@bastani/atomic 0.6.8 → 0.7.0-2

package/src/services/system/auth.ts

@@ -1,140 +0,0 @@
-/**
- * Fail-fast login checks for the agent CLIs atomic drives.
- *
- * Copilot exposes `CopilotClient.getAuthStatus()` — a thin JSON-RPC call
- * that returns `isAuthenticated: boolean`. Claude Agent SDK has no
- * direct "is signed in" primitive, but `query().initializationResult()`
- * returns an `account` record populated with `email`, `tokenSource`,
- * and/or `apiKeySource` whenever the CLI has valid credentials — an
- * empty record means the user never completed the OAuth flow and no
- * API key is in the environment.
- *
- * We run these probes BEFORE spawning the native CLI from `atomic chat`
- * or `atomic workflow` so the user sees a short actionable error
- * instead of dropping into an interactive agent that immediately
- * prompts for login (or, in the workflow case, silently stalls).
- */
-
-import type { AgentKey } from "../config/index.ts";
-import { COLORS } from "../../theme/colors.ts";
-import { copilotSdkLaunchOptions } from "../../sdk/providers/copilot.ts";
-import { withAtomicTempEnv } from "../../lib/atomic-temp.ts";
-
-export interface AuthCheckResult {
-  /** True when the SDK reports the user is authenticated. */
-  loggedIn: boolean;
-  /** Optional human-readable detail — usually the SDK's status message. */
-  detail?: string;
-  /** Login identity if reported (GitHub login for Copilot, email for Claude). */
-  identity?: string;
-}
-
-/**
- * Verify the user is authenticated for the given agent. For agents that
- * do not expose an SDK-level auth probe (currently `opencode`), returns
- * `{ loggedIn: true }` so the caller can skip the check.
- */
-export async function checkAgentAuth(agent: AgentKey): Promise<AuthCheckResult> {
-  if (agent === "copilot") return checkCopilotAuth();
-  if (agent === "claude") return checkClaudeAuth();
-  return { loggedIn: true };
-}
-
-/**
- * Print a consistent login-required banner to stderr. Exported so
- * `chatCommand` and `workflowCommand` share the same wording.
- */
-export function printAuthError(agent: AgentKey, result: AuthCheckResult): void {
-  const { name, loginHint } = AUTH_PROMPTS[agent];
-  console.error(
-    `${COLORS.red}Error: Not logged in to ${name}.${COLORS.reset}`,
-  );
-  if (result.detail) {
-    console.error(`${COLORS.dim}${result.detail}${COLORS.reset}`);
-  }
-  console.error(loginHint);
-}
-
-const AUTH_PROMPTS: Record<AgentKey, { name: string; loginHint: string }> = {
-  claude: {
-    name: "Claude Code",
-    loginHint:
-      "Run `claude` and complete the /login flow (or set ANTHROPIC_API_KEY), then retry.",
-  },
-  copilot: {
-    name: "GitHub Copilot CLI",
-    loginHint: "Run `copilot` and complete the `/login` flow, then retry.",
-  },
-  opencode: {
-    name: "OpenCode",
-    loginHint: "Run `opencode auth login`, then retry.",
-  },
-};
-
-async function checkCopilotAuth(): Promise<AuthCheckResult> {
-  const { CopilotClient } = await import("@github/copilot-sdk");
-  const client = new CopilotClient(copilotSdkLaunchOptions());
-  try {
-    await client.start();
-    const status = await client.getAuthStatus();
-    return {
-      loggedIn: status.isAuthenticated,
-      detail: status.statusMessage,
-      identity: status.login,
-    };
-  } catch (err) {
-    return {
-      loggedIn: false,
-      detail: err instanceof Error ? err.message : String(err),
-    };
-  } finally {
-    try {
-      await client.stop();
-    } catch {
-      // Best effort — a failed stop shouldn't shadow the probe result.
-    }
-  }
-}
-
-async function checkClaudeAuth(): Promise<AuthCheckResult> {
-  const { query } = await import("@anthropic-ai/claude-agent-sdk");
-  const { resolveHeadlessClaudeBin } = await import("../../sdk/providers/claude.ts");
-
-  // A never-yielding iterable keeps the query idle while we probe the
-  // initialization result. The SDK starts the `claude` subprocess on
-  // query construction but only blocks on the stream once a prompt is
-  // actually delivered.
