@beunec/rivine 0.1.0

package/dist/api/workspace.js

@@ -0,0 +1,152 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+import { createHash } from 'node:crypto';
+import { MEDIATOR_MODE, TARGET_ENGINE, apiUrl } from '../config.js';
+import { accessToken } from '../auth/session.js';
+export class InsufficientCredits extends Error {
+    detail;
+    constructor(detail) {
+        super(detail);
+        this.detail = detail;
+        this.name = 'InsufficientCredits';
+    }
+}
+async function authHeaders() {
+    return {
+        authorization: `Bearer ${await accessToken()}`,
+        'content-type': 'application/json',
+    };
+}
+export function projectKey(cwd) {
+    return createHash('sha256').update(cwd).digest('hex').slice(0, 40);
+}
+export async function bootstrap(cwd, label) {
+    const url = new URL(`${apiUrl()}/api/cli/bootstrap`);
+    url.searchParams.set('project_key', projectKey(cwd));
+    url.searchParams.set('label', label);
+    const res = await fetch(url, { headers: await authHeaders() });
+    if (!res.ok) {
+        const detail = await res
+            .json()
+            .then((b) => String(b?.error ?? b?.detail ?? '').trim())
+            .catch(() => '');
+        if (res.status === 401) {
+            throw new Error('Your session is no longer valid. Run `rivine login`.');
+        }
+        if (res.status === 404) {
+            const deployed = await fetch(`${apiUrl()}/api/cli/config`)
+                .then((r) => r.ok)
+                .catch(() => false);
+            if (!deployed) {
+                throw new Error(`${apiUrl()} does not serve the terminal API — /api/cli/config is not ` +
+                    'there either. This build of the Workspace has not been deployed with ' +
+                    'Rivine Code CLI support, or RIVINE_API_URL points somewhere else.');
+            }
+            throw new Error('That account has no Aselius profile. Sign in with the account you use ' +
+                'on aselius.beunec.com — `rivine logout` then `rivine login`.');
+        }
+        if (detail.toLowerCase().includes('authentication')) {
+            throw new Error(`The server could not look up your account (${detail}). ` +
+                'Its identity service is unreachable — if this is a local or staging ' +
+                'Workspace, check that the Node backend is running and its cloud ' +
+                'credentials are valid.');
+        }
+        throw new Error(detail
+            ? `Could not start a session (HTTP ${res.status}): ${detail}`
+            : `Could not start a session (HTTP ${res.status}).`);
+    }
+    return (await res.json());
+}
+export async function openTurn(req) {
+    const res = await fetch(`${apiUrl()}/api/workspaces/${req.workspaceId}/chats/${req.chatSpaceId}/stream`, {
+        method: 'POST',
+        headers: { ...(await authHeaders()), accept: 'text/event-stream' },
+        body: JSON.stringify({
+            message: req.message,
+            mediator_mode: MEDIATOR_MODE,
+            target_engine: TARGET_ENGINE,
+            client: 'cli',
+            cli_session_id: req.sessionId,
+            permission_mode: req.permissionMode,
+            cwd_snapshot: req.cwdSnapshot ?? null,
+            mcp_tools: req.mcpTools ?? null,
+            cli_session_key: req.sessionKey ?? null,
+            sources: [],
+            tools: [],
+            connector_ids: [],
+        }),
+    });
+    if (res.status === 402) {
+        const body = (await res.json().catch(() => ({})));
+        throw new InsufficientCredits(body.error ?? 'Not enough credits for Rivine Code.');
+    }
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new Error(`The engine refused this turn (HTTP ${res.status}). ${body.slice(0, 300)}`);
+    }
+    return res;
+}
+export async function postFsResult(sessionId, requestId, outcome, key) {
+    const data = outcome.ok ? (key ? key.seal(outcome.data) : outcome.data) : null;
+    await fetch(`${apiUrl()}/api/cli/sessions/${sessionId}/fs-result`, {
+        method: 'POST',
+        headers: await authHeaders(),
+        body: JSON.stringify({
+            request_id: requestId,
+            ok: outcome.ok,
+            data,
+            error: outcome.ok ? null : outcome.error,
+        }),
+    });
+}
+export async function resumeTurn(args) {
+    const res = await fetch(`${apiUrl()}/api/workspaces/${args.workspaceId}/chats/${args.chatSpaceId}/resume`, {
+        method: 'POST',
+        headers: await authHeaders(),
+        body: JSON.stringify({
+            thread_id: args.threadId,
+            approved: args.approved,
+            decision: args.approved ? 'approved' : 'rejected',
+            feedback: args.feedback ?? '',
+            modified_args: args.modifiedArgs ?? null,
+            cli_session_key: args.sessionKey ?? null,
+            cli_session_id: args.sessionId,
+        }),
+    });
+    if (!res.ok) {
+        throw new Error(`Could not resume the turn (HTTP ${res.status}).`);
+    }
+    return (await res.json());
+}
+export async function closeSession(sessionId) {
+    try {
+        await fetch(`${apiUrl()}/api/cli/sessions/${sessionId}/close`, {
+            method: 'POST',
+            headers: await authHeaders(),
+        });
+    }
+    catch {
+    }
+}
+export async function fetchCredits(creditsUrl) {
+    if (!creditsUrl)
+        return null;
+    try {
+        const res = await fetch(creditsUrl, { headers: await authHeaders() });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return { balance: Number(body.balance ?? 0), plan: String(body.plan ?? 'free') };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/auth/device.js

