@comonad/cocode 0.0.0-stage → 0.1.8

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# CoCode CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+CoCode runs coding agents on your computer and lets you control them from its
+desktop, web, or mobile app.
+
+```bash
+npx @comonad/cocode
+```
+
+CoCode is invite-only. The first run of each version asks you to sign in at
+https://code.comonad.co.uk with a one-time code, then downloads the CoCode
+executable for this platform. To download without the sign-in, set
+`COCODE_ACCESS_TOKEN` for one run, such as `cocode --version`. Do not keep it set
+for a server, because the token is short-lived.
+
+It supports macOS on Apple silicon and Linux on x64 and arm64 with glibc.

package/bin/cocode.mjs

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+import * as NodeChildProcess from "node:child_process";
+import * as NodeCrypto from "node:crypto";
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
+
+const manifest = JSON.parse(
+  NodeFS.readFileSync(NodePath.join(import.meta.dirname, "../package.json"), "utf8"),
+);
+const { version } = manifest;
+
+const ARCHIVE_KEYS = ["darwin-arm64", "linux-arm64", "linux-x64"];
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+// RFC 8628: 5 seconds when the server names no interval, and 5 more after each slow_down.
+const DEFAULT_POLL_SECONDS = 5;
+const SLOW_DOWN_MS = 5_000;
+
+function cocodeHome() {
+  const raw = (process.env.COCODE_HOME || "").trim();
+  if (raw === "") return NodePath.join(NodeOS.homedir(), ".cocode");
+  if (raw === "~") return NodeOS.homedir();
+  if (raw.startsWith("~/") || raw.startsWith("~\\")) {
+    return NodePath.join(NodeOS.homedir(), raw.slice(2));
+  }
+  return NodePath.resolve(raw);
+}
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+function secureUrlSetting(name, fallback) {
+  const value = (process.env[name] || fallback).replace(/\/+$/, "");
+  const url = URL.canParse(value) ? new URL(value) : undefined;
+  const isLoopbackHttp = url?.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+  if (url?.protocol !== "https:" && !isLoopbackHttp) {
+    throw new Error(`${name} must be an https URL, or http on localhost, not "${value}".`);
+  }
+  return value;
+}
+
+function archiveKey() {
+  const key = `${process.platform}-${process.arch}`;
+  const installScript = new URL("/install.sh", manifest.cocode.releasesUrl);
+  if (key.startsWith("win32-")) {
+    throw new Error(
+      `CoCode has no Windows CLI. Run it inside WSL with \`npx ${manifest.name}\` or ${installScript}.`,
+    );
+  }
+  if (key === "darwin-x64") {
+    throw new Error(
+      "CoCode ships a macOS CLI for Apple silicon only. On an Apple silicon Mac, use an arm64 build of Node.js.",
+    );
+  }
+  if (!ARCHIVE_KEYS.includes(key)) {
+    throw new Error(`CoCode has no CLI for ${key}. It ships for ${ARCHIVE_KEYS.join(", ")}.`);
+  }
+  if (key.startsWith("linux-") && !process.report.getReport().header.glibcVersionRuntime) {
+    throw new Error("the Linux CLI needs glibc. musl systems such as Alpine are not supported.");
+  }
+  return key;
+}
+
+async function accessToken() {
+  const token = (process.env.COCODE_ACCESS_TOKEN || "").trim();
+  return token === "" ? await signIn() : token;
+}
+
+async function signIn() {
+  const relayUrl = secureUrlSetting("COCODE_RELAY_URL", manifest.cocode.relayUrl);
+  const clientId = manifest.cocode.oauthClientId;
+  const post = (route, params) =>
+    fetch(`${relayUrl}${route}`, { method: "POST", body: new URLSearchParams(params) });
+
+  const started = await post("/cli/device", { client_id: clientId });
+  if (!started.ok) {
+    throw new Error(
+      `could not start the CoCode sign-in: ${relayUrl} returned HTTP ${started.status}`,
+    );
+  }
+  const grant = await started.json();
+  if (
+    typeof grant.device_code !== "string" ||
+    typeof grant.user_code !== "string" ||
+    typeof grant.verification_uri !== "string" ||
+    typeof grant.expires_in !== "number"
+  ) {
+    throw new Error("the CoCode sign-in service sent an unexpected response.");
+  }
+  process.stderr.write(
