@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.1

package/dist/src/common-auth-embedded/auth-menu/accounts.js

@@ -0,0 +1,387 @@
+import { formatQuota, isQuotaMap, projectQuota, quotaTextParts, } from '../quota/index.js';
+import { PoolOperationError, } from '../store/index.js';
+import { doctorAction } from './doctor.js';
+import { runMenuLogin } from './login.js';
+import { runMenu, } from './menu.js';
+/** The reason recorded on a row the menu disables. */
+export const MENU_DISABLE_REASON = 'disabled from the auth menu';
+/** At most this many account lines are shown above the actions. */
+const STATUS_ACCOUNT_LINES = 8;
+async function readRows(store) {
+    const load = await store.read();
+    if (load.status === 'ready')
+        return { rows: load.rows };
+    if (load.status === 'pending-migration')
+        return { rows: [], problem: 'The account store has not been migrated yet.' };
+    return {
+        rows: [],
+        problem: `The account store could not be read (${load.file}: ${load.reason}).`,
+    };
+}
+/**
+ * Whether the store holds any usable credential. Meant as one half of an
+ * `hasCredential` predicate (the other being the host's own slot); a row with
+ * no credential does not count, since it gives the menu nothing to manage.
+ */
+export async function poolHasCredential(store) {
+    const { rows } = await readRows(store);
+    return rows.some((row) => row.credential !== undefined);
+}
+function describeRow(row) {
+    const parts = [];
+    if (row.label)
+        parts.push(row.label);
+    if (row.invalid)
+        parts.push(`invalid ${row.invalid}`);
+    else if (!row.enabled)
+        parts.push(row.disabledReason ? `disabled: ${row.disabledReason}` : 'disabled');
+    else
+        parts.push('enabled');
+    if (!row.credential && !row.invalid)
+        parts.push('no credential');
+    return parts.join(', ');
+}
+function accountLines(read) {
+    if (read.problem)
+        return [read.problem];
+    if (read.rows.length === 0)
+        return ['No accounts yet.'];
+    const lines = read.rows
+        .slice(0, STATUS_ACCOUNT_LINES)
+        .map((row) => `${row.id}: ${describeRow(row)}`);
+    const more = read.rows.length - STATUS_ACCOUNT_LINES;
+    if (more > 0)
+        lines.push(`... and ${more} more`);
+    return lines;
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function pickAccount(context, rows, message) {
+    if (rows.length === 0) {
+        context.print('There are no accounts.');
+        return null;
+    }
+    return context.select(rows.map((row) => ({ label: row.id, value: row, hint: describeRow(row) })), { message });
+}
+function defaultAccountId(account, rows) {
+    const taken = new Set(rows.map((row) => row.id));
+    if (account.id && !taken.has(account.id))
+        return account.id;
+    for (let n = 1;; n++) {
+        const id = `account-${n}`;
+        if (!taken.has(id))
+            return id;
+    }
+}
+/**
+ * Formats a row's stored quota map as one line per window, in the shared
+ * quota wording (`5h 58% left, resets 2h`; see `formatQuota` in `/quota`).
+ * `now` is the current time in ms and defaults to the clock.
+ */
+export function quotaLines(row, now = Date.now()) {
+    const projected = isQuotaMap(row.quota) ? projectQuota(row.quota) : undefined;
+    const parts = quotaTextParts(projected, { now, form: 'full' });
+    // With nothing to list, the line is the shared formatter's own sentence.
+    return (parts.length > 0 ? parts : [formatQuota(projected, { now })]).map((line) => `  ${line}`);
+}
+/** Adds an account through the plugin's login and reports what the store did. */
+export function addAccountAction(options) {
+    return {
+        id: 'add-account',
+        label: 'Add account',
+        hint: 'sign in to another account',
+        async run(context) {
+            const login = options.login;
+            if (!login)
+                throw new Error('No login is configured');
+            const account = await runMenuLogin(login, context);
+            const { rows } = await readRows(options.store);
+            const id = (options.newAccountId ?? defaultAccountId)(account, rows);
+            const added = await options.store.add({
+                id,
+                credential: account.credential,
+                ...(account.identity !== undefined
+                    ? { identity: account.identity }
+                    : {}),
+                ...(account.label !== undefined ? { label: account.label } : {}),
+            }, options.extraLocks ? { extraLocks: options.extraLocks } : {});
+            if (added.outcome === 'rotated')
+                context.print(`That sign-in is already account ${added.id}; its credential was updated.`);
+            else if (added.outcome === 'added-disabled')
+                context.print(`Added account ${added.id}, disabled: another enabled account is the same provider account.`);
+            else if (added.outcome === 'completed')
+                context.print(`Finished adding account ${added.id}.`);
+            else
+                context.print(`Added account ${added.id}.`);
+        },
+    };
+}
+/**
+ * Signs an existing account in again and replaces its credential. A login
