@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/src/tui-raw/common-auth-embedded/logger/engine.js

@@ -0,0 +1,246 @@
+import { appendFileSync, chmodSync, existsSync, renameSync, statSync, } from "node:fs";
+import { createRedactor } from "./redact.js";
+const ORDER = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3,
+    trace: 4,
+};
+const MAX_BYTES = 5 * 1024 * 1024;
+const ROTATE_KEEP = 3;
+function chmodPrivate(path) {
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function rotateIfNeeded(f) {
+    try {
+        if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
+            return;
+        for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
+            if (existsSync(`${f}.${i}`)) {
+                const rotated = `${f}.${i + 1}`;
+                renameSync(`${f}.${i}`, rotated);
+                chmodPrivate(rotated);
+            }
+        }
+        const rotated = `${f}.1`;
+        renameSync(f, rotated);
+        chmodPrivate(rotated);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function safeSerialize(data) {
+    try {
+        return ` ${JSON.stringify(data)}`;
+    }
+    catch {
+        return ' [unserializable]';
+    }
+}
+/**
+ * One logger's settings and buffer.
+ *
+ * Where lines are written and the level floor start unset unless `options`
+ * supplies them. A host decides where its log lives (that decision reads host
+ * environment variables and host directories, neither of which belongs in
+ * shared code) and configures the logger before it runs any command. Until
+ * then every `log.*` call is a silent no-op: throwing would turn the first
+ * command a host forgot to wire into a crash, and buffering would hold
+ * credential-bearing lines for a configuration that may never arrive.
+ */
+function createEngine(options) {
+    let logFileSource;
+    let initLevelSource;
+    let runtimeLevel;
+    let redactor = createRedactor();
+    let captureSink;
+    let buffer = [];
+    let timer;
+    function configure(next) {
+        logFileSource = next.file;
+        initLevelSource = next.level;
+        redactor = createRedactor(next);
+        captureSink = next.captureSink;
+    }
+    function setLogLevel(l) {
+        if (l === undefined || l in ORDER)
+            runtimeLevel = l;
+    }
+    function logFilePath() {
+        if (logFileSource === undefined)
+            return undefined;
+        const resolved = typeof logFileSource === 'function' ? logFileSource() : logFileSource;
+        return resolved || undefined;
+    }
+    function configuredLevel() {
+        if (runtimeLevel)
+            return runtimeLevel;
+        const floor = typeof initLevelSource === 'function'
+            ? initLevelSource()
+            : initLevelSource;
+        if (floor && floor in ORDER)
+            return floor;
+        return 'info';
+    }
+    function flushLogs() {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (!buffer.length)
+            return;
+        let file;
+        try {
+            file = logFilePath();
+        }
+        catch {
+            buffer = [];
+            return;
+        }
+        const text = buffer.join('');
+        buffer = [];
+        if (!file)
+            return;
+        try {
+            rotateIfNeeded(file);
+            if (existsSync(file))
+                chmodPrivate(file);
+            appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            /* never throw */
+        }
+    }
+    function schedule() {
+        if (!timer)
+            timer = setTimeout(() => {
+                timer = undefined;
+                flushLogs();
+            }, 500);
+    }
+    function emit(channel, level, message, data) {
+        // Unconfigured (neither a file nor a sink) stays a silent no-op.
+        if (logFileSource === undefined && captureSink === undefined)
+            return;
+        try {
+            if (ORDER[level] > ORDER[configuredLevel()])
+                return;
+            const scrubbedMessage = redactor.redactStrings(message);
