@cortexkit/opencode-antigravity-auth 2.2.0 → 3.0.0

package/dist/src/plugin/commands.js

@@ -1,47 +1,21 @@
 /**
- * Slash-command wiring for the antigravity plugin.
+ * The single `/antigravity` slash command of OpenCode 1.
  *
- * Three places must agree on the set of modal commands — keeping
- * them in lockstep is a hard invariant:
- *
- *   1. `MODAL_COMMANDS` — the canonical list of `CommandModalName`s.
- *   2. `registerAntigravityCommands` (in `./catalog.ts`) — what we
- *      register in the host `config.command.*` map so OpenCode
- *      recognises them.
- *   3. `buildDialogPayload` (here) — the per-command dialog payload
- *      builder the TUI renders when a notification arrives.
- *
- * If any one drifts, a future slash command will be discoverable in
- * the host palette but invisible to the dialog flow (or vice versa).
- * The bidirectional three-wiring test pins this invariant.
- *
- * `/gemini-dump` remains a backward-compatibility alias: the host
- * already registers the command under that name in `OpenCode` and
- * long-running sessions may still call it. The modal name
- * `antigravity-dump` is the canonical name; both stay registered.
+ * The command opens the shared Antigravity menu built by the core
+ * `createAntigravityCommandMenu` over the location's account store: the
+ * server pushes the menu payload to the TUI over the private RPC queue, and
+ * the TUI sends each chosen action back to the RPC server, which hands it to
+ * the same menu's `apply`. The menu (common-auth's public `./commands`
+ * entry) owns confirmation, redaction, per-invocation isolation and action
+ * dispatch; this module supplies the OpenCode-specific sections (settings,
+ * diagnostics, sign-in) and the host hook.
  */
+import { ANTIGRAVITY_MENU_COMMAND, antigravitySettingsSections, createAntigravityCommandMenu, loadCommonAuthCommands, } from '@cortexkit/antigravity-auth-core';
 import { isTuiConnected as defaultIsTuiConnected } from '../rpc/notifications';
-import { buildSidebarMachineStateFromAccounts, setSidebarMachineState, } from '../sidebar-state';
-import { executeGeminiDumpCommand, GEMINI_DUMP_COMMAND_NAME, parseGeminiDumpCommandAction, setGeminiDumpEnabled, } from './gemini-dump';
-import { createLogger } from './logger';
-import { createOperatorSettingsController, } from './operator-settings';
+import { diagnosticsMenuSection, operatorMenuSettings } from './command-apply';
 import { resolvePromptContext } from './prompt-context';
-import { AccountStorageUnreadableError } from './storage';
-const log = createLogger('commands');
-export const ANTIGRAVITY_QUOTA_COMMAND_NAME = 'antigravity-quota';
-export const ANTIGRAVITY_ACCOUNT_COMMAND_NAME = 'antigravity-account';
-export const ANTIGRAVITY_ROUTING_COMMAND_NAME = 'antigravity-routing';
-export const ANTIGRAVITY_KILLSWITCH_COMMAND_NAME = 'antigravity-killswitch';
-export const ANTIGRAVITY_DUMP_COMMAND_NAME = 'antigravity-dump';
-export const ANTIGRAVITY_LOGGING_COMMAND_NAME = 'antigravity-logging';
-export const MODAL_COMMANDS = [
-    ANTIGRAVITY_QUOTA_COMMAND_NAME,
-    ANTIGRAVITY_ACCOUNT_COMMAND_NAME,
-    ANTIGRAVITY_ROUTING_COMMAND_NAME,
-    ANTIGRAVITY_KILLSWITCH_COMMAND_NAME,
-    ANTIGRAVITY_DUMP_COMMAND_NAME,
-    ANTIGRAVITY_LOGGING_COMMAND_NAME,
-];
+/** The one slash command this plugin registers. */
+export { ANTIGRAVITY_MENU_COMMAND };
 const HANDLED_COMMAND_SENTINEL = 'ANTIGRAVITY_COMMAND_HANDLED';
 async function sendIgnoredMessage(client, sessionID, text) {
     const session = client.session;
@@ -70,677 +44,231 @@ function throwHandledCommandSentinel() {
     throw new Error(HANDLED_COMMAND_SENTINEL);
 }
 /**
- * Build the dialog payload the TUI renders for `command`.
- *
- * Each branch produces a self-contained payload the OpenTUI dialog tree
- * can mount without further RPC chatter. The knobs object is the
- * payload-specific metadata (current toggle state, available actions,
- * default values) — knobs are intentionally stringly-typed to keep the
- * dialog code free of per-command schema definitions.
