n * `sleep` is injectable so tests do not wait in real time.\n */\nexport async function pollDeviceAuth(\n\thubUrl: string,\n\tstart: DeviceAuthStart,\n\toptions: {\n\t\tsignal?: AbortSignal;\n\t\tsleep?: (ms: number) => Promise<void>;\n\t\tnow?: () => number;\n\t} = {},\n): Promise<DeviceAuthResult> {\n\tconst sleep = options.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n\tconst now = options.now ?? (() => Date.now());\n\tconst deadline = now() + start.expiresIn * 1000;\n\tlet intervalMs = start.interval * 1000;\n\n\twhile (true) {\n\t\tif (options.signal?.aborted) throw new DeviceAuthError(\"Login cancelled\", \"timeout\");\n\t\tawait sleep(intervalMs);\n\t\t// Re-check after sleeping: a request that expired while we waited should\n\t\t// not cost the hub another round trip.\n\t\tif (now() >= deadline) break;\n\n\t\tconst { status, data } = await postJson(\n\t\t\t`${hubApiBase(hubUrl)}/auth/device/poll`,\n\t\t\t{ deviceCode: start.deviceCode },\n\t\t\toptions.signal,\n\t\t);\n\n\t\tif (status === 200 && typeof data?.token === \"string\") {\n\t\t\treturn {\n\t\t\t\ttoken: data.token,\n\t\t\t\thubUrl: typeof data.hubUrl === \"string\" ? data.hubUrl : hubUrl,\n\t\t\t\ttokenId: typeof data.tokenId === \"string\" ? data.tokenId : undefined,\n\t\t\t};\n\t\t}\n\n\t\tswitch (data?.error) {\n\t\t\tcase \"authorization_pending\":\n\t\t\t\tbreak;\n\t\t\tcase \"slow_down\":\n\t\t\t\t// Back off to whatever the hub now advertises, or a second more.\n\t\t\t\tintervalMs = typeof data.interval === \"number\" ? data.interval * 1000 : intervalMs + 1000;\n\t\t\t\tbreak;\n\t\t\tcase \"access_denied\":\n\t\t\t\tthrow new DeviceAuthError(\"Login was denied in the browser\", \"access_denied\");\n\t\t\tcase \"expired_token\":\n\t\t\t\tthrow new DeviceAuthError(\"The login code expired or was already used\", \"expired_token\");\n\t\t\tdefault:\n\t\t\t\tthrow new DeviceAuthError(\n\t\t\t\t\tdata?.error ? String(data.error) : `Unexpected hub response (HTTP ${status})`,\n\t\t\t\t\t\"protocol\",\n\t\t\t\t);\n\t\t}\n\t}\n\n\tthrow new DeviceAuthError(\"Timed out waiting for approval\", \"timeout\");\n}\n"]}

package/dist/extensions/gitnexus/gateway.d.ts

@@ -0,0 +1,57 @@
+import type { ExtensionAPI } from "../../core/extensions/types.ts";
+import { type GitNexusConfig } from "./config.ts";
+/**
+ * Auto mode: models served through the hub's LLM gateway.
+ *
+ * The hub decides which model "auto" is and never tells the CLI — the policy
+ * endpoint serves budget numbers (context window, output cap), not a name, so
+ * there is nothing here that could display one. The entry the user sees is
+ * "Auto", and the hub can move the underlying model without a CLI release.
+ *
+ * Providers must exist before the initial model is resolved, which happens
+ * before any network round-trip could finish, so registration reads a policy
+ * cache written the last time the hub was reachable:
+ *
+ *   startup gate (already talks to the hub)  ->  refreshGatewayPolicy()
+ *   extension factory (synchronous)          ->  registerAutoProvider()
+ *
+ * The gate runs at every startup, so the cache is at most one session stale.
+ * Entitlement is the hub's call: a 404 from the policy endpoint (feature off
+ * for this account) deletes the cache and the next session has no Auto entry.
+ */
+export declare const AUTO_PROVIDER_ID = "gitnexus";
+export declare const AUTO_MODEL_ID = "auto";
+export interface GatewayPolicy {
+    configured: boolean;
+    contextWindow: number;
+    maxTokens: number;
+    usage?: {
+        used: number;
+        limit: number;
+    };
+}
+export declare function gatewayCachePath(): string;
+/** Cached policy from the last successful refresh, or undefined. */
+export declare function readGatewayCache(path?: string): GatewayPolicy | undefined;
+/**
+ * Ask the hub what auto mode looks like for this account and cache the answer.
+ *
+ * Never throws: auto mode is additive, and a hub outage at startup must not
+ * cost the user their session. A definitive "no" (404: not entitled; 401/403:
+ * bad credential) clears the cache; a transient failure keeps it, so a flaky
+ * network does not flap the Auto entry in and out of the model list.
+ */
+export declare function refreshGatewayPolicy(config: GitNexusConfig | undefined, options?: {
+    fetchImpl?: typeof fetch;
+    cachePath?: string;
+    timeoutMs?: number;
+}): Promise<GatewayPolicy | undefined>;
+/**
+ * Register the Auto entry. Synchronous — called from the extension factory so
+ * the provider exists before initial model resolution.
+ *
+ * No config, no cache, or a gateway with no upstream key all mean no
+ * registration: an Auto entry that cannot serve a request is worse than none.