+            let scrubbedData;
+            try {
+                scrubbedData = redactor.redact(data);
+            }
+            catch {
+                scrubbedData = '[unserializable]';
+            }
+            const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` +
+                (data === undefined ? '' : safeSerialize(scrubbedData)) +
+                '\n';
+            // A failing observer must not prevent file logging or escape into the host.
+            try {
+                captureSink?.({
+                    channel,
+                    level,
+                    message: scrubbedMessage,
+                    data: scrubbedData,
+                });
+            }
+            catch { }
+            // A sink-only logger has no file to buffer lines for.
+            if (logFileSource === undefined)
+                return;
+            buffer.push(line);
+            if (buffer.length >= 50)
+                flushLogs();
+            else
+                schedule();
+        }
+        catch {
+            // Provider and redaction failures must never turn diagnostics into a host crash.
+        }
+    }
+    function createLogger(channel) {
+        return {
+            error: (m, d) => emit(channel, 'error', m, d),
+            warn: (m, d) => emit(channel, 'warn', m, d),
+            info: (m, d) => emit(channel, 'info', m, d),
+            debug: (m, d) => emit(channel, 'debug', m, d),
+            trace: (m, d) => emit(channel, 'trace', m, d),
+        };
+    }
+    function reset() {
+        buffer = [];
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        logFileSource = undefined;
+        initLevelSource = undefined;
+        runtimeLevel = undefined;
+        redactor = createRedactor();
+        captureSink = undefined;
+    }
+    if (options)
+        configure(options);
+    return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+/**
+ * A logger instance of its own, configured with `options`. A plugin whose
+ * copy of this module may be shared with another plugin in the same process
+ * uses this instead of `initLogger`, so neither replaces the other's file,
+ * level, redaction or capture sink.
+ */
+export function createLoggerInstance(options) {
+    const { configure, createLogger, setLogLevel, flushLogs } = createEngine(options);
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+/**
+ * The instance behind the module-level functions below, which keep the
+ * single-plugin API: one plugin per copy of this module calls `initLogger`
+ * and `createLogger` without holding an instance.
+ */
+const defaultEngine = createEngine();
+/**
+ * Point the module's default logger at a host's file and level, and return
+ * it. Idempotent: calling it again replaces both. A runtime level installed
+ * by `setLogLevel` is deliberately left alone, because it is the operator's
+ * explicit choice and outranks the floor a host computed at start-up.
+ */
+export function initLogger(options) {
+    defaultEngine.configure(options);
+    const { configure, createLogger, setLogLevel, flushLogs } = defaultEngine;
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+export function setLogLevel(l) {
+    defaultEngine.setLogLevel(l);
+}
+/**
+ * Write whatever the default logger has buffered. Safe to call synchronously
+ * from a process-exit handler, which is how each host drains the buffer on
+ * shutdown.
+ */
+export function flushLogs() {
+    defaultEngine.flushLogs();
+}
+export function createLogger(channel) {
+    return defaultEngine.createLogger(channel);
+}
+export async function flushForTest() {
+    defaultEngine.flushLogs();
+}
+/**
+ * Return the default logger to its uninitialised state. Only a test needs
+ * this: a single process runs every test file, so a file path left over from
+ * one test would keep a later "logger was never initialised" case writing
+ * lines.
+ */
+export function resetLoggerForTest() {
+    defaultEngine.reset();
+}