+ * The menu invocation for one session: the menu's notifications become
+ * toast notifications for that session. common-auth copies these fields
+ * when a call starts, so later work reports to the session that began it.
  */
-export async function buildDialogPayload(command, argumentsText, context) {
-    switch (command) {
-        case 'antigravity-quota': {
-            const action = argumentsText.trim().toLowerCase();
-            const accounts = context.commandData
-                ? await context.commandData.listAccounts()
-                : [];
-            // Render the cached snapshot immediately. Opening the dialog is a
-            // VIEW — it must respect the quota manager's per-account backoff so
-            // a rate-limited account isn't hammered every time the dialog opens.
-            // Explicit user-triggered refreshes (inside the dialog) keep force:true.
-            if (context.commandData) {
-                void context.commandData.refreshQuotaRespectingBackoff().catch(() => { });
-            }
-            return {
-                command,
-                text: 'Antigravity quota',
-                knobs: {
-                    mode: action === 'refresh' ? 'refresh' : 'status',
-                    accounts,
-                },
-            };
-        }
-        case 'antigravity-account': {
-            const action = argumentsText.trim().toLowerCase();
-            const accounts = context.commandData
-                ? await context.commandData.listAccounts()
-                : [];
-            return {
-                command,
-                text: 'Antigravity accounts',
-                knobs: {
-                    action: action === 'add' ||
-                        action === 'refresh' ||
-                        action === 'remove' ||
-                        action === 'list'
-                        ? action
-                        : 'list',
-                    accounts,
-                },
-            };
-        }
-        case 'antigravity-routing': {
-            const settings = context.settings.get();
-            const parsed = parseToggleArguments(argumentsText);
-            // State-first: the opening payload reports the CURRENT persisted
-            // values (no `!` inversion). Argument overrides still flow through
-            // so the slash-command-direct path can pre-stage a value, but the
-            // fallback when no argument is provided is the actual current
-            // state, not its negation. The apply handler returns the complete
-            // post-mutation state in `knobs` so the dialog re-renders from
-            // the same shape it was opened with.
-            return {
-                command,
-                text: 'Antigravity routing',
-                knobs: {
-                    cli_first: parsed.cli_first ?? settings.routing.cli_first,
-                    quota_style_fallback: parsed.quota_style_fallback ??
-                        settings.routing.quota_style_fallback,
-                    timeoutMs: 2_000,
-                },
-            };
-        }
-        case 'antigravity-killswitch': {
-            const settings = context.settings.get();
-            const parsed = parseKillswitchArguments(argumentsText);
-            // State-first: opening reports the current killswitch shape
-            // (`enabled`, `minimum_remaining_percent`, plus the full
-            // per-account override map if any keys exist). Argument overrides
-            // are honored so the slash-command-direct path stays explicit.
-            return {
-                command,
-                text: 'Antigravity killswitch',
-                knobs: {
-                    enabled: parsed.enabled ?? settings.killswitch.enabled,
-                    minimum_remaining_percent: parsed.minimum_remaining_percent ??
-                        settings.killswitch.minimum_remaining_percent,
-                    accounts: settings.killswitch.accounts ?? {},
-                    timeoutMs: 2_000,
-                },
-            };
-        }
-        case 'antigravity-dump': {
-            const action = parseGeminiDumpCommandAction(argumentsText);
-            return {
-                command,
-                text: 'Antigravity wire dump',
-                knobs: {
-                    mode: action.type === 'usage' ? 'status' : action.type,
-                },
-            };
-        }
-        case 'antigravity-logging': {
-            const level = parseLoggingLevel(argumentsText);
-            return {
-                command,
-                text: 'Antigravity logging',
-                knobs: { log_level: level },
-            };
-        }
-        default: {
-            const exhaustiveCheck = command;
-            throw new Error(`Unknown command ${exhaustiveCheck}`);
-        }
-    }
+export function menuInvocation(push, sessionId) {
+    return {
+        ...(sessionId !== undefined ? { sessionId } : {}),
+        notify(message, kind) {
+            push({
+                command: ANTIGRAVITY_MENU_COMMAND,
+                notify: { message, kind: kind ?? 'info' },
+            }, sessionId);
+        },
+    };
 }
-function parseToggleArguments(input) {
-    const result = {};
-    for (const part of input.split(/\s+/).filter(Boolean)) {
-        const eq = part.indexOf('=');
-        if (eq < 0)
-            continue;
-        const key = part.slice(0, eq).trim().toLowerCase();
-        const value = part
-            .slice(eq + 1)
-            .trim()
-            .toLowerCase();
-        if (key === 'cli_first' || key === 'cli-first') {
-            result.cli_first = value === 'true' || value === '1' || value === 'on';
-        }
-        else if (key === 'quota_style_fallback' ||
-            key === 'quota-style-fallback') {
-            result.quota_style_fallback =
-                value === 'true' || value === '1' || value === 'on';
+/**
+ * The host's `command.execute.before` for `/antigravity`: open the menu,
+ * queue its payload for the TUI, and stop the host from sending the command
+ * text as a prompt. Without a TUI listening, the outcome is written into the
+ * session as an ignored message instead. Every other command is left alone.