+ */
+export declare function registerAutoProvider(pi: ExtensionAPI, config: GitNexusConfig | undefined, policy: GatewayPolicy | undefined): boolean;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/extensions/gitnexus/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/gateway.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,aAAa,CAAC;AAGtE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAC3C,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAA2B,GAAG,aAAa,GAAG,SAAS,CAa7F;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAGzC,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChF,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAuCpC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,MAAM,EAAE,aAAa,GAAG,SAAS,GAC/B,OAAO,CAgCT","sourcesContent":["import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { type GitNexusConfig, gitNexusConfigPath } from \"./config.ts\";\nimport { hubApiBase } from \"./device-auth.ts\";\n\n/**\n * Auto mode: models served through the hub's LLM gateway.\n *\n * The hub decides which model \"auto\" is and never tells the CLI — the policy\n * endpoint serves budget numbers (context window, output cap), not a name, so\n * there is nothing here that could display one. The entry the user sees is\n * \"Auto\", and the hub can move the underlying model without a CLI release.\n *\n * Providers must exist before the initial model is resolved, which happens\n * before any network round-trip could finish, so registration reads a policy\n * cache written the last time the hub was reachable:\n *\n *   startup gate (already talks to the hub)  ->  refreshGatewayPolicy()\n *   extension factory (synchronous)          ->  registerAutoProvider()\n *\n * The gate runs at every startup, so the cache is at most one session stale.\n * Entitlement is the hub's call: a 404 from the policy endpoint (feature off\n * for this account) deletes the cache and the next session has no Auto entry.\n */\n\nexport const AUTO_PROVIDER_ID = \"gitnexus\";\nexport const AUTO_MODEL_ID = \"auto\";\n\nexport interface GatewayPolicy {\n\tconfigured: boolean;\n\tcontextWindow: number;\n\tmaxTokens: number;\n\tusage?: { used: number; limit: number };\n}\n\nexport function gatewayCachePath(): string {\n\treturn join(dirname(gitNexusConfigPath()), \"gateway.json\");\n}\n\n/** Cached policy from the last successful refresh, or undefined. */\nexport function readGatewayCache(path: string = gatewayCachePath()): GatewayPolicy | undefined {\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<GatewayPolicy>;\n\t\tif (typeof parsed.contextWindow !== \"number\" || typeof parsed.maxTokens !== \"number\") return undefined;\n\t\treturn {\n\t\t\tconfigured: parsed.configured === true,\n\t\t\tcontextWindow: parsed.contextWindow,\n\t\t\tmaxTokens: parsed.maxTokens,\n\t\t\tusage: parsed.usage,\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Ask the hub what auto mode looks like for this account and cache the answer.\n *\n * Never throws: auto mode is additive, and a hub outage at startup must not\n * cost the user their session. A definitive \"no\" (404: not entitled; 401/403:\n * bad credential) clears the cache; a transient failure keeps it, so a flaky\n * network does not flap the Auto entry in and out of the model list.\n */\nexport async function refreshGatewayPolicy(\n\t// No default: an explicit `undefined` must mean signed out, never \"read the\n\t// real config\" — a test passing undefined once sent a real token upstream.\n\tconfig: GitNexusConfig | undefined,\n\toptions: { fetchImpl?: typeof fetch; cachePath?: string; timeoutMs?: number } = {},\n): Promise<GatewayPolicy | undefined> {\n\tconst cachePath = options.cachePath ?? gatewayCachePath();\n\tif (!config) return undefined;\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\n\ttry {\n\t\tconst response = await fetchImpl(`${hubApiBase(config.hubUrl)}/llm/policy`, {\n\t\t\t// Device-bound tokens are rejected without the fingerprint headers the\n\t\t\t// login flow registered them with, so these mirror GitNexusClient.\n\t\t\theaders: {\n\t\t\t\tauthorization: `Bearer ${config.token}`,\n\t\t\t\taccept: \"application/json\",\n\t\t\t\t...(config.deviceFingerprint ? { \"x-device-fingerprint\": config.deviceFingerprint } : {}),\n\t\t\t\t...(config.deviceName ? { \"x-device-name\": config.deviceName } : {}),\n\t\t\t},\n\t\t\tsignal: AbortSignal.timeout(options.timeoutMs ?? 10_000),\n\t\t});\n\t\tif (response.status === 404 || response.status === 401 || response.status === 403) {\n\t\t\trmSync(cachePath, { force: true });\n\t\t\treturn undefined;\n\t\t}\n\t\tif (!response.ok) return readGatewayCache(cachePath);\n\n\t\tconst body = (await response.json()) as Partial<GatewayPolicy>;\n\t\tif (typeof body.contextWindow !== \"number\" || typeof body.maxTokens !== \"number\") {\n\t\t\treturn readGatewayCache(cachePath);\n\t\t}\n\t\tconst policy: GatewayPolicy = {\n\t\t\tconfigured: body.configured === true,\n\t\t\tcontextWindow: body.contextWindow,\n\t\t\tmaxTokens: body.maxTokens,\n\t\t\tusage: body.usage,\n\t\t};\n\t\tif (!existsSync(dirname(cachePath))) mkdirSync(dirname(cachePath), { recursive: true, mode: 0o700 });\n\t\twriteFileSync(cachePath, JSON.stringify(policy), { mode: 0o600 });\n\t\treturn policy;\n\t} catch {\n\t\treturn readGatewayCache(cachePath);\n\t}\n}\n\n/**\n * Register the Auto entry. Synchronous — called from the extension factory so\n * the provider exists before initial model resolution.\n *\n * No config, no cache, or a gateway with no upstream key all mean no\n * registration: an Auto entry that cannot serve a request is worse than none.\n */\nexport function registerAutoProvider(\n\tpi: ExtensionAPI,\n\tconfig: GitNexusConfig | undefined,\n\tpolicy: GatewayPolicy | undefined,\n): boolean {\n\tif (!config || !policy || !policy.configured) return false;\n\n\tpi.registerProvider(AUTO_PROVIDER_ID, {\n\t\tname: \"GitNexus\",\n\t\tbaseUrl: `${hubApiBase(config.hubUrl)}/llm`,\n\t\tapiKey: config.token,\n\t\tauthHeader: true,\n\t\t// Device-bound tokens 403 without the fingerprint they were minted with.\n\t\theaders: {\n\t\t\t...(config.deviceFingerprint ? { \"x-device-fingerprint\": config.deviceFingerprint } : {}),\n\t\t\t...(config.deviceName ? { \"x-device-name\": config.deviceName } : {}),\n\t\t},\n\t\tapi: \"openai-completions\",\n\t\tmodels: [\n\t\t\t{\n\t\t\t\tid: AUTO_MODEL_ID,\n\t\t\t\tname: \"Auto\",\n\t\t\t\t// The hub may route to a reasoning model, but reasoning controls are\n\t\t\t\t// provider-specific and \"auto\" promises nothing about the provider —\n\t\t\t\t// so none are offered.\n\t\t\t\treasoning: false,\n\t\t\t\tinput: [\"text\", \"image\"],\n\t\t\t\t// Spend is metered hub-side against a monthly allowance; there is no\n\t\t\t\t// per-token price to show.\n\t\t\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\t\t\tcontextWindow: policy.contextWindow,\n\t\t\t\tmaxTokens: policy.maxTokens,\n\t\t\t},\n\t\t],\n\t});\n\treturn true;\n}\n"]}

package/dist/extensions/gitnexus/gateway.js

@@ -0,0 +1,139 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { gitNexusConfigPath } from "./config.js";
+import { hubApiBase } from "./device-auth.js";
+/**
+ * Auto mode: models served through the hub's LLM gateway.