package/src/tui-raw/common-auth-embedded/logger/index.js

@@ -0,0 +1,3 @@
+export { createCaptureSink } from "./capture-sink.js";
+export { createLogger, createLoggerInstance, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from "./engine.js";
+export { createRedactor, redact, redactStrings } from "./redact.js";

package/src/tui-raw/common-auth-embedded/logger/redact.js

@@ -0,0 +1,83 @@
+const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
+const MASK = '***REDACTED***';
+// How many errors deep a cause chain is followed. A chain this long is
+// already unreadable in a log line, and an unbounded one (each cause a fresh
+// object, so the cycle check never trips) must not grow the line forever.
+const MAX_ERROR_DEPTH = 8;
+// Error's own fields are non-enumerable, so a plain entry walk renders an
+// Error as `{}` and the name, message and stack a plugin logged are lost.
+// The tag check also recognises an Error from another realm (a worker or a
+// vm context), whose prototype is not this realm's Error.
+function isError(value) {
+    return (value instanceof Error ||
+        Object.prototype.toString.call(value) === '[object Error]');
+}
+export function createRedactor(options = {}) {
+    const patterns = [TOKEN_VALUE, ...(options.extraValuePatterns ?? [])].map((pattern) => new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`));
+    function isSecretKey(key) {
+        const normalized = key.toLowerCase().replace(/[-_]/g, '');
+        return (SECRET_KEY_EXACT.test(key) ||
+            normalized.includes('apikey') ||
+            normalized.endsWith('secret') ||
+            normalized.endsWith('password') ||
+            (normalized.endsWith('token') && !normalized.endsWith('tokens')) ||
+            !!options.extraSecretKeys?.(normalized));
+    }
+    // The fields every log reader wants first, then whatever else the error
+    // carries as its own enumerable properties (which is all an Error rendered
+    // as before). Every entry goes through the same key and string scrubbing as
+    // any other object, so a token in a message or stack is still masked.
+    function errorEntries(error) {
+        const fields = error;
+        const entries = [
+            ['name', error.name],
+            ['message', error.message],
+            ['stack', error.stack],
+        ];
+        for (const key of ['code', 'status', 'cause'])
+            if (fields[key] !== undefined)
+                entries.push([key, fields[key]]);
+        const listed = new Set(entries.map(([key]) => key));
+        for (const entry of Object.entries(error))
+            if (!listed.has(entry[0]))
+                entries.push(entry);
+        return entries;
+    }
+    function walk(value, keys, seen, errorDepth = 0) {
+        if (typeof value === 'string') {
+            return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
+        }
+        if (!value || typeof value !== 'object')
+            return value;
+        if (seen.has(value))
+            return '[Circular]';
+        seen.add(value);
+        try {
+            if (Array.isArray(value))
+                return value.map((item) => walk(item, keys, seen, errorDepth));
+            const error = isError(value);
+            if (error && errorDepth >= MAX_ERROR_DEPTH)
+                return '[Truncated]';
+            const childDepth = error ? errorDepth + 1 : errorDepth;
+            // Define own properties so a diagnostic __proto__ key cannot change the output prototype.
+            return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
+                key,
+                keys && isSecretKey(key)
+                    ? MASK
+                    : walk(item, keys, seen, childDepth),
+            ]));
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    return {
+        redact: (value) => walk(value, true, new WeakSet()),
+        // Schema keys describe arguments, not credentials; only their string values are scrubbed.
+        redactStrings: (value) => walk(value, false, new WeakSet()),
+    };
+}
+const defaultRedactor = createRedactor();
+export const redact = defaultRedactor.redact;
+export const redactStrings = defaultRedactor.redactStrings;

package/src/tui-raw/common-auth-embedded/quota/codec.js

@@ -0,0 +1,12 @@
+import { isQuotaMap } from "./map.js";
+import { mergeQuotaObservation } from "./merge.js";
+/**
+ * The quota codec the account-pool store (the `/store` subpath) takes when it
+ * is opened: `validate` checks a stored per-row quota map and `merge` applies
+ * an observation to one, so the store persists the map without interpreting
+ * it.
+ */
+export const quotaCodec = Object.freeze({
+    validate: isQuotaMap,
+    merge: mergeQuotaObservation,
+});