+ * that comes back as a different provider account is refused: replacing
+ * would silently turn the row into another account.
+ */
+export function reauthenticateAction(options) {
+    return {
+        id: 'reauthenticate',
+        label: 'Re-authenticate account',
+        hint: 'sign an account in again',
+        async run(context) {
+            const login = options.login;
+            if (!login)
+                throw new Error('No login is configured');
+            const { rows } = await readRows(options.store);
+            const row = await pickAccount(context, rows, 'Re-authenticate which account?');
+            if (!row)
+                return;
+            const account = await runMenuLogin(login, context);
+            if (account.identity !== undefined &&
+                row.identity !== undefined &&
+                account.identity !== row.identity) {
+                context.print(`That sign-in is a different account from ${row.id}; nothing was changed. Use Add account to add it.`);
+                return;
+            }
+            const identity = account.identity ?? row.identity;
+            await options.store.replace(row.id, account.credential, identity !== undefined ? { identity } : {}, options.extraLocks ? { extraLocks: options.extraLocks } : {});
+            context.print(`Updated the sign-in of account ${row.id}.`);
+        },
+    };
+}
+function removeOptions(options) {
+    return {
+        ...(options.protect ? { protect: options.protect } : {}),
+        ...(options.extraLocks ? { extraLocks: options.extraLocks } : {}),
+    };
+}
+function protectedReason(error) {
+    return error instanceof PoolOperationError && error.kind === 'row-protected'
+        ? error.message
+        : undefined;
+}
+/** Removes one account after the operator confirms it by name. */
+export function removeAccountAction(options) {
+    return {
+        id: 'remove-account',
+        label: 'Remove account',
+        hint: 'delete one account',
+        async run(context) {
+            const { rows } = await readRows(options.store);
+            const row = await pickAccount(context, rows, 'Remove which account?');
+            if (!row)
+                return;
+            if (!(await context.confirm(`Remove account ${row.id}?`))) {
+                context.print('Cancelled; nothing was changed.');
+                return;
+            }
+            try {
+                await options.store.remove(row.id, removeOptions(options));
+            }
+            catch (error) {
+                const reason = protectedReason(error);
+                if (reason === undefined)
+                    throw error;
+                context.print(`Account ${row.id} was kept: ${reason}`);
+                return;
+            }
+            context.print(`Removed account ${row.id}.`);
+        },
+    };
+}
+/** Disables an enabled account, or enables a disabled one. */
+export function toggleAccountAction(options) {
+    return {
+        id: 'toggle-account',
+        label: 'Enable or disable account',
+        hint: 'stop or resume using an account',
+        async run(context) {
+            const { rows } = await readRows(options.store);
+            const row = await pickAccount(context, rows, 'Enable or disable which account?');
+            if (!row)
+                return;
+            const toggle = options.extraLocks
+                ? { extraLocks: options.extraLocks }
+                : {};
+            if (row.enabled) {
+                await options.store.disable(row.id, options.disableReason ?? MENU_DISABLE_REASON, toggle);
+                context.print(`Disabled account ${row.id}.`);
+                return;
+            }
+            try {
+                await options.store.enable(row.id, toggle);
+            }
+            catch (error) {
+                if (error instanceof PoolOperationError &&
+                    error.kind === 'duplicate-identity') {
+                    context.print(`Account ${row.id} stays disabled: another enabled account is the same provider account.`);
+                    return;
+                }
+                throw error;
+            }
+            context.print(`Enabled account ${row.id}.`);
+        },
+    };
+}
+/** Prints every account and its state, changing nothing. */
+export function listAccountsAction(options) {
+    return {
+        id: 'list-accounts',
+        label: 'List accounts',
+        hint: 'show every account',
+        async run(context) {
+            const read = await readRows(options.store);
+            if (read.problem) {
+                context.print(read.problem);
+                return;
+            }
+            if (read.rows.length === 0)
+                context.print('No accounts yet.');
+            for (const row of read.rows)
+                context.print(`${row.id}: ${describeRow(row)}`);
+        },
+    };
+}
+/**
+ * Polls each account's quota once, in order, records each reading through
+ * the store (so it lands only on the credential it was taken with), then
+ * prints every account's windows from what is stored.
+ */
+export function checkQuotasAction(options) {
+    return {