+ *
+ * The hub decides which model "auto" is and never tells the CLI — the policy
+ * endpoint serves budget numbers (context window, output cap), not a name, so
+ * there is nothing here that could display one. The entry the user sees is
+ * "Auto", and the hub can move the underlying model without a CLI release.
+ *
+ * Providers must exist before the initial model is resolved, which happens
+ * before any network round-trip could finish, so registration reads a policy
+ * cache written the last time the hub was reachable:
+ *
+ *   startup gate (already talks to the hub)  ->  refreshGatewayPolicy()
+ *   extension factory (synchronous)          ->  registerAutoProvider()
+ *
+ * The gate runs at every startup, so the cache is at most one session stale.
+ * Entitlement is the hub's call: a 404 from the policy endpoint (feature off
+ * for this account) deletes the cache and the next session has no Auto entry.
+ */
+export const AUTO_PROVIDER_ID = "gitnexus";
+export const AUTO_MODEL_ID = "auto";
+export function gatewayCachePath() {
+    return join(dirname(gitNexusConfigPath()), "gateway.json");
+}
+/** Cached policy from the last successful refresh, or undefined. */
+export function readGatewayCache(path = gatewayCachePath()) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof parsed.contextWindow !== "number" || typeof parsed.maxTokens !== "number")
+            return undefined;
+        return {
+            configured: parsed.configured === true,
+            contextWindow: parsed.contextWindow,
+            maxTokens: parsed.maxTokens,
+            usage: parsed.usage,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Ask the hub what auto mode looks like for this account and cache the answer.
+ *
+ * Never throws: auto mode is additive, and a hub outage at startup must not
+ * cost the user their session. A definitive "no" (404: not entitled; 401/403:
+ * bad credential) clears the cache; a transient failure keeps it, so a flaky
+ * network does not flap the Auto entry in and out of the model list.
+ */
+export async function refreshGatewayPolicy(
+// No default: an explicit `undefined` must mean signed out, never "read the
+// real config" — a test passing undefined once sent a real token upstream.
+config, options = {}) {
+    const cachePath = options.cachePath ?? gatewayCachePath();
+    if (!config)
+        return undefined;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    try {
+        const response = await fetchImpl(`${hubApiBase(config.hubUrl)}/llm/policy`, {
+            // Device-bound tokens are rejected without the fingerprint headers the
+            // login flow registered them with, so these mirror GitNexusClient.
+            headers: {
+                authorization: `Bearer ${config.token}`,
+                accept: "application/json",
+                ...(config.deviceFingerprint ? { "x-device-fingerprint": config.deviceFingerprint } : {}),
+                ...(config.deviceName ? { "x-device-name": config.deviceName } : {}),
+            },
+            signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+        });
+        if (response.status === 404 || response.status === 401 || response.status === 403) {
+            rmSync(cachePath, { force: true });
+            return undefined;
+        }
+        if (!response.ok)
+            return readGatewayCache(cachePath);
+        const body = (await response.json());
+        if (typeof body.contextWindow !== "number" || typeof body.maxTokens !== "number") {
+            return readGatewayCache(cachePath);
+        }
+        const policy = {
+            configured: body.configured === true,
+            contextWindow: body.contextWindow,
+            maxTokens: body.maxTokens,
+            usage: body.usage,
+        };
+        if (!existsSync(dirname(cachePath)))
+            mkdirSync(dirname(cachePath), { recursive: true, mode: 0o700 });
+        writeFileSync(cachePath, JSON.stringify(policy), { mode: 0o600 });
+        return policy;
+    }
+    catch {
+        return readGatewayCache(cachePath);
+    }
+}
+/**
+ * Register the Auto entry. Synchronous — called from the extension factory so
+ * the provider exists before initial model resolution.
+ *
+ * No config, no cache, or a gateway with no upstream key all mean no
+ * registration: an Auto entry that cannot serve a request is worse than none.
+ */
+export function registerAutoProvider(pi, config, policy) {
+    if (!config || !policy || !policy.configured)
+        return false;
+    pi.registerProvider(AUTO_PROVIDER_ID, {
+        name: "GitNexus",
+        baseUrl: `${hubApiBase(config.hubUrl)}/llm`,
+        apiKey: config.token,
+        authHeader: true,
+        // Device-bound tokens 403 without the fingerprint they were minted with.
+        headers: {
+            ...(config.deviceFingerprint ? { "x-device-fingerprint": config.deviceFingerprint } : {}),
+            ...(config.deviceName ? { "x-device-name": config.deviceName } : {}),
+        },
+        api: "openai-completions",
+        models: [
+            {
+                id: AUTO_MODEL_ID,
+                name: "Auto",
+                // The hub may route to a reasoning model, but reasoning controls are
+                // provider-specific and "auto" promises nothing about the provider —
+                // so none are offered.