+ */
+export function createAntigravityCommandExecuteBefore(options) {
+    const connection = options.connection ?? {
+        isTuiConnected: defaultIsTuiConnected,
+    };
+    return async (input) => {
+        if (input.command !== ANTIGRAVITY_MENU_COMMAND)
+            return;
+        const opening = await options.open(input.sessionID);
+        if (opening.kind === 'menu') {
+            options.push(opening.payload, input.sessionID);
         }
-    }
-    return result;
-}
-function parseKillswitchArguments(input) {
-    const result = {};
-    for (const part of input.split(/\s+/).filter(Boolean)) {
-        const eq = part.indexOf('=');
-        if (eq < 0)
-            continue;
-        const key = part.slice(0, eq).trim().toLowerCase();
-        const value = part
-            .slice(eq + 1)
-            .trim()
-            .toLowerCase();
-        if (key === 'enabled') {
-            result.enabled = value === 'true' || value === '1' || value === 'on';
+        else {
+            options.push({
+                command: ANTIGRAVITY_MENU_COMMAND,
+                notify: { message: opening.message, kind: 'warning' },
+            }, input.sessionID);
         }
-        else if (key === 'minimum_remaining_percent' ||
-            key === 'minimum-remaining-percent') {
-            const n = Number.parseFloat(value);
-            if (!Number.isNaN(n) && n >= 0 && n <= 100) {
-                result.minimum_remaining_percent = n;
-            }
+        if (!connection.isTuiConnected(input.sessionID)) {
+            await sendIgnoredMessage(options.client, input.sessionID, opening.kind === 'menu'
+                ? 'The Antigravity menu opens in the OpenCode terminal interface.'
+                : opening.message);
         }
-    }
-    return result;
-}
-function parseLoggingLevel(input) {
-    const trimmed = input.trim().toLowerCase();
-    if (trimmed === 'error' ||
-        trimmed === 'warn' ||
-        trimmed === 'info' ||
-        trimmed === 'debug' ||
-        trimmed === 'trace') {
-        return trimmed;
-    }
-    return 'info';
-}
-/**
- * Parse the slash-command apply argument for `/antigravity-account`.
- *
- * Recognized forms:
- *   `<empty>`        → `{ kind: 'refresh' }` (keeps the original
- *                      "manage → refresh" placeholder semantics)
- *   `add`            → `{ kind: 'add' }`
- *   `refresh`        → `{ kind: 'refresh' }`
- *   `current <n>`    → `{ kind: 'current', index: n }`
- *   `toggle <n>`     → `{ kind: 'toggle', index: n }`
- *   `remove <n>`     → `{ kind: 'remove', index: n }`
- *
- * `n` is the transient `acct-<index>` position the dialog renders.
- * Negative or non-integer values are rejected; out-of-range indices
- * are accepted here and rejected by the data service so the dialog
- * can surface the error text.
- */
-function parseAccountAction(input) {
-    const trimmed = input.trim();
-    if (!trimmed)
-        return { kind: 'refresh' };
-    const parts = trimmed.split(/\s+/).filter(Boolean);
-    const head = parts[0]?.toLowerCase();
-    if (head === 'add')
-        return { kind: 'add' };
-    if (head === 'add-oauth-start' && parts.length === 1) {
-        return { kind: 'add-oauth-start' };
-    }
-    if (head === 'add-oauth-finish') {
-        const code = parts[1];
-        if (!code)
-            return undefined;
-        const labelAt = parts.indexOf('--label');
-        const label = labelAt === -1
-            ? undefined
-            : parts
-                .slice(labelAt + 1)
-                .join(' ')
-                .trim();
-        return { kind: 'add-oauth-finish', code, label: label || undefined };
-    }
-    if (head === 'refresh')
-        return { kind: 'refresh' };
-    if (head === 'current' || head === 'toggle' || head === 'remove') {
-        const raw = parts[1];
-        if (raw === undefined)
-            return undefined;
-        const index = Number.parseInt(raw, 10);
-        if (!Number.isInteger(index) || index < 0)
-            return undefined;
-        return { kind: head, index };
-    }
-    return undefined;
+        throwHandledCommandSentinel();
+    };
 }
 /**
- * Apply the result of a TUI dialog back to the plugin runtime.