+        id: 'check-quotas',
+        label: 'Check quotas',
+        hint: 'poll and show the windows of each account',
+        async run(context) {
+            const before = await readRows(options.store);
+            if (before.problem) {
+                context.print(before.problem);
+                return;
+            }
+            const errors = new Map();
+            const poll = options.pollQuota;
+            if (poll) {
+                for (const row of before.rows) {
+                    if (row.invalid ||
+                        !row.credential ||
+                        row.credentialEpoch === undefined) {
+                        errors.set(row.id, 'no usable credential');
+                        continue;
+                    }
+                    try {
+                        const observation = await poll(row);
+                        await options.store.recordQuota(row.id, {
+                            credentialEpoch: row.credentialEpoch,
+                            ...(row.identity !== undefined
+                                ? { identity: row.identity }
+                                : {}),
+                        }, observation);
+                    }
+                    catch (error) {
+                        errors.set(row.id, errorText(error));
+                    }
+                }
+            }
+            const after = await readRows(options.store);
+            if (after.rows.length === 0)
+                context.print('No accounts yet.');
+            for (const row of after.rows) {
+                context.print(`${row.id}:`);
+                const error = errors.get(row.id);
+                if (error)
+                    context.print(`  quota check failed: ${error}`);
+                for (const line of quotaLines(row, (options.now ?? Date.now)()))
+                    context.print(line);
+            }
+        },
+    };
+}
+/**
+ * Removes every account the plugin does not protect. Each removal goes
+ * through `store.remove` with the plugin's `protect`, so a protected id is
+ * refused under the store's locks and stays, with its files untouched.
+ */
+export function deleteAllAction(options) {
+    return {
+        id: 'delete-all',
+        label: 'Delete all accounts',
+        destructive: true,
+        confirm: 'Delete every account? Accounts the plugin keeps are not deleted.',
+        async run(context) {
+            const read = await readRows(options.store);
+            if (read.problem) {
+                context.print(read.problem);
+                return;
+            }
+            const removed = [];
+            const kept = [];
+            for (const row of read.rows) {
+                try {
+                    await options.store.remove(row.id, removeOptions(options));
+                    removed.push(row.id);
+                }
+                catch (error) {
+                    const reason = protectedReason(error);
+                    if (reason === undefined)
+                        throw error;
+                    kept.push(`${row.id} (${reason})`);
+                }
+            }
+            context.print(`Deleted ${removed.length} account(s).`);
+            if (kept.length > 0)
+                context.print(`Kept: ${kept.join(', ')}.`);
+        },
+    };
+}
+/**
+ * The menu's actions for this plugin and mode. Local mode: add,
+ * re-authenticate, remove, enable/disable, check quotas, doctor, the
+ * plugin's extras, delete all. Custody mode: list, enable/disable, check
+ * quotas, doctor and the extras; nothing that adds, signs in or removes.
+ */
+export async function accountMenuActions(options) {
+    return actionsFor(options, (await options.custody?.()) === true);
+}
+function actionsFor(options, custody) {
+    const doctor = options.doctor?.length
+        ? [doctorAction({ checks: options.doctor })]
+        : [];
+    const extras = [...(options.extraActions ?? [])];
+    if (custody) {
+        return [
+            listAccountsAction(options),
+            toggleAccountAction(options),
+            checkQuotasAction(options),
+            ...doctor,
+            ...extras,
+        ];
+    }
+    return [
+        ...(options.login
+            ? [addAccountAction(options), reauthenticateAction(options)]
+            : []),
+        removeAccountAction(options),
+        toggleAccountAction(options),
+        checkQuotasAction(options),
+        ...doctor,
+        ...extras,
+        deleteAllAction(options),
+    ];
+}
+/** Shows the account menu once and runs the chosen action. */
+export async function runAccountMenu(options) {
+    const custody = (await options.custody?.()) === true;
+    const actions = actionsFor(options, custody);
+    const [read, status] = await Promise.all([
+        readRows(options.store),
+        options.status?.() ?? [],
+    ]);
+    return runMenu({
+        title: options.title,
+        subtitle: custody
+            ? 'Accounts come from the vault; select an action'
+            : 'Select an account action',
+        status: [...status, ...accountLines(read)],
+        actions,
+        ...(options.terminal ? { terminal: options.terminal } : {}),
+    });
+}