+                reasoning: false,
+                input: ["text", "image"],
+                // Spend is metered hub-side against a monthly allowance; there is no
+                // per-token price to show.
+                cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                contextWindow: policy.contextWindow,
+                maxTokens: policy.maxTokens,
+            },
+        ],
+    });
+    return true;
+}
+//# sourceMappingURL=gateway.js.map

package/dist/extensions/gitnexus/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../src/extensions/gitnexus/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAuB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AASpC,MAAM,UAAU,gBAAgB,GAAW;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAAA,CAC3D;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAW,gBAAgB,EAAE,EAA6B;IAC9F,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAC;QAChF,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvG,OAAO;YACN,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI;YACtC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;AACzC,4EAA4E;AAC5E,6EAA2E;AAC3E,MAAkC,EAClC,OAAO,GAAyE,EAAE,EAC7C;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3E,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;gBACvC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnF,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClF,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAkB;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI;YACpC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AAAA,CACD;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CACnC,EAAgB,EAChB,MAAkC,EAClC,MAAiC,EACvB;IACV,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE3D,EAAE,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;QACrC,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;QAC3C,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,UAAU,EAAE,IAAI;QAChB,yEAAyE;QACzE,OAAO,EAAE;YACR,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE;QACD,GAAG,EAAE,oBAAoB;QACzB,MAAM,EAAE;YACP;gBACC,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,MAAM;gBACZ,qEAAqE;gBACrE,uEAAqE;gBACrE,uBAAuB;gBACvB,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;gBACxB,qEAAqE;gBACrE,2BAA2B;gBAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;gBAC1D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B;SACD;KACD,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AAAA,CACZ","sourcesContent":["import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { type GitNexusConfig, gitNexusConfigPath } from \"./config.ts\";\nimport { hubApiBase } from \"./device-auth.ts\";\n\n/**\n * Auto mode: models served through the hub's LLM gateway.\n *\n * The hub decides which model \"auto\" is and never tells the CLI — the policy\n * endpoint serves budget numbers (context window, output cap), not a name, so\n * there is nothing here that could display one. The entry the user sees is\n * \"Auto\", and the hub can move the underlying model without a CLI release.\n *\n * Providers must exist before the initial model is resolved, which happens\n * before any network round-trip could finish, so registration reads a policy\n * cache written the last time the hub was reachable:\n *\n *   startup gate (already talks to the hub)  ->  refreshGatewayPolicy()\n *   extension factory (synchronous)          ->  registerAutoProvider()\n *\n * The gate runs at every startup, so the cache is at most one session stale.\n * Entitlement is the hub's call: a 404 from the policy endpoint (feature off\n * for this account) deletes the cache and the next session has no Auto entry.\n */\n\nexport const AUTO_PROVIDER_ID = \"gitnexus\";\nexport const AUTO_MODEL_ID = \"auto\";\n\nexport interface GatewayPolicy {\n\tconfigured: boolean;\n\tcontextWindow: number;\n\tmaxTokens: number;\n\tusage?: { used: number; limit: number };\n}\n\nexport function gatewayCachePath(): string {\n\treturn join(dirname(gitNexusConfigPath()), \"gateway.json\");\n}\n\n/** Cached policy from the last successful refresh, or undefined. */\nexport function readGatewayCache(path: string = gatewayCachePath()): GatewayPolicy | undefined {\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<GatewayPolicy>;\n\t\tif (typeof parsed.contextWindow !== \"number\" || typeof parsed.maxTokens !== \"number\") return undefined;\n\t\treturn {\n\t\t\tconfigured: parsed.configured === true,\n\t\t\tcontextWindow: parsed.contextWindow,\n\t\t\tmaxTokens: parsed.maxTokens,\n\t\t\tusage: parsed.usage,\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Ask the hub what auto mode looks like for this account and cache the answer.\n *\n * Never throws: auto mode is additive, and a hub outage at startup must not\n * cost the user their session. A definitive \"no\" (404: not entitled; 401/403:\n * bad credential) clears the cache; a transient failure keeps it, so a flaky\n * network does not flap the Auto entry in and out of the model list.\n */\nexport async function refreshGatewayPolicy(\n\t// No default: an explicit `undefined` must mean signed out, never \"read the\n\t// real config\" — a test passing undefined once sent a real token upstream.