-  async function* emptyStream(): AsyncGenerator<never, void, void> {}
-
-  return await withAtomicTempEnv(async () => {
-    const q = query({
-      prompt: emptyStream(),
-      options: {
-        pathToClaudeCodeExecutable: resolveHeadlessClaudeBin(),
-      },
-    });
-
-    try {
-      const init = await q.initializationResult();
-      const account = init.account ?? {};
-      const loggedIn = Boolean(
-        account.email || account.tokenSource || account.apiKeySource,
-      );
-      return {
-        loggedIn,
-        identity: account.email,
-      };
-    } catch (err) {
-      return {
-        loggedIn: false,
-        detail: err instanceof Error ? err.message : String(err),
-      };
-    } finally {
-      try {
-        q.close();
-      } catch {
-        // Best effort — the subprocess is torn down on process exit anyway.
-      }
-    }
-  });
-}

package/src/services/system/auto-sync.ts

@@ -1,128 +0,0 @@
-/**
- * Lazy first-run sync of tooling deps, bundled agents, and global skills.
- *
- * Why this exists: bun's package manager does NOT execute the top-level
- * package's `postinstall` script on `bun add -g` / `bun update -g` — see
- * `src/install/PackageManager/install_with_manager.zig` (the
- * `!manager.options.global` guard around root lifecycle scripts). So
- * there's no install-time hook we can register from `package.json`.
- *
- * Instead, we detect a fresh install or upgrade lazily on CLI startup by
- * comparing the bundled `VERSION` constant against a marker file at
- * `~/.atomic/.synced-version`. On a mismatch we run the same setup the
- * production bootstrap installers (`install.sh` / `install.ps1`) provide,
- * silently in the background:
- *
- *     1. tmux / psmux            (terminal multiplexer for `chat` / `workflow`)
- *     2. global agent configs    (file copies — no network)
- *     3. @playwright/cli         (bun install -g)
- *     4. @llamaindex/liteparse   (bun install -g)
- *     5. @ast-grep/cli           (bun install -g)
- *     6. global skills           (file copies from bundled .agents/skills)
- *
- * All steps run silently. The only user-facing loading bar lives in the
- * bootstrap installers (install.sh / install.ps1). Failures are swallowed;
- * the marker is only written when every step succeeds, so the next launch
- * retries (all steps are idempotent).
- */
-
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { VERSION } from "../../version.ts";
-import {
-  hasRequiredMuxBinary,
-  ensureTmuxInstalled,
-  upgradeGlobalToolPackages,
-} from "../../lib/spawn.ts";
-import { installGlobalAgents } from "./agents.ts";
-import { installGlobalSkills } from "./skills.ts";
-import { seedGlobalAdditionalInstructions } from "../config/additional-instructions.ts";
-import { seedGlobalProviderEnvVars } from "../config/settings.ts";
-
-/** Path to the version marker. Honors ATOMIC_SETTINGS_HOME for tests. */
-function syncMarkerPath(): string {
-  const home = process.env.ATOMIC_SETTINGS_HOME ?? homedir();
-  return join(home, ".atomic", ".synced-version");
-}
-
-/**
- * True when running from an installed package (under `node_modules/`),
- * false on a dev checkout. Avoids triggering a full global setup on every
- * `bun run dev` in the repo.
- */
-function isInstalledPackage(): boolean {
-  return import.meta.dir.includes("node_modules");
-}
-
-/**
- * Write the version marker. Best-effort: a failed write just means the
- * next launch will re-sync, which is wasteful but not broken.
- */
-export async function markSynced(): Promise<void> {
-  try {
-    await Bun.write(syncMarkerPath(), VERSION);
-  } catch {
-    // Swallow — see docstring.
-  }
-}
-
-/**
- * Run a step silently, returning whether it succeeded.
- */
-async function silentStep(fn: () => Promise<unknown>): Promise<boolean> {
-  try {
-    await fn();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Sync tooling deps, bundled agents, and global skills if the marker
- * doesn't match the bundled VERSION. No-op in dev checkouts and when the
- * marker already matches the current version and the platform-native
- * multiplexer is present.