@@ -0,0 +1,73 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+export async function startDeviceFlow(config) {
+    const res = await fetch(`https://${config.auth0_domain}/oauth/device/code`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: config.auth0_client_id,
+            scope: config.scope,
+            audience: config.auth0_audience,
+        }),
+    });
+    if (!res.ok) {
+        throw new Error(`Could not start device sign-in (HTTP ${res.status}). ` +
+            `Device code may not be enabled for this application.`);
+    }
+    const body = (await res.json());
+    let intervalMs = (body.interval ?? 5) * 1000;
+    const deadline = Date.now() + body.expires_in * 1000;
+    const poll = async () => {
+        for (;;) {
+            if (Date.now() > deadline) {
+                throw new Error('The code expired before it was approved. Run rivine login --device again.');
+            }
+            await new Promise((r) => setTimeout(r, intervalMs));
+            const tokenRes = await fetch(`https://${config.auth0_domain}/oauth/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    device_code: body.device_code,
+                    client_id: config.auth0_client_id,
+                }),
+            });
+            const payload = (await tokenRes.json().catch(() => ({})));
+            if (tokenRes.ok && payload.access_token) {
+                return {
+                    accessToken: payload.access_token,
+                    refreshToken: payload.refresh_token,
+                    expiresAt: Date.now() + (payload.expires_in ?? 3600) * 1000,
+                };
+            }
+            if (payload.error === 'authorization_pending')
+                continue;
+            if (payload.error === 'slow_down') {
+                intervalMs += 5000;
+                continue;
+            }
+            throw new Error(payload.error === 'expired_token'
+                ? 'The code expired before it was approved.'
+                : payload.error === 'access_denied'
+                    ? 'Sign-in was declined.'
+                    : `Device sign-in failed: ${payload.error_description || payload.error || tokenRes.status}`);
+        }
+    };
+    return {
+        start: {
+            userCode: body.user_code,
+            verificationUri: body.verification_uri,
+            verificationUriComplete: body.verification_uri_complete,
+            expiresIn: body.expires_in,
+        },
+        poll,
+    };
+}

package/dist/auth/keychain.js

@@ -0,0 +1,88 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const SERVICE = 'beunec-rivine-cli';
+const ACCOUNT = 'default';
+const filePath = (account = ACCOUNT) => account === ACCOUNT
+    ? join(homedir(), '.rivine', 'credentials.json')
+    : join(homedir(), '.rivine', 'credentials', `${encodeURIComponent(account)}.json`);
+const keyrings = new Map();
+async function getKeyring(account = ACCOUNT) {
+    const cached = keyrings.get(account);
+    if (cached !== undefined)
+        return cached;
+    if (process.env.RIVINE_NO_KEYCHAIN) {
+        keyrings.set(account, null);
+        return null;
+    }
+    let entry = null;
+    try {
+        const mod = await import('@napi-rs/keyring');
+        const candidate = new mod.Entry(SERVICE, account);
+        candidate.getPassword();
+        entry = candidate;
+    }
+    catch {
+        entry = null;
+    }
+    keyrings.set(account, entry);
+    return entry;
+}
+export async function usingKeychain() {
+    return (await getKeyring()) !== null;
+}
+export function mcpAccount(serverName) {
+    return `mcp:${serverName}`;
+}
+export async function saveSession(session, account = ACCOUNT) {
+    const payload = JSON.stringify(session);
+    const ring = await getKeyring(account);
+    if (ring) {
+        ring.setPassword(payload);
+        return;
+    }
+    const path = filePath(account);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, payload, { encoding: 'utf8', mode: 0o600 });
+    await chmod(path, 0o600);
+}
+export async function loadSession(account = ACCOUNT) {
+    const ring = await getKeyring(account);
+    let raw = null;
+    if (ring) {
+        raw = ring.getPassword();
+    }
+    else {
+        raw = await readFile(filePath(account), 'utf8').catch(() => null);
+    }
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed?.accessToken ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function clearSession(account = ACCOUNT) {
+    const ring = await getKeyring(account);
+    if (ring) {
+        try {
+            ring.deletePassword();
+        }
+        catch {
+        }
+    }
+    await rm(filePath(account), { force: true });
+}