package/src/tui-raw/common-auth-embedded/quota/format.js

@@ -0,0 +1,138 @@
+// The one quota wording every surface shows: the command menu's dialogs on
+// OpenCode and Pi, the terminal auth menu, and the plugins' sidebars. Each of
+// them calls `formatQuota` (or `quotaTextParts` for one line per window), so
+// the wording cannot drift between plugins or between a dialog and a sidebar.
+//
+// The rules: a window is named by its length (`5h`, `7d`), or, for a window
+// that binds only one model family, by the label the plugin stored it under.
+// Every figure is "% left". A window the provider did not report (an absence
+// record or a retirement tombstone) is left out rather than written as "not
+// reported". A reset is a short time from now (`resets 2h`). A reading older
+// than fifteen minutes says how old it is (`checked 3h ago`).
+//
+// Like the rest of this module it reads no clock: `now` is a parameter.
+import { ALL_SCOPE } from "./map.js";
+/** A reading older than this is marked with its age. */
+export const QUOTA_STALE_AFTER_MS = 15 * 60_000;
+/** What `formatQuota` returns when there is no reading at all. */
+export const NO_QUOTA_READING = 'no quota reading yet';
+/**
+ * What `formatQuota` returns when the provider answered but reported no
+ * limit for any window (every window is an absence record or a tombstone).
+ */
+export const NO_LIMITS_REPORTED = 'no limits reported';
+/**
+ * A length or a time span in its largest whole-ish unit: `45m`, `5h`, `3d`.
+ * Spans under an hour are minutes, under a day hours, otherwise days, each
+ * rounded to the nearest unit and never shown as zero.
+ */
+function shortSpan(ms) {
+    const minutes = Math.max(1, Math.round(ms / 60_000));
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 24)
+        return `${hours}h`;
+    return `${Math.max(1, Math.round(minutes / 1440))}d`;
+}
+/** A stored window length in minutes as its exact name: `5h`, `7d`, `90m`. */
+function lengthName(minutes) {
+    if (minutes % 1440 === 0)
+        return `${minutes / 1440}d`;
+    if (minutes % 60 === 0)
+        return `${minutes / 60}h`;
+    return `${minutes}m`;
+}
+/**
+ * The name a window is shown under. A general window (scope `all`) is named
+ * by its stored length; a model-scoped window keeps the label the plugin
+ * stored it under, which already names the model (`seven_day_opus`). A
+ * general window stored without a length (a snapshot from before lengths
+ * were recorded) falls back to its label.
+ */
+export function quotaWindowName(limit) {
+    if (limit.scope !== ALL_SCOPE || limit.windowMinutes === undefined)
+        return limit.label;
+    return lengthName(limit.windowMinutes);
+}
+function percentLeft(remaining) {
+    return `${Math.round(Math.min(100, Math.max(0, remaining)))}% left`;
+}
+function resetText(resetsAt, now) {
+    if (resetsAt === undefined)
+        return '';
+    const at = Date.parse(resetsAt);
+    // A reset already passed says nothing about the future; leave it out.
+    if (!Number.isFinite(at) || at <= now)
+        return '';
+    return `, resets ${shortSpan(at - now)}`;
+}
+/** Shortest window first, so `5h` reads before `7d`; unknown lengths last. */
+function displayOrder(left, right) {
+    const l = left.windowMinutes;
+    const r = right.windowMinutes;
+    if (l !== undefined && r !== undefined && l !== r)
+        return l - r;
+    if ((l === undefined) !== (r === undefined))
+        return l === undefined ? 1 : -1;
+    if (left.scope !== right.scope) {
+        if (left.scope === ALL_SCOPE)
+            return -1;
+        if (right.scope === ALL_SCOPE)
+            return 1;
+        return left.scope < right.scope ? -1 : 1;
+    }
+    return left.label < right.label ? -1 : left.label > right.label ? 1 : 0;
+}
+/**
+ * The pieces of a quota text, in order: one per reported window
+ * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
+ * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
+ * was reported; `formatQuota` turns that into a sentence. A caller printing
+ * one line per window (the terminal auth menu) uses these directly.
+ */
+export function quotaTextParts(quota, options) {
+    if (!quota)
+        return [];
+    const { now } = options;
+    const full = (options.form ?? 'full') === 'full';
+    const parts = [];
+    const times = [];
+    const readings = quota.limits
+        .filter((limit) => limit.kind === 'reading' && limit.remainingPercent !== undefined)
+        .sort(displayOrder);
+    for (const limit of readings) {
+        times.push(limit.checkedAt);
+        parts.push(`${quotaWindowName(limit)} ${percentLeft(limit.remainingPercent ?? 0)}${full ? resetText(limit.resetsAt, now) : ''}`);
+    }
+    const budget = quota.budget;
+    if (budget) {
+        times.push(budget.checkedAt);
+        const figure = budget.reached
+            ? 'credits spent'
+            : budget.remainingPercent !== undefined
+                ? `credits ${percentLeft(budget.remainingPercent)}`
+                : 'credits available';
+        parts.push(`${figure}${full ? resetText(budget.resetsAt, now) : ''}`);
+    }
+    if (times.length > 0) {
+        const age = now - Math.min(...times);
+        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))
+            parts.push(`checked ${shortSpan(age)} ago`);
+    }
+    return parts;
+}
+/**
+ * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
+ * form, with `, resets 2h` after each window in the full form. With nothing
+ * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
+ * provider answered without a limit for any window.
+ */
+export function formatQuota(quota, options) {
+    const parts = quotaTextParts(quota, options);
+    if (parts.length > 0)
+        return parts.join(' · ');
+    return quota && quota.limits.length > 0
+        ? NO_LIMITS_REPORTED
+        : NO_QUOTA_READING;
+}