- *
- * Runs entirely silently — no spinner, no progress bar, no banner. The
- * only loading UI lives in the bootstrap installers (install.sh / install.ps1).
- */
-export async function autoSyncIfStale(): Promise<void> {
-  // Seed the global additional-instructions AGENTS.md on every CLI start —
-  // a single `existsSync` when already present, so cheap enough to run
-  // outside the installed-package gate. This way dev checkouts also get
-  // the file and the resolver in `additional-instructions.ts` always finds
-  // a non-`undefined` path on machines that have ever run `atomic`.
-  await silentStep(seedGlobalAdditionalInstructions);
-
-  if (!isInstalledPackage()) return;
-
-  let stored = "";
-  const marker = Bun.file(syncMarkerPath());
-  if (await marker.exists()) {
-    stored = (await marker.text()).trim();
-  }
-
-  if (stored === VERSION && hasRequiredMuxBinary()) return;
-
-  const steps = stored === VERSION
-    ? [silentStep(() => ensureTmuxInstalled({ quiet: true }))]
-    : [
-        silentStep(() => ensureTmuxInstalled({ quiet: true })),
-        silentStep(installGlobalAgents),
-        silentStep(upgradeGlobalToolPackages),
-        silentStep(installGlobalSkills),
-        silentStep(seedGlobalProviderEnvVars),
-      ];
-
-  // All steps run in parallel and silently. Failures are swallowed so the
-  // CLI can proceed. The marker is only written when every step succeeds;
-  // on partial failure the next launch retries (all steps are idempotent).
-  const results = await Promise.all(steps);
-
-  const allOk = results.every(Boolean);
-
-  if (allOk) {
-    await markSynced();
-  }
-}

package/src/services/system/copy.ts

@@ -1,392 +0,0 @@
-/**
- * Utilities for copying directories and files with exclusions
- */
-
-import { readdir, mkdir, stat, readFile } from "node:fs/promises";
-import { mkdirSync } from "node:fs";
-import { join, extname, relative, resolve } from "node:path";
-import type { Ignore } from "ignore";
-import { getOppositeScriptExtension } from "./detect.ts";
-import {
-  assertPathWithinRoot,
-  assertRealPathWithinRoot,
-  isPathWithinRoot,
-} from "../../lib/path-root-guard.ts";
-
-/**
- * Safely create a directory (and parents) without throwing on EEXIST.
- *
- * `mkdir` with `{ recursive: true }` is supposed to be idempotent, but
- * cloud-sync tools like OneDrive can create the directory between the
- * internal existence check and the actual syscall, causing a spurious
- * EEXIST error on Windows.  This wrapper absorbs that race.
- */
-export async function ensureDir(path: string): Promise<void> {
-  try {
-    await mkdir(path, { recursive: true });
-  } catch (error: unknown) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "EEXIST"
-    ) {
-      return;
-    }
-    throw error;
-  }
-}
-
-/**
- * Synchronous version of {@link ensureDir}.
- */
-export function ensureDirSync(path: string): void {
-  try {
-    mkdirSync(path, { recursive: true });
-  } catch (error: unknown) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as NodeJS.ErrnoException).code === "EEXIST"
-    ) {
-      return;
-    }
-    throw error;
-  }
-}
-
-/**
- * Normalize a path for cross-platform comparison.
- * Converts Windows backslashes to forward slashes so that exclusion
- * patterns work consistently on both Windows and Unix systems.