+    [
+      `Sign in to CoCode to download version ${version}. Open on any device:`,
+      `  ${grant.verification_uri_complete || grant.verification_uri}`,
+      `Code: ${grant.user_code}`,
+      `Waiting for approval. Expires in ${Math.max(1, Math.round(grant.expires_in / 60))} min. Ctrl+C cancels.`,
+      "",
+    ].join("\n"),
+  );
+
+  const deadline = Date.now() + grant.expires_in * 1000;
+  let intervalMs = (grant.interval ?? DEFAULT_POLL_SECONDS) * 1000;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    const response = await post("/cli/oauth/token", {
+      grant_type: DEVICE_CODE_GRANT,
+      device_code: grant.device_code,
+      client_id: clientId,
+    }).catch(() => undefined);
+    if (response === undefined || response.status >= 500) {
+      await response?.body?.cancel();
+      intervalMs += SLOW_DOWN_MS;
+      continue;
+    }
+    const body = await response.json().catch(() => ({}));
+    if (response.ok && typeof body.access_token === "string") return body.access_token;
+    if (body.error === "authorization_pending") continue;
+    if (body.error === "slow_down") {
+      intervalMs += SLOW_DOWN_MS;
+      continue;
+    }
+    if (body.error === "access_denied") throw new Error("the CoCode sign-in was denied.");
+    if (body.error === "expired_token") break;
+    throw new Error(`the CoCode sign-in failed (${body.error || `HTTP ${response.status}`}).`);
+  }
+  throw new Error("the CoCode sign-in code expired. Run the command again for a new code.");
+}
+
+async function get(url, token) {
+  const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+  if (response.status === 401) {
+    throw new Error(
+      process.env.COCODE_ACCESS_TOKEN
+        ? "the CoCode release feed rejected COCODE_ACCESS_TOKEN. It may have expired, or your account is not on the allow list. Unset it to sign in with a code."
+        : "the CoCode release feed rejected your sign-in. Your account is not on the allow list.",
+    );
+  }
+  if (response.status === 404) {
+    throw new Error(
+      `${url} does not exist yet. If ${version} was just released, try again in a few minutes.`,
+    );
+  }
+  if (!response.ok) throw new Error(`GET ${url} returned HTTP ${response.status}`);
+  return response;
+}
+
+async function download(url, token, file) {
+  const response = await get(url, token);
+  const total = Number(response.headers.get("content-length")) || 0;
+  const hash = NodeCrypto.createHash("sha256");
+  const out = NodeFS.openSync(file, "w");
+  const tty = process.stderr.isTTY;
+  let received = 0;
+  let shown = -1;
+  try {
+    for await (const chunk of response.body) {
+      hash.update(chunk);
+      NodeFS.writeSync(out, chunk);
+      received += chunk.byteLength;
+      const step = total ? Math.floor((received * 100) / total) : Math.floor(received / 1048576);
+      if (tty && step !== shown) {
+        shown = step;
+        const percent = total ? ` ${step}%` : "";
+        process.stderr.write(
+          `\r\x1b[2Kcocode: downloading CoCode ${version}${percent} (${(received / 1048576).toFixed(1)} MB)`,
+        );
+      }
+    }
+  } finally {
+    NodeFS.closeSync(out);
+    if (tty) process.stderr.write("\r\x1b[2K");
+  }
+  return hash.digest("hex");
+}
+
+async function install(dir, key) {
+  const releasesUrl = secureUrlSetting("COCODE_RELEASES_URL", manifest.cocode.releasesUrl);
+  const token = await accessToken();
+  const archive = `cocode-${version}-${key}.tar.gz`;
+  const base = `${releasesUrl}/download/v${version}`;
+  const sums = await (await get(`${base}/SHA256SUMS`, token)).text();
+  const expected = /^([0-9a-f]{64})\s+\*?(.+)$/im;
+  const line = sums
+    .split(/\r?\n/)
+    .map((l) => expected.exec(l.trim()))
+    .find((m) => m && m[2] === archive);
+  if (!line) throw new Error(`${archive} is not listed in the release's SHA256SUMS`);
+
+  // Stage beside the destination and rename atomically to avoid half-installed versions.
+  NodeFS.mkdirSync(NodePath.dirname(dir), { recursive: true });
+  const staging = NodeFS.mkdtempSync(`${dir}.staging-`);
+  try {