package/src/tui-raw/common-auth-embedded/quota/index.js

@@ -0,0 +1,5 @@
+export { quotaCodec } from "./codec.js";
+export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from "./format.js";
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from "./map.js";
+export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from "./merge.js";
+export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from "./projection.js";

package/src/tui-raw/common-auth-embedded/quota/map.js

@@ -0,0 +1,105 @@
+// The per-row quota map: what the pool knows about one row's limits.
+//
+// A row's quota is a set of keyed limits. Each key is a (scope, window label)
+// pair: the scope is `all` for a limit that binds every request, or a model
+// family name for a limit that binds only that family; the label names the
+// window the provider reports (for example `primary` or `secondary`). Each key
+// holds one entry, which is either a reading, a retirement tombstone (the key
+// held a reading until an authoritative observation stopped reporting it), or
+// an absence record (an authoritative observation reported the key as having
+// no limit before any reading was seen). Tombstones and absence records are
+// evidence that the key is known to be unlimited; a missing key is unknown.
+//
+// Beside the limits sits the credit budget, a third pressure axis with its own
+// reset clock. It is a tri-state: absent (never reported), a reading, or
+// cleared (the provider reported that no budget exists).
+//
+// The map is plain JSON so the store can persist it without interpreting it.
+/** The scope of a limit that binds every request regardless of model. */
+export const ALL_SCOPE = 'all';
+/** The window label required when an admission call supplies none. */
+export const DEFAULT_REQUIRED_LABELS = Object.freeze([
+    'primary',
+]);
+export function emptyQuotaMap() {
+    return { limits: [] };
+}
+/** The time an entry speaks for: its reading, retirement or absence time. */
+export function entryTime(entry) {
+    return entry.kind === 'retired' ? entry.retiredAt : entry.checkedAt;
+}
+export function limitKey(scope, label) {
+    // JSON-encoding the pair keeps keys unambiguous for any scope or label text.
+    return JSON.stringify([scope, label]);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value);
+}
+function isName(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function optional(record, key, check) {
+    return record[key] === undefined || check(record[key]);
+}
+function isPositiveFinite(value) {
+    return isFiniteNumber(value) && value > 0;
+}
+function isString(value) {
+    return typeof value === 'string';
+}
+function isQuotaEntry(value) {
+    if (!isRecord(value) || !isName(value.scope) || !isName(value.label)) {
+        return false;
+    }
+    switch (value.kind) {
+        case 'reading':
+            return (isFiniteNumber(value.checkedAt) &&
+                isFiniteNumber(value.usedPercent) &&
+                optional(value, 'resetsAt', isString) &&
+                optional(value, 'windowMinutes', isPositiveFinite));
+        case 'retired':
+            return isFiniteNumber(value.retiredAt);
+        case 'absent':
+            return isFiniteNumber(value.checkedAt);
+        default:
+            return false;
+    }
+}
+export function isCreditBudgetEntry(value) {
+    if (!isRecord(value) || !isFiniteNumber(value.checkedAt))
+        return false;
+    if (value.kind === 'cleared')
+        return true;
+    return (value.kind === 'reading' &&
+        typeof value.reached === 'boolean' &&
+        optional(value, 'remainingPercent', isFiniteNumber) &&
+        optional(value, 'usedPercent', isFiniteNumber) &&
+        optional(value, 'resetsAt', isString) &&
+        optional(value, 'limit', isFiniteNumber) &&
+        optional(value, 'used', isFiniteNumber) &&
+        optional(value, 'remaining', isFiniteNumber) &&
+        optional(value, 'unit', isString));
+}
+/**
+ * True when `value` is a well-formed quota map. Unrecognised top-level keys
+ * are tolerated (and preserved by merge) so a newer writer's additions
+ * survive; a malformed entry, a duplicated (scope, label) key or a malformed
+ * budget makes the whole map invalid.
+ */
+export function isQuotaMap(value) {
+    if (!isRecord(value) || !Array.isArray(value.limits))
+        return false;
+    const seen = new Set();
+    for (const entry of value.limits) {
+        if (!isQuotaEntry(entry))
+            return false;
+        const key = limitKey(entry.scope, entry.label);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+    }
+    return optional(value, 'budget', isCreditBudgetEntry);
+}