- *
- * @param p - The path to normalize
- * @returns The path with all backslashes converted to forward slashes
- */
-export function normalizePath(p: string): string {
-  return p.replace(/\\/g, "/");
-}
-
-/**
- * Check if a target path is safe (doesn't escape the base directory)
- * Protects against path traversal attacks
- */
-export function isPathSafe(basePath: string, targetPath: string): boolean {
-  const resolvedTarget = resolve(basePath, targetPath);
-  return isPathWithinRoot(basePath, resolvedTarget);
-}
-
-interface CopyOptions {
-  /** Paths to exclude (relative to source root or base names) */
-  exclude?: string[];
-  /** Gitignore-style filter for common junk patterns (via the `ignore` package) */
-  ignoreFilter?: Ignore;
-  /** Whether to skip scripts for the opposite platform */
-  skipOppositeScripts?: boolean;
-}
-
-/**
- * Copy a single file using Bun's file API
- * @throws Error if the copy operation fails
- */
-export async function copyFile(src: string, dest: string): Promise<void> {
-  if (resolve(src) === resolve(dest)) {
-    return;
-  }
-
-  try {
-    const srcFile = Bun.file(src);
-    await Bun.write(dest, srcFile);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to copy ${src} to ${dest}: ${message}`);
-  }
-}
-
-/**
- * Copy a symlink by dereferencing it (copying the target content as a regular file)
- * This ensures symlinks work on Windows without requiring special permissions
- * @throws Error if the copy operation fails
- */
-async function copySymlinkAsFile(
-  src: string,
-  dest: string,
-  sourceRoot: string,
-): Promise<void> {
-  try {
-    // Resolve the symlink and ensure it cannot escape the source root
-    const resolvedPath = await assertRealPathWithinRoot(
-      sourceRoot,
-      src,
-      "Symlink source",
-    );
-    const stats = await stat(resolvedPath);
-
-    if (stats.isFile()) {
-      // Copy the target file content
-      await copyFile(resolvedPath, dest);
-    }
-    // If symlink points to a directory, we skip it (rare case, could be handled if needed)
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to copy symlink ${src} to ${dest}: ${message}`);
-  }
-}
-
-async function copyFileWithOverwriteOption(
-  src: string,
-  dest: string,
-  overwriteExisting: boolean,
-): Promise<void> {
-  if (!overwriteExisting && (await pathExists(dest))) {
-    return;
-  }
-
-  await copyFile(src, dest);
-}
-
-async function copySymlinkAsFileWithOverwriteOption(
-  src: string,
-  dest: string,
-  sourceRoot: string,
-  overwriteExisting: boolean,
-): Promise<void> {
-  if (!overwriteExisting && (await pathExists(dest))) {
-    return;
-  }
-
-  await copySymlinkAsFile(src, dest, sourceRoot);
-}
-
-/**
- * Check if a path should be excluded based on exclusion rules.
- * Uses normalized paths (forward slashes) to ensure consistent matching
- * on both Windows and Unix systems.
- *
- * When an {@link Ignore} filter is provided, gitignore-style glob patterns
- * are evaluated first so common junk files (.DS_Store, node_modules, etc.)
- * are filtered automatically without polluting the explicit `exclude` list.
- */
-export function shouldExclude(
-  relativePath: string,
-  name: string,
-  exclude: string[],
-  ignoreFilter?: Ignore,
-): boolean {
-  const normalizedPath = normalizePath(relativePath);
-
-  // Gitignore-style patterns take precedence
-  if (ignoreFilter?.ignores(normalizedPath)) {
-    return true;
-  }
-
-  // Check if the name matches any exclusion
-  if (exclude.includes(name)) {
-    return true;
-  }
-
-  // Check if the relative path starts with any exclusion
-  for (const ex of exclude) {
-    const normalizedExclusion = normalizePath(ex);
-    if (
-      normalizedPath === normalizedExclusion ||
-      normalizedPath.startsWith(`${normalizedExclusion}/`)
-    ) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
-/**
- * Recursively copy a directory with exclusions
- *
- * @param src Source directory path
- * @param dest Destination directory path
- * @param options Copy options including exclusions
- * @param rootSrc Root source path for calculating relative paths (used internally)
- * @throws Error if the copy operation fails or path traversal is detected
- */
-async function copyDirInternal(
-  src: string,
-  dest: string,
-  options: CopyOptions = {},
-  rootSrc?: string,
-  rootDest?: string,
-  overwriteExisting: boolean = true,
-): Promise<void> {
-  try {
-    const { exclude = [], ignoreFilter, skipOppositeScripts = true } = options;
-    const root = rootSrc ?? src;
-    const destinationRoot = rootDest ?? dest;
-
-    assertPathWithinRoot(root, src, "Source path");
-    assertPathWithinRoot(destinationRoot, dest, "Destination path");
-