package/dist/src/common-auth-embedded/auth-menu/ansi.d.ts

@@ -0,0 +1,26 @@
+/** ANSI controls used by the first-party auth menu. */
+export declare const ANSI: {
+    readonly hide: '\u001B[?25l';
+    readonly show: '\u001B[?25h';
+    readonly up: (n?: number) => string;
+    readonly clearLine: '\u001B[2K';
+    readonly clearScreen: '\u001B[2J';
+    readonly moveTo: (row: number, col: number) => string;
+    readonly cyan: '\u001B[36m';
+    readonly green: '\u001B[32m';
+    readonly red: '\u001B[31m';
+    readonly dim: '\u001B[2m';
+    readonly reset: '\u001B[0m';
+};
+export type KeyAction = 'up' | 'down' | 'left' | 'right' | 'enter' | 'escape' | 'escape-start' | 'char' | null;
+/** Tokenize complete keys in one read; incomplete escape sequences are ignored. */
+export declare function parseKeys(data: Buffer | string): KeyAction[];
+/** Preserve the single-key parser for callers that only need the first token. */
+export declare function parseKey(data: Buffer | string): KeyAction;
+/** Remove colour codes, leaving the text an operator sees. */
+export declare function stripAnsi(input: string): string;
+/**
+ * Shorten coloured text to a visible width without cutting an escape code in
+ * half, resetting the colour before the ellipsis so it cannot bleed.
+ */
+export declare function truncateAnsi(input: string, maxVisibleChars: number): string;