- *
- * Most commands mutate persistent operator settings (routing toggles,
- * killswitch thresholds, log level). Account add/refresh kicks off the
- * OAuth flow which can take up to two minutes on a fresh login — that
- * path opts into a 120s RPC timeout. Status / toggle paths keep the
- * default 2s timeout.
- *
- * The TUI's imperative dispatcher (`tui/command-dialogs.openCommandDialog`)
- * forwards the apply `options.timeoutMs` knob into the RPC apply call
- * so a long-running path (account add / refresh) can opt in without the
- * dialog layer having to special-case it.
+ * The Sign in section: the OpenCode 1 OAuth add flow. Starting returns the
+ * authorization URL for this session; finishing takes the redirect URL (or
+ * its code) the browser ends on, and the account service admits the login
+ * into the account store.
  */
-export async function applyCommand(request, context) {
-    const result = await applyCommandInner(request, context);
-    // Push a sidebar refresh after every mutation so the TUI's next poll
-    // sees a fresh `checkedAt`. The refresher is optional; tests and
-    // read-only contexts leave it undefined and skip the write entirely.
-    if (context.onApplied) {
-        const accounts = result.knobs.accounts;
-        await Promise.resolve(context.onApplied(Array.isArray(accounts) ? accounts : undefined)).catch(() => {
-            // Sidebar refresh must never break the command's apply response.
-        });
-    }
-    return result;
-}
-async function runAccountMutation(context, call) {
-    if (!context.commandData) {
-        return {
-            kind: 'error',
-            text: 'Command data service is not wired; account mutations are disabled.',
-        };
-    }
-    try {
-        const rows = await call();
-        if (rows == null)
-            return { kind: 'not-found' };
-        return { kind: 'rows', rows };
-    }
-    catch (error) {
-        if (error instanceof AccountStorageUnreadableError) {
-            log.warn('account mutation: locked storage is unreadable', {
-                error: error.message,
-            });
-            return {
-                kind: 'error',
-                text: `Account storage is unreadable: ${error.details.reason}. The mutation was not applied.`,
-            };
-        }
-        const message = error instanceof Error ? error.message : String(error);
-        log.warn('account mutation failed', { error: message });
-        return {
-            kind: 'error',
-            text: `Account mutation failed: ${message}`,
-        };
-    }
-}
-function notFoundResult(verb, index) {
-    return {
-        text: `Cannot ${verb}: account ${index} not found`,
-        knobs: { action: verb, timeoutMs: 2_000 },
-    };
-}
-function errorResult(verb, text) {
+export function signInMenuSection(oauth) {
     return {
-        text,
-        knobs: { action: verb, timeoutMs: 2_000, error: true },
-    };
-}
-async function applyCommandInner(request, context) {
-    switch (request.command) {
-        case 'antigravity-quota': {
-            // `refresh` is the only quota apply path; opening is cache-only
-            // via `listAccounts`. The data service forces the refresh and
-            // returns the freshly persisted rows so the dialog can re-render
-            // in place without a second RPC round-trip.
-            const accounts = context.commandData
-                ? await context.commandData.refreshQuota()
-                : [];
+        id: 'sign-in',
+        title: 'Sign in',
+        build() {
             return {
-                text: 'Quota refreshed',
-                knobs: { accounts, timeoutMs: 2_000 },
-            };
-        }
-        case 'antigravity-account': {
-            const args = request.arguments.trim();
-            const parsed = parseAccountAction(args);
-            if (!parsed) {
-                return {
-                    text: `Unknown account action: ${args}`,
-                    knobs: { action: 'unknown', timeoutMs: 2_000 },
-                };
-            }
-            if (parsed.kind === 'add-oauth-start') {
-                if (!context.accountOAuth) {
-                    return {
-                        text: 'OAuth account add is unavailable.',
-                        knobs: { timeoutMs: 120_000, error: true },
-                    };
-                }
-                const result = await context.accountOAuth.start(context.sessionID);
-                return {
-                    text: `Open this URL in your browser:\n${result.url}`,
-                    knobs: {
-                        oauthUrl: result.url,
-                        accounts: result.accounts,
-                        timeoutMs: 120_000,
-                    },
-                };
-            }
-            if (parsed.kind === 'add-oauth-finish') {
-                if (!context.accountOAuth) {
-                    return {
-                        text: 'OAuth account add is unavailable.',
-                        knobs: { timeoutMs: 120_000, error: true },
-                    };
-                }
-                const result = parsed.label
-                    ? await context.accountOAuth.finish(context.sessionID, parsed.code, parsed.label)
-                    : await context.accountOAuth.finish(context.sessionID, parsed.code);
-                return {
-                    text: result.text,
-                    knobs: { accounts: result.accounts, timeoutMs: 120_000 },
-                };
-            }
-            // The data service drives the locked-storage mutator for the
-            // three CRUD mutations. The locked-storage write is awaited FIRST so a
-            // failed disk write never leaves the runtime ahead of disk. When
-            // that await throws — AccountStorageUnreadableError, lock
-            // contention, I/O — we catch here and surface the message as the
-            // apply's `text`. The dialog toasts that text and stays mounted
-            // (the `clear()` is gated on `apply returning rows`).