\n\tconfig: GitNexusConfig | undefined,\n\toptions: { fetchImpl?: typeof fetch; cachePath?: string; timeoutMs?: number } = {},\n): Promise<GatewayPolicy | undefined> {\n\tconst cachePath = options.cachePath ?? gatewayCachePath();\n\tif (!config) return undefined;\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\n\ttry {\n\t\tconst response = await fetchImpl(`${hubApiBase(config.hubUrl)}/llm/policy`, {\n\t\t\t// Device-bound tokens are rejected without the fingerprint headers the\n\t\t\t// login flow registered them with, so these mirror GitNexusClient.\n\t\t\theaders: {\n\t\t\t\tauthorization: `Bearer ${config.token}`,\n\t\t\t\taccept: \"application/json\",\n\t\t\t\t...(config.deviceFingerprint ? { \"x-device-fingerprint\": config.deviceFingerprint } : {}),\n\t\t\t\t...(config.deviceName ? { \"x-device-name\": config.deviceName } : {}),\n\t\t\t},\n\t\t\tsignal: AbortSignal.timeout(options.timeoutMs ?? 10_000),\n\t\t});\n\t\tif (response.status === 404 || response.status === 401 || response.status === 403) {\n\t\t\trmSync(cachePath, { force: true });\n\t\t\treturn undefined;\n\t\t}\n\t\tif (!response.ok) return readGatewayCache(cachePath);\n\n\t\tconst body = (await response.json()) as Partial<GatewayPolicy>;\n\t\tif (typeof body.contextWindow !== \"number\" || typeof body.maxTokens !== \"number\") {\n\t\t\treturn readGatewayCache(cachePath);\n\t\t}\n\t\tconst policy: GatewayPolicy = {\n\t\t\tconfigured: body.configured === true,\n\t\t\tcontextWindow: body.contextWindow,\n\t\t\tmaxTokens: body.maxTokens,\n\t\t\tusage: body.usage,\n\t\t};\n\t\tif (!existsSync(dirname(cachePath))) mkdirSync(dirname(cachePath), { recursive: true, mode: 0o700 });\n\t\twriteFileSync(cachePath, JSON.stringify(policy), { mode: 0o600 });\n\t\treturn policy;\n\t} catch {\n\t\treturn readGatewayCache(cachePath);\n\t}\n}\n\n/**\n * Register the Auto entry. Synchronous — called from the extension factory so\n * the provider exists before initial model resolution.\n *\n * No config, no cache, or a gateway with no upstream key all mean no\n * registration: an Auto entry that cannot serve a request is worse than none.\n */\nexport function registerAutoProvider(\n\tpi: ExtensionAPI,\n\tconfig: GitNexusConfig | undefined,\n\tpolicy: GatewayPolicy | undefined,\n): boolean {\n\tif (!config || !policy || !policy.configured) return false;\n\n\tpi.registerProvider(AUTO_PROVIDER_ID, {\n\t\tname: \"GitNexus\",\n\t\tbaseUrl: `${hubApiBase(config.hubUrl)}/llm`,\n\t\tapiKey: config.token,\n\t\tauthHeader: true,\n\t\t// Device-bound tokens 403 without the fingerprint they were minted with.\n\t\theaders: {\n\t\t\t...(config.deviceFingerprint ? { \"x-device-fingerprint\": config.deviceFingerprint } : {}),\n\t\t\t...(config.deviceName ? { \"x-device-name\": config.deviceName } : {}),\n\t\t},\n\t\tapi: \"openai-completions\",\n\t\tmodels: [\n\t\t\t{\n\t\t\t\tid: AUTO_MODEL_ID,\n\t\t\t\tname: \"Auto\",\n\t\t\t\t// The hub may route to a reasoning model, but reasoning controls are\n\t\t\t\t// provider-specific and \"auto\" promises nothing about the provider —\n\t\t\t\t// so none are offered.\n\t\t\t\treasoning: false,\n\t\t\t\tinput: [\"text\", \"image\"],\n\t\t\t\t// Spend is metered hub-side against a monthly allowance; there is no\n\t\t\t\t// per-token price to show.\n\t\t\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\t\t\tcontextWindow: policy.contextWindow,\n\t\t\t\tmaxTokens: policy.maxTokens,\n\t\t\t},\n\t\t],\n\t});\n\treturn true;\n}\n"]}

package/dist/extensions/gitnexus/index.d.ts

@@ -0,0 +1,14 @@
+import type { ExtensionAPI } from "../../core/extensions/types.ts";
+/** Resolve workflow skills in source mode and bundled dist/cli.js mode. */
+export declare function resolveGitNexusSkillsDir(moduleUrl?: string, pathExists?: (path: string) => boolean): string | undefined;
+/**
+ * GitNexus built-in extension: connects nexus-cli to the GitNexus hub.
+ *
+ * - session_start: resolve config + repo inventory, register the six graph
+ *   tools and the augmented grep. No token / hub down / repo unindexed all
+ *   degrade to a plain coding agent (graph is additive, never load-bearing).
+ * - before_agent_start: append the GitNexus guidance block (ported from the
+ *   CLAUDE.md generator) to the system prompt.
+ */
+export default function gitnexusExtension(pi: ExtensionAPI): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/extensions/gitnexus/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/extensions/gitnexus/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAqBnE,2EAA2E;AAC3E,wBAAgB,wBAAwB,CACvC,SAAS,GAAE,MAAwB,EACnC,UAAU,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAChD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAuKhE","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { ExtensionAPI } from \"../../core/extensions/types.ts\";\nimport { graphRailStore } from \"../../core/graph-rail-store.ts\";\nimport { openBrowser } from \"../../utils/open-browser.ts\";\nimport { registerAugmentedGrep } from \"./augment.ts\";\nimport { registerChangeTracking } from \"./changes.ts\";\nimport { GitNexusClient, GitNexusClientError } from \"./client.ts\";\nimport { DEFAULT_HUB_URL, resolveGitNexusConfig, saveGitNexusConfig } from \"./config.ts\";\nimport { defaultDeviceName, deviceFingerprint, pollDeviceAuth, startDeviceAuth } from \"./device-auth.ts\";\nimport { readGatewayCache, registerAutoProvider } from \"./gateway.ts\";\nimport { spawnObservatoryFetch } from \"./observatory.ts\";\nimport { buildGitNexusPrompt } from \"./prompt.ts\";\nimport { withGitNexusRenderer } from \"./render.ts\";\nimport {\n\tgitRemoteSlug,\n\ttype IndexedRepo,\n\tmatchCurrentRepo,\n\tparseRepoInventory,\n\ttype RepoInventory,\n} from \"./resolve.ts\";\nimport { createGitNexusTools } from \"./tools.ts\";\n\n/** Resolve workflow skills in source mode and bundled dist/cli.js mode. */\nexport function resolveGitNexusSkillsDir(\n\tmoduleUrl: string = import.meta.url,\n\tpathExists: (path: string) => boolean = existsSync,\n): string | undefined {\n\tconst candidates = [\n\t\tfileURLToPath(new URL(\"./skills/\", moduleUrl)),\n\t\tfileURLToPath(new URL(\"./extensions/gitnexus/skills/\", moduleUrl)),\n\t];\n\treturn candidates.find(pathExists);\n}\n\n/**\n * GitNexus built-in extension: connects nexus-cli to the GitNexus hub.