package/dist/src/common-auth-embedded/auth-menu/ansi.js

@@ -0,0 +1,98 @@
+/** ANSI controls used by the first-party auth menu. */
+export const ANSI = {
+    hide: '\x1b[?25l',
+    show: '\x1b[?25h',
+    up: (n = 1) => `\x1b[${n}A`,
+    clearLine: '\x1b[2K',
+    clearScreen: '\x1b[2J',
+    moveTo: (row, col) => `\x1b[${row};${col}H`,
+    cyan: '\x1b[36m',
+    green: '\x1b[32m',
+    red: '\x1b[31m',
+    dim: '\x1b[2m',
+    reset: '\x1b[0m',
+};
+/** Tokenize complete keys in one read; incomplete escape sequences are ignored. */
+export function parseKeys(data) {
+    const value = data.toString();
+    const keys = [];
+    for (let index = 0; index < value.length;) {
+        const char = value[index];
+        if (char === '\x1b') {
+            const sequence = value.slice(index, index + 3);
+            const arrow = sequence[1] === '[' || sequence[1] === 'O' ? sequence[2] : undefined;
+            if (arrow && 'ABCD'.includes(arrow)) {
+                const action = { A: 'up', B: 'down', C: 'right', D: 'left' };
+                const parsed = action[arrow];
+                if (parsed)
+                    keys.push(parsed);
+                index += 3;
+            }
+            else if (index + 1 === value.length) {
+                // Only a chunk consisting solely of ESC gets the legacy Escape timeout.
+                if (index === 0)
+                    keys.push('escape-start');
+                index += 1;
+            }
+            else if ((value[index + 1] === '[' || value[index + 1] === 'O') &&
+                index + 2 >= value.length) {
+                // An incomplete escape prefix at the chunk boundary is not a key.
+                break;
+            }
+            else {
+                index += 1;
+            }
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            keys.push('enter');
+        else if (char === '\x03')
+            keys.push('escape');
+        else if (char && char >= ' ')
+            keys.push('char');
+        index += 1;
+    }
+    return keys;
+}
+/** Preserve the single-key parser for callers that only need the first token. */
+export function parseKey(data) {
+    return parseKeys(data)[0] ?? null;
+}
+const ANSI_PATTERN = `${String.fromCharCode(27)}\\[[0-9;]*m`;
+const ANSI_REGEX = new RegExp(ANSI_PATTERN, 'g');
+const ANSI_LEADING_REGEX = new RegExp(`^${ANSI_PATTERN}`);
+/** Remove colour codes, leaving the text an operator sees. */
+export function stripAnsi(input) {
+    return input.replace(ANSI_REGEX, '');
+}
+/**
+ * Shorten coloured text to a visible width without cutting an escape code in
+ * half, resetting the colour before the ellipsis so it cannot bleed.
+ */
+export function truncateAnsi(input, maxVisibleChars) {
+    if (maxVisibleChars <= 0)
+        return '';
+    if (stripAnsi(input).length <= maxVisibleChars)
+        return input;
+    const suffix = maxVisibleChars >= 3 ? '...' : '.'.repeat(maxVisibleChars);
+    const keep = Math.max(0, maxVisibleChars - suffix.length);
+    let output = '';
+    let offset = 0;
+    let visible = 0;
+    while (offset < input.length && visible < keep) {
+        if (input[offset] === '\x1b') {
+            const match = input.slice(offset).match(ANSI_LEADING_REGEX);
+            if (match) {
+                output += match[0];
+                offset += match[0].length;
+                continue;
+            }
+        }
+        output += input[offset];
+        offset += 1;
+        visible += 1;
+    }
+    return output.includes('\x1b[')
+        ? `${output}${ANSI.reset}${suffix}`
+        : output + suffix;
+}

package/dist/src/common-auth-embedded/auth-menu/confirm.d.ts

@@ -0,0 +1,7 @@
+import { type MenuTerminal } from './terminal.js';
+/**
+ * Ask a yes/no question. "No" is listed first unless `defaultYes`, so a
+ * stray Enter declines. Escape, and a terminal that cannot take keys, count
+ * as "No": nothing destructive runs without an explicit yes.
+ */
+export declare function confirm(terminal: MenuTerminal, message: string, defaultYes?: boolean): Promise<boolean>;

package/dist/src/common-auth-embedded/auth-menu/confirm.js

@@ -0,0 +1,21 @@
+import { select } from './select.js';
+import { isInteractive } from './terminal.js';
+/**
+ * Ask a yes/no question. "No" is listed first unless `defaultYes`, so a
+ * stray Enter declines. Escape, and a terminal that cannot take keys, count
+ * as "No": nothing destructive runs without an explicit yes.
+ */
+export async function confirm(terminal, message, defaultYes = false) {
+    if (!isInteractive(terminal))
+        return false;
+    const items = defaultYes
+        ? [
+            { label: 'Yes', value: true },
+            { label: 'No', value: false },
+        ]
+        : [
+            { label: 'No', value: false },
+            { label: 'Yes', value: true },
+        ];
+    return (await select(terminal, items, { message })) ?? false;
+}