-            if (parsed.kind === 'current') {
-                const result = await runAccountMutation(context, () => context.commandData?.setCurrentAccount(parsed.index));
-                if (result.kind === 'not-found') {
-                    return notFoundResult('set current', parsed.index);
-                }
-                if (result.kind === 'error') {
-                    return errorResult('current', result.text);
-                }
-                return {
-                    text: 'Current account updated',
-                    knobs: {
-                        accounts: result.rows,
-                        action: 'current',
-                        timeoutMs: 2_000,
-                    },
-                };
-            }
-            if (parsed.kind === 'toggle') {
-                const result = await runAccountMutation(context, () => context.commandData?.toggleAccountEnabled(parsed.index));
-                if (result.kind === 'not-found') {
-                    return notFoundResult('toggle', parsed.index);
-                }
-                if (result.kind === 'error') {
-                    return errorResult('toggle', result.text);
-                }
-                return {
-                    text: 'Account enabled state updated',
-                    knobs: {
-                        accounts: result.rows,
-                        action: 'toggle',
-                        timeoutMs: 2_000,
+                lines: [
+                    'Start a sign-in, open the link, then paste the address the browser ends on.',
+                ],
+                actions: [
+                    {
+                        id: 'start',
+                        label: 'Start sign-in',
+                        run: async ({ invocation }) => {
+                            const sessionId = invocation.sessionId;
+                            if (sessionId === undefined)
+                                return {
+                                    ok: false,
+                                    text: 'Sign-in needs a session; run /antigravity from one.',
+                                    code: 'refused',
+                                };
+                            const started = await oauth.start(sessionId);
+                            return `Open this link to sign in, then choose Finish sign-in:\n${started.url}`;
+                        },
                     },
-                };
-            }
-            if (parsed.kind === 'remove') {
-                const result = await runAccountMutation(context, () => context.commandData?.removeAccount(parsed.index));
-                if (result.kind === 'not-found') {
-                    return notFoundResult('remove', parsed.index);
-                }
-                if (result.kind === 'error') {
-                    return errorResult('remove', result.text);
-                }
-                return {
-                    text: 'Account removed',
-                    knobs: {
-                        accounts: result.rows,
-                        action: 'remove',
-                        timeoutMs: 2_000,
+                    {
+                        id: 'finish',
+                        label: 'Finish sign-in',
+                        knobs: [
+                            {
+                                kind: 'text',
+                                id: 'callback',
+                                label: 'Address or code from the browser',
+                                masked: true,
+                                required: true,
+                            },
+                            { kind: 'text', id: 'label', label: 'Label (optional)' },
+                        ],
+                        run: async ({ values, invocation }) => {
+                            const sessionId = invocation.sessionId;
+                            const callback = values.callback;
+                            if (sessionId === undefined || typeof callback !== 'string')
+                                return {
+                                    ok: false,
+                                    text: 'Paste the address the browser ended on.',
+                                    code: 'invalid-input',
+                                };
+                            const label = typeof values.label === 'string' && values.label.trim() !== ''
+                                ? values.label.trim()
+                                : undefined;
+                            const finished = label === undefined
+                                ? await oauth.finish(sessionId, callback)
+                                : await oauth.finish(sessionId, callback, label);
+                            return finished.text;
+                        },
                     },
-                };
-            }
-            // `add` (and `refresh`) — backwards-compatible no-op response
-            // that keeps the 120s RPC timeout for the future OAuth path.
-            return {
-                text: `Account ${parsed.kind} requested`,
-                knobs: { action: parsed.kind, timeoutMs: 120_000 },
-            };
-        }
-        case 'antigravity-routing': {
-            const parsed = parseToggleArguments(request.arguments);
-            try {
-                await context.settings.update((draft) => {
-                    if (parsed.cli_first !== undefined) {
-                        draft.routing.cli_first = parsed.cli_first;
-                    }
-                    if (parsed.quota_style_fallback !== undefined) {
-                        draft.routing.quota_style_fallback = parsed.quota_style_fallback;
-                    }
-                });
-            }
-            catch (error) {
-                // Lock contention / unreadable config — surface the writer's
-                // message so the dialog can toast the real cause and stay
-                // mounted (T8/T10 pattern). The runtime view is left untouched
-                // because the writer either landed or threw.