package/dist/auth/pkce.js

@@ -0,0 +1,142 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+const base64url = (buf) => buf.toString('base64url');
+function makeVerifier() {
+    return base64url(randomBytes(32));
+}
+function challengeFor(verifier) {
+    return base64url(createHash('sha256').update(verifier).digest());
+}
+function sameState(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+export function openBrowser(url) {
+    if (process.env.RIVINE_NO_BROWSER)
+        return;
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        const child = spawn(cmd, [url], { stdio: 'ignore', detached: true, shell: process.platform === 'win32' });
+        child.unref();
+    }
+    catch {
+    }
+}
+const DONE_PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${title}</title>` +
+    `<body style="font-family:ui-sans-serif,system-ui,sans-serif;display:grid;place-items:center;height:100vh;margin:0;background:#0b0b0c;color:#e8e8ea">` +
+    `<div style="text-align:center;max-width:34rem;padding:2rem">` +
+    `<h1 style="font-size:1.25rem;font-weight:600;margin:0 0 .5rem">${title}</h1>` +
+    `<p style="margin:0;color:#a1a1aa;line-height:1.6">${body}</p></div></body>`;
+export async function loginWithPkce(config, onUrl, timeoutMs = 5 * 60_000) {
+    const verifier = makeVerifier();
+    const challenge = challengeFor(verifier);
+    const state = base64url(randomBytes(16));
+    const port = config.loopback_port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const received = new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end();
+                return;
+            }
+            const finish = (status, page, done) => {
+                res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' }).end(page);
+                res.on('finish', () => {
+                    server.close();
+                    done();
+                });
+            };
+            const error = url.searchParams.get('error');
+            if (error) {
+                const description = url.searchParams.get('error_description') || error;
+                finish(400, DONE_PAGE('Sign-in was cancelled', description), () => reject(new Error(description)));
+                return;
+            }
+            const returnedState = url.searchParams.get('state') ?? '';
+            const code = url.searchParams.get('code') ?? '';
+            if (!code || !sameState(returnedState, state)) {
+                finish(400, DONE_PAGE('Sign-in could not be verified', 'Please run rivine login again.'), () => reject(new Error('The sign-in response did not match this terminal. Try again.')));
+                return;
+            }
+            finish(200, DONE_PAGE('You are signed in', 'You can close this tab and return to your terminal.'), () => resolve(code));
+        });
+        server.on('error', (err) => {
+            reject(err.code === 'EADDRINUSE'
+                ? new Error(`Port ${port} is already in use — another rivine login may be running. ` +
+                    `Close it and try again.`)
+                : err);
+        });
+        server.listen(port, '127.0.0.1');
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error('Sign-in timed out. Run rivine login to try again.'));
+        }, timeoutMs);
+        timer.unref();
+    });
+    const bridge = new URL(config.authorize_bridge_url);
+    bridge.searchParams.set('challenge', challenge);
+    bridge.searchParams.set('state', state);
+    bridge.searchParams.set('port', String(port));
+    onUrl(bridge.toString());
+    openBrowser(bridge.toString());
+    const code = await received;
+    return exchangeCode(config, { code, verifier, redirectUri });
+}
+async function exchangeCode(config, args) {
+    const res = await fetch(`https://${config.auth0_domain}/oauth/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: config.auth0_client_id,
+            code: args.code,
+            code_verifier: args.verifier,
+            redirect_uri: args.redirectUri,
+        }),
+    });
+    if (!res.ok) {
+        const detail = await res.text().catch(() => '');
+        throw new Error(`Could not complete sign-in (HTTP ${res.status}). ${detail.slice(0, 300)}`);
+    }
+    const body = (await res.json());
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        expiresAt: Date.now() + (body.expires_in ?? 3600) * 1000,
+    };
+}
+export async function refresh(config, refreshToken) {
+    const res = await fetch(`https://${config.auth0_domain}/oauth/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: config.auth0_client_id,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!res.ok) {
+        throw new Error('Your session expired. Run rivine login to sign in again.');
+    }
+    const body = (await res.json());
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token ?? refreshToken,
+        expiresAt: Date.now() + (body.expires_in ?? 3600) * 1000,
+    };
+}