package/dist/src/common-auth-embedded/auth-menu/doctor.d.ts

@@ -0,0 +1,52 @@
+import type { MenuAction, MenuContext } from './menu.js';
+/** A fix the doctor can offer for one finding; applied only when chosen. */
+export interface DoctorRepair {
+    /** What the repair does, as the operator is asked about it. */
+    label: string;
+    apply(): void | Promise<void>;
+}
+export interface DoctorFinding {
+    /** A stable plugin-chosen code, for tests and logs. */
+    code: string;
+    message: string;
+    accountId?: string;
+    repair?: DoctorRepair;
+}
+/** One plugin-registered check. A check only reads; repairs do the writing. */
+export interface DoctorCheck {
+    id: string;
+    run(): readonly DoctorFinding[] | Promise<readonly DoctorFinding[]>;
+}
+export interface DoctorReport {
+    findings: DoctorFinding[];
+}
+/** The code of the finding recorded for a check that threw. */
+export declare const DOCTOR_CHECK_FAILED = "doctor-check-failed";
+/**
+ * Runs every check in order. A check that throws becomes a finding of its
+ * own instead of hiding what the other checks found.
+ */
+export declare function runDoctorChecks(checks: readonly DoctorCheck[]): Promise<DoctorReport>;
+export declare function formatDoctorReport(title: string, report: DoctorReport): string[];
+export interface RepairOutcome {
+    applied: DoctorFinding[];
+    declined: DoctorFinding[];
+    failed: {
+        finding: DoctorFinding;
+        error: unknown;
+    }[];
+}
+/**
+ * Asks about each available repair in turn and applies only the ones the
+ * operator answers yes to. Without an interactive terminal every question
+ * is answered no, so nothing is written.
+ */
+export declare function applyChosenRepairs(context: MenuContext, report: DoctorReport): Promise<RepairOutcome>;
+export interface DoctorActionOptions {
+    checks: readonly DoctorCheck[];
+    /** The report's heading; defaults to "Auth doctor". */
+    title?: string;
+    label?: string;
+}
+/** The menu's doctor: lists every finding, then offers each repair. */
+export declare function doctorAction(options: DoctorActionOptions): MenuAction;

package/dist/src/common-auth-embedded/auth-menu/doctor.js

@@ -0,0 +1,81 @@
+/** The code of the finding recorded for a check that threw. */
+export const DOCTOR_CHECK_FAILED = 'doctor-check-failed';
+/**
+ * Runs every check in order. A check that throws becomes a finding of its
+ * own instead of hiding what the other checks found.
+ */
+export async function runDoctorChecks(checks) {
+    const findings = [];
+    for (const check of checks) {
+        try {
+            findings.push(...(await check.run()));
+        }
+        catch (error) {
+            findings.push({
+                code: DOCTOR_CHECK_FAILED,
+                message: `Check ${check.id} failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+    }
+    return { findings };
+}
+export function formatDoctorReport(title, report) {
+    const lines = [title];
+    if (report.findings.length === 0) {
+        lines.push('No problems found.');
+        return lines;
+    }
+    for (const finding of report.findings) {
+        const repair = finding.repair ? ' (repair available)' : '';
+        lines.push(`- ${finding.message}${repair}`);
+    }
+    return lines;
+}
+/**
+ * Asks about each available repair in turn and applies only the ones the
+ * operator answers yes to. Without an interactive terminal every question
+ * is answered no, so nothing is written.
+ */
+export async function applyChosenRepairs(context, report) {
+    const outcome = { applied: [], declined: [], failed: [] };
+    for (const finding of report.findings) {
+        const repair = finding.repair;
+        if (!repair)
+            continue;
+        if (!(await context.confirm(`Apply repair: ${repair.label}?`))) {
+            outcome.declined.push(finding);
+            continue;
+        }
+        try {
+            await repair.apply();
+            outcome.applied.push(finding);
+        }
+        catch (error) {
+            outcome.failed.push({ finding, error });
+            context.print(`Repair failed: ${repair.label}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return outcome;
+}
+/** The menu's doctor: lists every finding, then offers each repair. */
+export function doctorAction(options) {
+    const title = options.title ?? 'Auth doctor';
+    return {
+        id: 'doctor',
+        label: options.label ?? 'Auth doctor',
+        hint: 'check accounts and offer repairs',
+        async run(context) {
+            const report = await runDoctorChecks(options.checks);
+            for (const line of formatDoctorReport(title, report))
+                context.print(line);
+            const repairable = report.findings.filter((finding) => finding.repair);
+            if (repairable.length === 0) {
+                if (report.findings.length > 0)
+                    context.print('No repairs are available.');
+                return;
+            }
+            const outcome = await applyChosenRepairs(context, report);
+            context.print(`Applied ${outcome.applied.length} of ${repairable.length} repair(s).`);
+        },
+    };
+}