\n *\n * - session_start: resolve config + repo inventory, register the six graph\n *   tools and the augmented grep. No token / hub down / repo unindexed all\n *   degrade to a plain coding agent (graph is additive, never load-bearing).\n * - before_agent_start: append the GitNexus guidance block (ported from the\n *   CLAUDE.md generator) to the system prompt.\n */\nexport default function gitnexusExtension(pi: ExtensionAPI): void {\n\tlet inventory: RepoInventory | undefined;\n\tlet current: IndexedRepo | undefined;\n\tlet activeClient: GitNexusClient | undefined;\n\tlet toolsRegistered = false;\n\tlet startupNotice: string | undefined;\n\tlet loginRequired = false;\n\n\tconst cwd = process.cwd();\n\n\t// Auto mode must also register at factory time: the initial model is\n\t// resolved before session_start fires, and a provider that appears after\n\t// that is invisible to it. Reads the policy cache the startup gate wrote.\n\tregisterAutoProvider(pi, resolveGitNexusConfig(), readGatewayCache());\n\n\t// Built-in tool overrides must happen at factory time (like the bash-spawn-hook\n\t// example) — session_start registrations only add NEW names reliably. The wrapper\n\t// behaves as plain grep until connect() provides a client + current repo.\n\tregisterAugmentedGrep(\n\t\tpi,\n\t\tcwd,\n\t\t() => activeClient,\n\t\t() => current?.name,\n\t);\n\tregisterChangeTracking(pi, cwd);\n\n\tasync function connect(): Promise<void> {\n\t\tinventory = undefined;\n\t\tcurrent = undefined;\n\t\tactiveClient = undefined;\n\t\tstartupNotice = undefined;\n\t\tloginRequired = false;\n\t\tconst config = resolveGitNexusConfig();\n\t\tif (!config) return;\n\t\tconst client = new GitNexusClient(config);\n\t\ttry {\n\t\t\tconst listResult = await client.callTool(\"list_repos\", {});\n\t\t\tinventory = parseRepoInventory(GitNexusClient.text(listResult));\n\t\t} catch (error) {\n\t\t\tconst reason = error instanceof GitNexusClientError ? error.message : String(error);\n\t\t\tif (error instanceof GitNexusClientError && error.kind === \"auth\") {\n\t\t\t\tloginRequired = true;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tstartupNotice = `GitNexus unavailable: ${reason}`;\n\t\t\treturn;\n\t\t}\n\n\t\tcurrent = matchCurrentRepo(inventory, gitRemoteSlug(cwd));\n\t\tactiveClient = client;\n\t\tgraphRailStore.setRepoList(inventory.repos.map((repo) => ({ name: repo.name, symbols: repo.symbols })));\n\t\t// Observatory (community map) rides a detached subprocess + temp-file\n\t\t// handoff — in-process hub calls made after startup can starve in some\n\t\t// environments, a fresh process never does. The UI picks the file up\n\t\t// lazily via tryLoadObservatoryCache.\n\t\tif (current) spawnObservatoryFetch(config, current.name);\n\t\tgraphRailStore.setRepo(\n\t\t\tcurrent\n\t\t\t\t? {\n\t\t\t\t\t\tname: current.name,\n\t\t\t\t\t\tsymbols: current.symbols,\n\t\t\t\t\t\trelationships: current.relationships,\n\t\t\t\t\t\tindexedAt: current.indexedAt,\n\t\t\t\t\t\trepoCount: inventory.repos.length,\n\t\t\t\t\t}\n\t\t\t\t: {\n\t\t\t\t\t\tname: \"\",\n\t\t\t\t\t\tsymbols: \"0\",\n\t\t\t\t\t\trelationships: \"0\",\n\t\t\t\t\t\tindexedAt: \"\",\n\t\t\t\t\t\trepoCount: inventory.repos.length,\n\t\t\t\t\t},\n\t\t\tcurrent !== undefined,\n\t\t);\n\t\tif (!toolsRegistered) {\n\t\t\tconst ctx = { client, currentRepo: () => current?.name, cwd };\n\t\t\tfor (const tool of createGitNexusTools(ctx)) pi.registerTool(withGitNexusRenderer(tool));\n\t\t\ttoolsRegistered = true;\n\t\t}\n\n\t\tstartupNotice = current\n\t\t\t? `GitNexus: connected — ${current.name} (${current.symbols} symbols, indexed ${current.indexedAt}), ${inventory.repos.length} repos available.`\n\t\t\t: `GitNexus: connected — current directory is not indexed; ${inventory.repos.length} indexed repos remain queryable. Index this repo from the Hub dashboard to unlock local graph context.`;\n\t}\n\n\tpi.on(\"session_start\", async (_event, ctx) => {\n\t\tawait connect();\n\t\tif (startupNotice) ctx.ui.notify(startupNotice, inventory ? \"info\" : \"warning\");\n\t});\n\n\t// Bundled GitNexus workflow skills (debugging, exploring, impact-analysis,\n\t// refactoring, pr-review, guide) — same SKILL.md content the Claude plugin\n\t// ships, adapted for hub-based indexing. Loaded on-demand by pi's skill system.\n\t// Skipped entirely when the user already has gitnexus skills (project or\n\t// global) so the startup screen doesn't report shadowed duplicates.