-                const message = error instanceof Error ? error.message : String(error);
-                log.warn('routing update failed', { error: message });
-                return {
-                    text: `Routing update failed: ${message}`,
-                    knobs: { timeoutMs: 2_000, error: true },
-                };
-            }
-            // Complete persisted state — the dialog re-renders from the same
-            // shape `buildDialogPayload` produced on open.
-            const after = context.settings.get();
-            return {
-                text: 'Routing updated',
-                knobs: {
-                    cli_first: after.routing.cli_first,
-                    quota_style_fallback: after.routing.quota_style_fallback,
-                    timeoutMs: 2_000,
-                },
-            };
-        }
-        case 'antigravity-killswitch': {
-            const parsed = parseKillswitchArguments(request.arguments);
-            try {
-                await context.settings.update((draft) => {
-                    if (parsed.enabled !== undefined) {
-                        draft.killswitch.enabled = parsed.enabled;
-                    }
-                    if (parsed.minimum_remaining_percent !== undefined) {
-                        draft.killswitch.minimum_remaining_percent =
-                            parsed.minimum_remaining_percent;
-                    }
-                });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                log.warn('killswitch update failed', { error: message });
-                return {
-                    text: `Killswitch update failed: ${message}`,
-                    knobs: { timeoutMs: 2_000, error: true },
-                };
-            }
-            // Complete persisted state — the dialog re-renders the full
-            // killswitch shape (enabled, threshold, per-account overrides).
-            const after = context.settings.get();
-            return {
-                text: 'Killswitch updated',
-                knobs: {
-                    enabled: after.killswitch.enabled,
-                    minimum_remaining_percent: after.killswitch.minimum_remaining_percent,
-                    accounts: after.killswitch.accounts ?? {},
-                    timeoutMs: 2_000,
-                },
+                ],
             };
-        }
-        case 'antigravity-dump': {
-            const action = parseGeminiDumpCommandAction(request.arguments);
-            if (action.type === 'enable')
-                setGeminiDumpEnabled(true);
-            else if (action.type === 'disable')
-                setGeminiDumpEnabled(false);
-            return {
-                text: executeGeminiDumpCommand({
-                    argumentsText: request.arguments,
-                }),
-                knobs: { timeoutMs: 2_000 },
-            };
-        }
-        case 'antigravity-logging': {
-            const level = parseLoggingLevel(request.arguments);
-            await context.settings.update((draft) => {
-                draft.log_level = level;
-            });
-            return {
-                text: `Logging level set to ${level}`,
-                knobs: { log_level: level, timeoutMs: 2_000 },
-            };
-        }
-        default: {
-            const exhaustiveCheck = request.command;
-            throw new Error(`Unknown command ${exhaustiveCheck}`);
-        }
-    }
+        },
+    };
 }
 /**
- * Build a sidebar refresher bound to the supplied account-snapshot provider.
- * The plugin entry passes `lifecycle.getAccountManager()`'s snapshot getter so
- * every `/antigravity-*` apply that mutates persistent state also bumps the
- * sidebar's `checkedAt`. The refresher is best-effort: a lock-contention
- * error or missing manager is swallowed by the caller.
+ * The OpenCode 1 `/antigravity` menu over the account store, built with
+ * the shared core factory in repository mode. The host registers it as
+ * its one slash command and carries its payloads over its own RPC.
  */
-export function createSidebarRefresher(getAccounts) {
-    return async (dialogAccounts) => {
-        // Live cooldown lookup keyed by numeric index — a best-effort
-        // fallback for rows projected before coolingDownUntil was
-        // added to CommandAccountRow. Rows now carry their own
-        // cooldown from projection time; the live map only fills in
-        // when the row value is absent.
-        const liveByIndex = new Map();
-        try {
-            const live = getAccounts();
-            if (live) {
-                for (const entry of live)
-                    liveByIndex.set(entry.index, entry.coolingDownUntil);
-            }
-        }
-        catch {
-            // The live provider is best-effort; fall through with an empty
-            // map if the manager is gone.
-        }
-        const accounts = dialogAccounts
-            ? dialogAccounts.map((entry) => {
-                // Prefer the row's own cooldown — it was projected from the
-                // live view at the last projection and is stable regardless
-                // of concurrent reloads. Fall back to the live-by-index map
-                // only for legacy rows that lack the field entirely (?? can't
-                // distinguish absent from present-but-undefined).
