@codeworksh/harness 0.0.1-dev.20260922135939 → 0.0.1-dev.20260923035712

package/effect.mjs

@@ -24,6 +24,8 @@ import path from "node:path";
 import { Script, constants } from "node:vm";
 import npa from "npm-package-arg";
 import * as AikitFailure from "@codeworksh/aikit/failure";
+import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworksh/aikit/oauth/github/copilot";
+import { JsonOpenAICodexAuthStorage, getOpenAICodexApiKey } from "@codeworksh/aikit/oauth/openai/codex";
 import "@codeworksh/plugin/tool/error";
 import { parse, printParseErrorCode } from "jsonc-parser";
 //#region src/schema.ts
@@ -97,6 +99,7 @@ var global_exports = /* @__PURE__ */ __exportAll({
 	Service: () => Service$17,
 	app: () => app,
 	appConfigDir: () => appConfigDir,
+	authFile: () => authFile,
 	defaultLayer: () => defaultLayer$4,
 	homeConfig: () => homeConfig,
 	layer: () => layer$26,
@@ -119,6 +122,16 @@ function make$18(input = {}) {
 		log: input.log ?? posix.join(home, "log")
 	};
 }
+/**
+* Where a Codework home keeps its OAuth credentials, or undefined to let aikit
+* resolve them (`CODEWORK_CREDENTIALS`, then the default home).
+*
+* Callers pass a home only when the user actually chose one, so an explicit
+* `--home` pins the file and everything else defers to aikit. The harness and
+* the RPC server both go through here: if they disagreed, a login stored by one
+* would be invisible to the other.
+*/
+const authFile = (home) => home === void 0 ? void 0 : posix.join(home, "aikit", "auth.json");
 const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
 	const home = input.home === void 0 ? yield* homeConfig : expandHome(input.home);
 	return make$18({
@@ -7400,14 +7413,50 @@ const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
 	});
 	return model;
 });
+/**
+* Fill in what an OAuth provider needs and the model catalog cannot carry: the
+* stored access token, and for Copilot the plan-specific inference host chosen
+* at login. Anything the request already pins is left alone, and a provider
+* with no stored login resolves to `{}` so aikit reports the missing key.
+*/
+const oauthCredentials = async (protocol, options) => {
+	const storage = options.authFile === void 0 ? {} : { path: options.authFile };
+	if (protocol === "openai-codex") {
+		const apiKey = await getOpenAICodexApiKey({ storage: new JsonOpenAICodexAuthStorage(storage) });
+		return apiKey === void 0 ? {} : { apiKey };
+	}
+	if (protocol === "github-copilot") {
+		const store = new JsonGitHubCopilotAuthStorage(storage);
+		const stored = await store.get();
+		const apiKey = await getGitHubCopilotApiKey({ storage: store });
+		if (apiKey === void 0) return {};
+		const apiEndpoint = apiKey === stored?.access ? stored.apiEndpoint : void 0;
+		return {
+			apiKey,
+			...apiEndpoint === void 0 ? {} : { baseURL: apiEndpoint }
+		};
+	}
+	return {};
+};
 /** Start a provider stream using the model pinned by State. */
-const open = Effect.fn("LLM.open")(function* (input, signal) {
+const openWith = (options = {}) => Effect.fn("LLM.open")(function* (input, signal) {
 	const model = input.resolvedModel;
+	const configured = runtimeOptions(input, model, signal);
+	const resolved = configured.apiKey === void 0 ? yield* Effect.tryPromise({
+		try: () => oauthCredentials(model.protocol, options),
+		catch: (cause) => providerErrorFromUnknown(input, cause)
+	}) : {};
+	const request = {
+		...configured,
+		...resolved,
+		...configured.baseURL === void 0 ? {} : { baseURL: configured.baseURL }
+	};
 	return yield* Effect.try({
-		try: () => stream(model, input.context, runtimeOptions(input, model, signal)),
+		try: () => stream(model, input.context, request),
 		catch: (cause) => providerErrorFromUnknown(input, cause)
 	});
 });
+const open = openWith();
 /**
 * Build a provider request from an opener. Tests use this with deterministic
 * aikit event streams; production uses `open` above.
@@ -8789,7 +8838,9 @@ const layer = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	const configured = yield* loadAll(options.sandboxes ?? [], { hostCwd });
 	const drivers = layer$18(driver_exports.SandboxDriver.withSource(make$11().driver, "core"), driver_exports.SandboxDriver.withSource(make$9().driver, "core"), ...configured);
 	const sandboxes = layer$16({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
-	const loop = options.llm === void 0 ? layer$3() : layer$3({ request: make$5(options.llm) });
+	const authFile$1 = authFile(options.home === void 0 ? void 0 : paths.home);
+	const open = options.llm ?? openWith(authFile$1 === void 0 ? {} : { authFile: authFile$1 });
+	const loop = layer$3({ request: make$5(open) });
 	return layer$9.pipe(Layer.provideMerge(layer$7.pipe(Layer.provide(loop))), Layer.provideMerge(layer$4({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$5(settingsOptions)), Layer.provideMerge(layer$6), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$21), Layer.provideMerge(layer$1), Layer.provideMerge(layer$24), Layer.provideMerge(layer$8(definitions)), Layer.provideMerge(database), Layer.provideMerge(global));
 }));
 //#endregion