\n\tpi.on(\"resources_discover\", (event) => {\n\t\tconst hasOwnGitnexusSkills =\n\t\t\texistsSync(join(event.cwd, \".agents\", \"skills\", \"gitnexus\")) ||\n\t\t\texistsSync(join(homedir(), \".agents\", \"skills\", \"gitnexus-debugging\"));\n\t\tif (hasOwnGitnexusSkills) return;\n\t\tconst skillsDir = resolveGitNexusSkillsDir();\n\t\tif (!skillsDir) return;\n\t\treturn { skillPaths: [skillsDir] };\n\t});\n\n\tpi.on(\"before_agent_start\", (event) => {\n\t\tif (!inventory) return;\n\t\treturn { systemPrompt: `${event.systemPrompt}\\n\\n${buildGitNexusPrompt(inventory, current)}` };\n\t});\n\n\tpi.registerCommand(\"gitnexus-login\", {\n\t\tdescription: \"Sign in to GitNexus (implementation of /login → GitNexus account; accepts a pasted token)\",\n\t\thandler: async (args, ctx) => {\n\t\t\tconst hubUrl = process.env.GITNEXUS_HUB_URL ?? DEFAULT_HUB_URL;\n\t\t\tconst pasted = args.trim();\n\n\t\t\t// Pasting a token stays supported for CI and headless installs.\n\t\t\tif (pasted) {\n\t\t\t\tawait new GitNexusClient({ hubUrl, token: pasted }).callTool(\"list_repos\", {});\n\t\t\t\tconst path = saveGitNexusConfig({ hubUrl, token: pasted });\n\t\t\t\tawait connect();\n\t\t\t\tctx.ui.notify(`GitNexus token saved to ${path}. ${startupNotice ?? \"\"}`, \"info\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst deviceName = defaultDeviceName();\n\t\t\t\tconst fingerprint = deviceFingerprint();\n\t\t\t\tconst start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });\n\t\t\t\tconst link = start.verificationUrlComplete ?? start.verificationUrl;\n\t\t\t\t// The link carries the code, so an opened browser needs no typing.\n\t\t\t\t// Print it too: the launcher is best effort and can be headless.\n\t\t\t\tctx.ui.notify(`Code ${start.userCode} — opening ${link}`, \"info\");\n\t\t\t\topenBrowser(link);\n\n\t\t\t\tconst result = await pollDeviceAuth(hubUrl, start);\n\t\t\t\tconst config = {\n\t\t\t\t\thubUrl: result.hubUrl,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tdeviceFingerprint: fingerprint,\n\t\t\t\t\tdeviceName,\n\t\t\t\t};\n\t\t\t\tawait new GitNexusClient(config).callTool(\"list_repos\", {});\n\t\t\t\tconst path = saveGitNexusConfig(config);\n\t\t\t\tawait connect();\n\t\t\t\tctx.ui.notify(`Signed in. Token saved to ${path}. ${startupNotice ?? \"\"}`, \"info\");\n\t\t\t} catch (error) {\n\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\tctx.ui.notify(`GitNexus login failed: ${message}`, \"error\");\n\t\t\t}\n\t\t},\n\t});\n\n\tpi.registerCommand(\"gitnexus-status\", {\n\t\tdescription: \"Show GitNexus connection status\",\n\t\thandler: async (_args, ctx) => {\n\t\t\tif (!inventory) {\n\t\t\t\tconst message = loginRequired\n\t\t\t\t\t? \"GitNexus session expired. Run /login to sign in again.\"\n\t\t\t\t\t: (startupNotice ?? \"GitNexus: not signed in. Run /login.\");\n\t\t\t\tctx.ui.notify(message, \"warning\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst repoLine = current ? `current repo: ${current.name}` : \"current repo: not indexed\";\n\t\t\tctx.ui.notify(`GitNexus: connected — ${inventory.repos.length} repos, ${repoLine}`, \"info\");\n\t\t},\n\t});\n}\n"]}

package/dist/extensions/gitnexus/index.js

@@ -0,0 +1,189 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { graphRailStore } from "../../core/graph-rail-store.js";
+import { openBrowser } from "../../utils/open-browser.js";
+import { registerAugmentedGrep } from "./augment.js";
+import { registerChangeTracking } from "./changes.js";
+import { GitNexusClient, GitNexusClientError } from "./client.js";
+import { DEFAULT_HUB_URL, resolveGitNexusConfig, saveGitNexusConfig } from "./config.js";
+import { defaultDeviceName, deviceFingerprint, pollDeviceAuth, startDeviceAuth } from "./device-auth.js";
+import { readGatewayCache, registerAutoProvider } from "./gateway.js";
+import { spawnObservatoryFetch } from "./observatory.js";
+import { buildGitNexusPrompt } from "./prompt.js";
+import { withGitNexusRenderer } from "./render.js";
+import { gitRemoteSlug, matchCurrentRepo, parseRepoInventory, } from "./resolve.js";
+import { createGitNexusTools } from "./tools.js";
+/** Resolve workflow skills in source mode and bundled dist/cli.js mode. */
+export function resolveGitNexusSkillsDir(moduleUrl = import.meta.url, pathExists = existsSync) {
+    const candidates = [
+        fileURLToPath(new URL("./skills/", moduleUrl)),
+        fileURLToPath(new URL("./extensions/gitnexus/skills/", moduleUrl)),
+    ];
+    return candidates.find(pathExists);
+}
+/**
+ * GitNexus built-in extension: connects nexus-cli to the GitNexus hub.
+ *
+ * - session_start: resolve config + repo inventory, register the six graph
+ *   tools and the augmented grep. No token / hub down / repo unindexed all
+ *   degrade to a plain coding agent (graph is additive, never load-bearing).
+ * - before_agent_start: append the GitNexus guidance block (ported from the
+ *   CLAUDE.md generator) to the system prompt.
+ */
+export default function gitnexusExtension(pi) {
+    let inventory;
+    let current;
+    let activeClient;
+    let toolsRegistered = false;
+    let startupNotice;
+    let loginRequired = false;
+    const cwd = process.cwd();
+    // Auto mode must also register at factory time: the initial model is
+    // resolved before session_start fires, and a provider that appears after
+    // that is invisible to it. Reads the policy cache the startup gate wrote.
+    registerAutoProvider(pi, resolveGitNexusConfig(), readGatewayCache());
+    // Built-in tool overrides must happen at factory time (like the bash-spawn-hook
+    // example) — session_start registrations only add NEW names reliably. The wrapper
+    // behaves as plain grep until connect() provides a client + current repo.