-                const liveCooldown = 'coolingDownUntil' in entry
-                    ? entry.coolingDownUntil
-                    : liveByIndex.get(entry.index);
-                return {
-                    index: entry.index,
-                    label: entry.label,
-                    enabled: entry.enabled,
-                    current: entry.current,
-                    coolingDownUntil: liveCooldown,
-                    healthScore: entry.healthScore,
-                    tier: entry.tier,
-                    // Rebuild cachedQuota carrying the windows array so the sidebar
-                    // doesn't collapse from per-window rows to a single aggregate bar
-                    // after every apply. Mirrors the QuotaGroupSummary shape expected
-                    // by projectQuotaPoolForSidebar inside buildSidebarMachineStateFromAccounts.
-                    cachedQuota: Object.fromEntries(entry.quota.flatMap((group) => {
-                        if (group.remainingPercent == null)
-                            return [];
-                        return [
-                            [
-                                group.key,
-                                {
-                                    remainingFraction: group.remainingPercent / 100,
-                                    ...(group.resetAt === undefined
-                                        ? {}
-                                        : { resetTime: new Date(group.resetAt).toISOString() }),
-                                    ...(group.windows && group.windows.length > 0
-                                        ? {
-                                            windows: group.windows.map((w) => ({
-                                                window: w.window,
-                                                remainingFraction: w.remainingPercent / 100,
-                                                resetTime: typeof w.resetAt === 'number' &&
-                                                    Number.isFinite(w.resetAt)
-                                                    ? new Date(w.resetAt).toISOString()
-                                                    : '',
-                                            })),
-                                        }
-                                        : {}),
-                                },
-                            ],
-                        ];
-                    })),
-                };
-            })
-            : getAccounts();
-        if (!accounts || accounts.length === 0)
-            return;
-        try {
-            // Pass the already-projected accounts directly so every field the
-            // intermediate map built (healthScore, cachedQuota with windows, ...)
-            // reaches the redactor unchanged. A second .map here would silently
-            // drop any field not explicitly forwarded -- that is the class of
-            // defect this cast prevents.
-            await setSidebarMachineState(buildSidebarMachineStateFromAccounts(accounts));
-        }
-        catch {
-            // Sidebar refresh is best-effort; the next command or quota refresh
-            // will publish the current account snapshot.
-        }
-    };
+export async function createOpenCodeAntigravityMenu(options) {
+    return createAntigravityCommandMenu({
+        source: 'repository',
+        commands: options.commands ?? (await loadCommonAuthCommands()),
+        accounts: options.accounts,
+        settings: operatorMenuSettings(options.settings),
+        diagnostics: diagnosticsMenuSection(options),
+        ...(options.refreshQuota ? { refreshQuota: options.refreshQuota } : {}),
+        ...(options.accountLimits ? { accountLimits: options.accountLimits } : {}),
+        ...(options.login ? { login: options.login } : {}),
+        extras: [
+            ...(options.signIn ? [signInMenuSection(options.signIn)] : []),
+            ...(options.vault ? [options.vault] : []),
+        ],
+    });
+}
+function storeRefusal(opening) {
+    return new Error(opening.status === 'refused' && typeof opening.message === 'string'
+        ? opening.message
+        : 'The Antigravity account store cannot be opened');
 }
 /**
- * Hook the host's `command.execute.before` to the modal commands.
- *
- * When a slash command is invoked, we push a notification onto the
- * RPC queue and abort the normal prompt with the same handled
- * sentinel the legacy `/gemini-dump` flow already uses.
+ * Where OpenCode 1 reads accounts and admits new logins, from the auth
+ * loader's single account-store opening.
  *
- * The `sendIgnoredMessage` fallback only fires when no TUI is
- * listening — the only path that actually consumes the queued
- * message. With a live TUI, push alone is enough; double-sending
- * would otherwise render the command text as a visible chat message
- * alongside the dialog the TUI renders.
+ * - `accountSource`: the account store, the pool file of a location not
+ *   yet migrated, or nothing on a fresh installation; any other store
+ *   state refuses.
+ * - `loginTarget`: a fresh installation first gets its explicit empty
+ *   account store (`initializeFreshStore`), so the first login is admitted
+ *   by the store and never written to a new pool file; a location still on
+ *   its pool file keeps it until it is migrated; any other store state
+ *   (pending migration or recovery, an unreadable store) refuses the login.
+ *   Nothing is initialized over an existing pool file or store.