+    const file = NodePath.join(staging, archive);
+    if ((await download(`${base}/${archive}`, token, file)) !== line[1].toLowerCase()) {
+      throw new Error(`checksum mismatch for ${archive}`);
+    }
+    const extract = NodeChildProcess.spawnSync(
+      "tar",
+      ["-xf", file, "-C", staging, "--strip-components=1"],
+      { stdio: "inherit" },
+    );
+    if (extract.status !== 0) throw new Error(`could not extract ${archive}`);
+    NodeFS.rmSync(file);
+    NodeFS.writeFileSync(NodePath.join(staging, ".install-complete"), `${version}\n`);
+    publish(staging, dir);
+  } finally {
+    NodeFS.rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+const isComplete = (dir) => {
+  try {
+    return NodeFS.readFileSync(NodePath.join(dir, ".install-complete"), "utf8").trim() === version;
+  } catch {
+    return false;
+  }
+};
+
+/** Preserve concurrently published complete installs; replace only incomplete folders without the completion marker. */
+function publish(staging, dir) {
+  try {
+    NodeFS.renameSync(staging, dir);
+    return;
+  } catch (error) {
+    if (isComplete(dir)) return;
+    if (!NodeFS.existsSync(dir)) throw error;
+  }
+  const lock = `${dir}.lock`;
+  try {
+    NodeFS.mkdirSync(lock);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    throw new Error(
+      `another cocode is installing ${version}. If none is running, delete ${lock} and try again.`,
+      { cause: error },
+    );
+  }
+  const stale = `${staging}.stale`;
+  try {
+    // A peer may have published between our marker check and taking the lock.
+    if (isComplete(dir)) return;
+    // Move it aside rather than deleting in place: once the folder is empty, a
+    // peer's first rename can land in it.
+    NodeFS.renameSync(dir, stale);
+    try {
+      NodeFS.renameSync(staging, dir);
+    } catch (error) {
+      if (!isComplete(dir)) throw error;
+    }
+  } finally {
+    NodeFS.rmSync(lock, { recursive: true, force: true });
+    NodeFS.rmSync(stale, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  const dir = NodePath.join(cocodeHome(), "runtime", "versions", version);
+  if (!isComplete(dir)) await install(dir, archiveKey());
+
+  // Service IPC and signals must reach the child; terminal Ctrl-C already does, so do not forward SIGINT twice.
+  const ipc = process.send !== undefined;
+  const child = NodeChildProcess.spawn(NodePath.join(dir, "cocode"), process.argv.slice(2), {
+    stdio: ipc ? ["inherit", "inherit", "inherit", "ipc"] : "inherit",
+    // The executable lives in the CoCode home, so this is how it knows npm launched it.
+    env: { ...process.env, COCODE_NPM_LAUNCHER_PATH: import.meta.filename },
+  });
+  if (ipc) {
+    process.on("message", (message) => child.connected && child.send(message));
+    child.on("message", (message) => process.connected && process.send(message));
+    process.on("disconnect", () => child.connected && child.disconnect());
+  }
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(signal, () => (ipc || signal !== "SIGINT") && child.kill(signal));
+  }
+  child.on("error", (error) => fail(error));
+  child.on("exit", (code, signal) =>
+    process.exit(code ?? 128 + (NodeOS.constants.signals[signal] || 1)),
+  );
+}
+
+function fail(error) {
+  process.stderr.write(`cocode: ${error.message}\n`);
+  process.exit(1);
+}
+
+await main().catch(fail);

package/dist/bin.mjs

@@ -0,0 +1,2 @@
+// Legacy background services still enter the npm package through this path.
+import "../bin/cocode.mjs";

package/package.json

@@ -1,6 +1,25 @@
 {
   "name": "@comonad/cocode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.8",
+  "description": "CoCode CLI. Signs you in, then downloads the self-contained executable for this platform.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vahaah/cocode.git"
+  },
+  "bin": {
+    "cocode": "./bin/cocode.mjs"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20.11"
+  },
+  "cocode": {
+    "releasesUrl": "https://code.comonad.co.uk/releases",
+    "relayUrl": "https://relay.code.comonad.co.uk",
+    "oauthClientId": "cocode-cli"
+  }
+}