package/dist/auth/session.js

@@ -0,0 +1,101 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+import { fetchCliConfig } from '../config.js';
+import { clearSession, loadSession, saveSession, usingKeychain, } from './keychain.js';
+import { loginWithPkce, refresh } from './pkce.js';
+import { startDeviceFlow } from './device.js';
+const REFRESH_SKEW_MS = 60_000;
+let inFlight = null;
+export class NotSignedIn extends Error {
+    constructor(message = 'You are not signed in. Run `rivine login`.') {
+        super(message);
+        this.name = 'NotSignedIn';
+    }
+}
+export class SessionExpired extends NotSignedIn {
+    constructor() {
+        super('Your session expired and could not be renewed automatically. ' +
+            'Run `rivine login` to sign in again.');
+        this.name = 'SessionExpired';
+    }
+}
+export async function accessToken() {
+    const fromEnv = process.env.RIVINE_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const stored = await loadSession();
+    if (!stored)
+        throw new NotSignedIn();
+    if (stored.expiresAt - REFRESH_SKEW_MS > Date.now()) {
+        return stored.accessToken;
+    }
+    if (!stored.refreshToken) {
+        await clearSession();
+        throw new SessionExpired();
+    }
+    if (!inFlight) {
+        inFlight = (async () => {
+            try {
+                const config = await fetchCliConfig();
+                const next = await refresh(config, stored.refreshToken);
+                await saveSession(next);
+                return next.accessToken;
+            }
+            catch (err) {
+                await clearSession();
+                throw err;
+            }
+            finally {
+                inFlight = null;
+            }
+        })();
+    }
+    return inFlight;
+}
+export async function isSignedIn() {
+    if (process.env.RIVINE_TOKEN?.trim())
+        return true;
+    return (await loadSession()) !== null;
+}
+export async function login(options = {}) {
+    const config = await fetchCliConfig();
+    let session;
+    if (options.device) {
+        const { start, poll } = await startDeviceFlow(config);
+        options.onDeviceCode?.(start.userCode, start.verificationUriComplete || start.verificationUri);
+        session = await poll();
+    }
+    else {
+        session = await loginWithPkce(config, options.onUrl ?? (() => { }));
+    }
+    await saveSession(session);
+    if (!session.refreshToken) {
+        options.onNoRefreshToken?.(Math.max(1, Math.round((session.expiresAt - Date.now()) / 3_600_000)));
+    }
+}
+export async function logout() {
+    await clearSession();
+}
+export async function status() {
+    if (process.env.RIVINE_TOKEN?.trim()) {
+        return { signedIn: true, storage: 'environment' };
+    }
+    const stored = await loadSession();
+    const storage = (await usingKeychain()) ? 'keychain' : 'file';
+    return stored
+        ? {
+            signedIn: true,
+            storage,
+            expiresAt: stored.expiresAt,
+            canRenew: Boolean(stored.refreshToken),
+        }
+        : { signedIn: false, storage };
+}

package/dist/config.js

@@ -0,0 +1,37 @@
+/*!
+ * Rivine Code CLI
+ * Licensed and owned by Beunec Technologies, Inc.
+ *
+ * https://aselius.beunec.com
+ *
+ * This software is proprietary. Use is governed by the licence agreement
+ * accompanying it; it is not open source and is not licensed for
+ * redistribution or derivative works.
+ */
+const DEFAULT_API_URL = 'https://workspace.beunec.com';
+const DEFAULT_SITE_URL = 'https://aselius.beunec.com';
+function trimSlash(value) {
+    return value.trim().replace(/\/+$/, '');
+}
+export function apiUrl() {
+    return trimSlash(process.env.RIVINE_API_URL || DEFAULT_API_URL);
+}
+export function siteUrl() {
+    return trimSlash(process.env.RIVINE_SITE_URL || DEFAULT_SITE_URL);
+}
+let cached = null;
+export async function fetchCliConfig() {
+    if (cached)
+        return cached;
+    const res = await fetch(`${apiUrl()}/api/cli/config`);
+    if (!res.ok) {
+        const detail = await res.text().catch(() => '');
+        throw new Error(res.status === 503
+            ? `Sign-in is not available right now: ${detail || 'the server is missing an Auth0 setting.'}`
+            : `Could not reach ${apiUrl()} (HTTP ${res.status}). Is RIVINE_API_URL correct?`);
+    }
+    cached = (await res.json());
+    return cached;
+}
+export const TARGET_ENGINE = 'rivine_code';
+export const MEDIATOR_MODE = 'alpha';