-    await assertRealPathWithinRoot(root, src, "Source path");
-
-    // Create destination directory
-    await ensureDir(dest);
-
-    // Read source directory entries
-    const entries = await readdir(src, { withFileTypes: true });
-
-    // Get the opposite script extension for filtering
-    const oppositeExt = getOppositeScriptExtension();
-
-    // Process entries in parallel for better performance
-    const copyPromises: Promise<void>[] = [];
-
-    for (const entry of entries) {
-      const srcPath = join(src, entry.name);
-      const destPath = join(dest, entry.name);
-
-      assertPathWithinRoot(root, srcPath, "Source entry path");
-      assertPathWithinRoot(destinationRoot, destPath, "Destination entry path");
-
-      if (!isPathSafe(src, entry.name) || !isPathSafe(dest, entry.name)) {
-        throw new Error(`Path traversal detected: ${entry.name}`);
-      }
-
-      // Calculate relative path from root using path.relative for cross-platform support
-      const relativePath = relative(root, srcPath);
-
-      if (relativePath.startsWith("..")) {
-        throw new Error(`Path traversal detected: ${srcPath}`);
-      }
-
-      // Check if this path should be excluded
-      if (shouldExclude(relativePath, entry.name, exclude, ignoreFilter)) {
-        continue;
-      }
-
-      // Skip scripts for the opposite platform
-      if (skipOppositeScripts && extname(entry.name) === oppositeExt) {
-        continue;
-      }
-
-      if (entry.isDirectory()) {
-        // Directories are processed recursively (which will parallelize their contents)
-        copyPromises.push(
-          copyDirInternal(
-            srcPath,
-            destPath,
-            options,
-            root,
-            destinationRoot,
-            overwriteExisting,
-          ),
-        );
-      } else if (entry.isFile()) {
-        copyPromises.push(
-          copyFileWithOverwriteOption(srcPath, destPath, overwriteExisting),
-        );
-      } else if (entry.isSymbolicLink()) {
-        // Dereference symlinks: resolve target and copy as regular file
-        copyPromises.push(
-          copySymlinkAsFileWithOverwriteOption(
-            srcPath,
-            destPath,
-            root,
-            overwriteExisting,
-          ),
-        );
-      }
-      // Skip other special files (block devices, etc.)
-    }
-
-    // Wait for all copy operations to complete
-    await Promise.all(copyPromises);
-  } catch (error) {
-    // Re-throw errors with more context if they don't already have it
-    if (error instanceof Error && error.message.includes("Failed to copy")) {
-      throw error;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to copy directory ${src} to ${dest}: ${message}`);
-  }
-}
-
-/**
- * Recursively copy a directory, overwriting existing destination files.
- */
-export async function copyDir(
-  src: string,
-  dest: string,
-  options: CopyOptions = {},
-  rootSrc?: string,
-  rootDest?: string,
-): Promise<void> {
-  await copyDirInternal(src, dest, options, rootSrc, rootDest, true);
-}
-
-/**
- * Recursively copy a directory without overwriting existing destination files.
- */
-export async function copyDirNonDestructive(
-  src: string,
-  dest: string,
-  options: CopyOptions = {},
-  rootSrc?: string,
-  rootDest?: string,
-): Promise<void> {
-  await copyDirInternal(src, dest, options, rootSrc, rootDest, false);
-}
-
-/**
- * Check if a path exists
- */
-export async function pathExists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Check if a path is a directory
- */
-export async function isDirectory(path: string): Promise<boolean> {
-  try {
-    const stats = await stat(path);
-    return stats.isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Check if a file is empty or contains only whitespace.
- * 
- * A file is considered empty if:
- * - It does not exist (returns true to allow overwrite)
- * - It has 0 bytes
- * - It contains only whitespace characters (for files under 1KB)
- * 
- * @param path - The path to the file to check
- * @returns true if the file is empty or whitespace-only, false otherwise
- */
-export async function isFileEmpty(path: string): Promise<boolean> {
-  try {
-    const stats = await stat(path);
-    
-    // 0-byte files are empty
-    if (stats.size === 0) {
-      return true;
-    }
-    
-    // For small files (under 1KB), check if content is whitespace-only
-    if (stats.size < 1024) {
-      const content = await readFile(path, "utf-8");
-      return content.trim().length === 0;
-    }
-    
-    // Large files with content are not empty
-    return false;
-  } catch {
-    // If file doesn't exist or can't be read, treat as empty (allow overwrite)
-    return true;
-  }
-}