+    registerAugmentedGrep(pi, cwd, () => activeClient, () => current?.name);
+    registerChangeTracking(pi, cwd);
+    async function connect() {
+        inventory = undefined;
+        current = undefined;
+        activeClient = undefined;
+        startupNotice = undefined;
+        loginRequired = false;
+        const config = resolveGitNexusConfig();
+        if (!config)
+            return;
+        const client = new GitNexusClient(config);
+        try {
+            const listResult = await client.callTool("list_repos", {});
+            inventory = parseRepoInventory(GitNexusClient.text(listResult));
+        }
+        catch (error) {
+            const reason = error instanceof GitNexusClientError ? error.message : String(error);
+            if (error instanceof GitNexusClientError && error.kind === "auth") {
+                loginRequired = true;
+                return;
+            }
+            startupNotice = `GitNexus unavailable: ${reason}`;
+            return;
+        }
+        current = matchCurrentRepo(inventory, gitRemoteSlug(cwd));
+        activeClient = client;
+        graphRailStore.setRepoList(inventory.repos.map((repo) => ({ name: repo.name, symbols: repo.symbols })));
+        // Observatory (community map) rides a detached subprocess + temp-file
+        // handoff — in-process hub calls made after startup can starve in some
+        // environments, a fresh process never does. The UI picks the file up
+        // lazily via tryLoadObservatoryCache.
+        if (current)
+            spawnObservatoryFetch(config, current.name);
+        graphRailStore.setRepo(current
+            ? {
+                name: current.name,
+                symbols: current.symbols,
+                relationships: current.relationships,
+                indexedAt: current.indexedAt,
+                repoCount: inventory.repos.length,
+            }
+            : {
+                name: "",
+                symbols: "0",
+                relationships: "0",
+                indexedAt: "",
+                repoCount: inventory.repos.length,
+            }, current !== undefined);
+        if (!toolsRegistered) {
+            const ctx = { client, currentRepo: () => current?.name, cwd };
+            for (const tool of createGitNexusTools(ctx))
+                pi.registerTool(withGitNexusRenderer(tool));
+            toolsRegistered = true;
+        }
+        startupNotice = current
+            ? `GitNexus: connected — ${current.name} (${current.symbols} symbols, indexed ${current.indexedAt}), ${inventory.repos.length} repos available.`
+            : `GitNexus: connected — current directory is not indexed; ${inventory.repos.length} indexed repos remain queryable. Index this repo from the Hub dashboard to unlock local graph context.`;
+    }
+    pi.on("session_start", async (_event, ctx) => {
+        await connect();
+        if (startupNotice)
+            ctx.ui.notify(startupNotice, inventory ? "info" : "warning");
+    });
+    // Bundled GitNexus workflow skills (debugging, exploring, impact-analysis,
+    // refactoring, pr-review, guide) — same SKILL.md content the Claude plugin
+    // ships, adapted for hub-based indexing. Loaded on-demand by pi's skill system.
+    // Skipped entirely when the user already has gitnexus skills (project or
+    // global) so the startup screen doesn't report shadowed duplicates.
+    pi.on("resources_discover", (event) => {
+        const hasOwnGitnexusSkills = existsSync(join(event.cwd, ".agents", "skills", "gitnexus")) ||
+            existsSync(join(homedir(), ".agents", "skills", "gitnexus-debugging"));
+        if (hasOwnGitnexusSkills)
+            return;
+        const skillsDir = resolveGitNexusSkillsDir();
+        if (!skillsDir)
+            return;
+        return { skillPaths: [skillsDir] };
+    });
+    pi.on("before_agent_start", (event) => {
+        if (!inventory)
+            return;
+        return { systemPrompt: `${event.systemPrompt}\n\n${buildGitNexusPrompt(inventory, current)}` };
+    });
+    pi.registerCommand("gitnexus-login", {
+        description: "Sign in to GitNexus (implementation of /login → GitNexus account; accepts a pasted token)",
+        handler: async (args, ctx) => {
+            const hubUrl = process.env.GITNEXUS_HUB_URL ?? DEFAULT_HUB_URL;
+            const pasted = args.trim();
+            // Pasting a token stays supported for CI and headless installs.
+            if (pasted) {
+                await new GitNexusClient({ hubUrl, token: pasted }).callTool("list_repos", {});
+                const path = saveGitNexusConfig({ hubUrl, token: pasted });
+                await connect();
+                ctx.ui.notify(`GitNexus token saved to ${path}. ${startupNotice ?? ""}`, "info");
+                return;
+            }
+            try {
+                const deviceName = defaultDeviceName();
+                const fingerprint = deviceFingerprint();
+                const start = await startDeviceAuth(hubUrl, { deviceName, deviceFingerprint: fingerprint });
+                const link = start.verificationUrlComplete ?? start.verificationUrl;
+                // The link carries the code, so an opened browser needs no typing.
+                // Print it too: the launcher is best effort and can be headless.
+                ctx.ui.notify(`Code ${start.userCode} — opening ${link}`, "info");
+                openBrowser(link);
+                const result = await pollDeviceAuth(hubUrl, start);
+                const config = {
+                    hubUrl: result.hubUrl,
+                    token: result.token,
+                    deviceFingerprint: fingerprint,
+                    deviceName,
+                };
+                await new GitNexusClient(config).callTool("list_repos", {});
+                const path = saveGitNexusConfig(config);
+                await connect();
+                ctx.ui.notify(`Signed in. Token saved to ${path}. ${startupNotice ?? ""}`, "info");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                ctx.ui.notify(`GitNexus login failed: ${message}`, "error");
+            }
+        },
+    });
+    pi.registerCommand("gitnexus-status", {
+        description: "Show GitNexus connection status",
+        handler: async (_args, ctx) => {
+            if (!inventory) {
+                const message = loginRequired
+                    ? "GitNexus session expired. Run /login to sign in again."
+                    : (startupNotice ?? "GitNexus: not signed in. Run /login.");
+                ctx.ui.notify(message, "warning");
+                return;
+            }
+            const repoLine = current ? `current repo: ${current.name}` : "current repo: not indexed";
+            ctx.ui.notify(`GitNexus: connected — ${inventory.repos.length} repos, ${repoLine}`, "info");
+        },
+    });
+}
+//# sourceMappingURL=index.js.map