  */
-export function createCommandExecuteBefore(client, settings, pushNotification, commandData, connectionState = {
-    isTuiConnected: defaultIsTuiConnected,
-}) {
-    const context = {
-        client,
-        sessionID: '',
-        settings,
-        commandData,
+export function createAccountTargets(loader) {
+    const isReady = (opening) => opening.status === 'ready' && opening.repository !== undefined;
+    return {
+        async accountSource() {
+            const opening = await loader.accountStore();
+            if (isReady(opening))
+                return { kind: 'store', repository: opening.repository };
+            if (opening.status === 'initialization-required')
+                return { kind: 'none' };
+            if (loader.usesPoolFile(opening))
+                return { kind: 'pool-file' };
+            throw storeRefusal(opening);
+        },
+        async loginTarget() {
+            const opening = await loader.initializeFreshStore();
+            if (isReady(opening))
+                return opening.repository;
+            if (opening.status !== 'initialization-required' &&
+                loader.usesPoolFile(opening))
+                return 'pool-file';
+            throw storeRefusal(opening);
+        },
     };
-    return async (input) => {
-        const command = input.command;
-        if (command === GEMINI_DUMP_COMMAND_NAME) {
-            const action = parseGeminiDumpCommandAction(input.arguments);
-            if (action.type === 'enable' || action.type === 'disable') {
-                setGeminiDumpEnabled(action.type === 'enable');
+}
+/**
+ * The OpenCode 1 request path that follows the vault mode file: each
+ * request re-reads the mode, so the Vault section's switches take effect on
+ * the next request. In custody the vault path serves, built for the vault
+ * source custody hands out (a new source after a switch rebuilds it); in
+ * local mode the local path serves and any vault path is released. An
+ * unreadable mode file refuses the request rather than picking a path.
+ */
+export function createCustodyAwareRequestPath(options) {
+    let vault = null;
+    const releaseVault = () => {
+        const current = vault;
+        vault = null;
+        current?.path.dispose();
+    };
+    return {
+        async fetch(input, init) {
+            const mode = await options.readMode();
+            if (!mode.ok)
+                throw new Error(`The Antigravity vault mode is unclear (${mode.reason}); choose a mode in the Vault section of the Antigravity menu.`);
+            if (mode.record.mode === 'local') {
+                releaseVault();
+                return options.local.fetch(input, init);
             }
-            if (!connectionState.isTuiConnected(input.sessionID)) {
-                await sendIgnoredMessage(client, input.sessionID, executeGeminiDumpCommand({ argumentsText: input.arguments }));
+            const source = await options.custodySource();
+            if (vault?.source !== source) {
+                releaseVault();
+                vault = { source, path: options.vault(source) };
             }
-            throwHandledCommandSentinel();
-        }
-        if (command !== ANTIGRAVITY_QUOTA_COMMAND_NAME &&
-            command !== ANTIGRAVITY_ACCOUNT_COMMAND_NAME &&
-            command !== ANTIGRAVITY_ROUTING_COMMAND_NAME &&
-            command !== ANTIGRAVITY_KILLSWITCH_COMMAND_NAME &&
-            command !== ANTIGRAVITY_DUMP_COMMAND_NAME &&
-            command !== ANTIGRAVITY_LOGGING_COMMAND_NAME) {
-            return;
-        }
-        const payload = await buildDialogPayload(command, input.arguments, {
-            ...context,
-            sessionID: input.sessionID,
-        });
-        pushNotification(payload, input.sessionID);
-        if (!connectionState.isTuiConnected(input.sessionID)) {
-            await sendIgnoredMessage(client, input.sessionID, payload.text);
-        }
-        throwHandledCommandSentinel();
+            return vault.path.fetch(input, init);
+        },
+        dispose() {
+            releaseVault();
+            options.local.dispose();
+        },
     };
 }
-/**
- * Backward-compat wrapper that constructs a no-settings `command.execute.before`
- * for tests that don't care about the operator settings controller. Production
- * code wires the real controller via `createAntigravityPlugin`.
- */
-export function createCommandExecuteBeforeForClient(client, commandData) {
-    return createCommandExecuteBefore(client, createOperatorSettingsController({
-        projectConfigPath: '/dev/null',
-        userConfigPath: '/dev/null',
-    }), () => undefined, commandData);
+/** The same command dispatcher over vault sections, without a local repository or sign-in flow. */
+export async function createOpenCodeVaultAntigravityMenu(options) {
+    return createAntigravityCommandMenu({
+        source: 'sections',
+        commands: options.commands ?? (await loadCommonAuthCommands()),
+        sections: {
+            ...options.sections,
+            ...antigravitySettingsSections(operatorMenuSettings(options.settings)),
+        },
+        diagnostics: diagnosticsMenuSection(options),
+        extras: options.vault ? [options.vault] : [],
+    });
 }
 //# sourceMappingURL=commands.js.map