@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.1

package/src/rpc/port-file.ts

@@ -1,143 +1,9 @@
-import { randomBytes } from 'node:crypto'
-import {
-  chmod,
-  mkdir,
-  readdir,
-  readFile,
-  rename,
-  unlink,
-  writeFile,
-} from 'node:fs/promises'
-import { join } from 'node:path'
+import { discoverPortFile as discoverPublicPortFile } from '../common-auth-embedded/rpc/client.js'
 
-export interface PortFileEntry {
-  port: number
-  token: string
-  pid: number
-  startedAt: number
-}
-
-const PORT_FILE_PATTERN = /^port-(\d+)\.json$/
-const DIR_MODE = 0o700
-const FILE_MODE = 0o600
-
-export async function writePortFile(
-  dir: string,
-  entry: { port: number; token: string; pid: number },
-): Promise<string> {
-  assertPortFileEntry({ ...entry, startedAt: 0 }, entry.pid)
-
-  // mkdir recursive with the private mode on first creation; on a re-run the
-  // directory already exists with the right mode. We still re-apply chmod so
-  // an operator who widened the directory accidentally gets it repaired
-  // back to 0o700 before we drop a token-bearing file inside.
-  await mkdir(dir, { recursive: true, mode: DIR_MODE })
-  await chmod(dir, DIR_MODE)
-
-  const full: PortFileEntry = { ...entry, startedAt: Date.now() }
-  const target = join(dir, `port-${entry.pid}.json`)
-  const temporary = `${target}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
-
-  try {
-    await writeFile(temporary, JSON.stringify(full), {
-      encoding: 'utf8',
-      mode: FILE_MODE,
-    })
-    await chmod(temporary, FILE_MODE)
-    await rename(temporary, target)
-  } catch (error) {
-    try {
-      await unlink(temporary)
-    } catch {}
-    throw error
-  }
-  return target
-}
-
-export async function discoverPortFile(
-  dir: string,
-  expectedPid?: number,
-): Promise<PortFileEntry | null> {
-  let names: string[]
-  try {
-    names = await readdir(dir)
-  } catch (error) {
-    if (isNodeError(error, 'ENOENT')) return null
-    throw error
-  }
-
-  const live: PortFileEntry[] = []
-  for (const name of names) {
-    const match = PORT_FILE_PATTERN.exec(name)
-    if (!match) continue
-    const path = join(dir, name)
-    const filenamePid = Number(match[1])
-
-    let parsed: PortFileEntry
-    try {
-      const text = await readFile(path, 'utf8')
-      const raw = JSON.parse(text) as unknown
-      assertPortFileEntry(raw, filenamePid)
-      parsed = raw
-    } catch {
-      // Malformed or stale — keep the directory clean so future discovers
-      // don't trip over the same debris.
-      await unlink(path).catch(() => {})
-      continue
-    }
-
-    if (!isProcessAlive(parsed.pid)) {
-      await unlink(path).catch(() => {})
-      continue
-    }
-
-    live.push(parsed)
-  }
-
-  if (expectedPid !== undefined) {
-    // antigravity exact-PID safety: a missing expected PID must surface as
-    // null so a stale but live entry can't impersonate the requester.
-    return live.find(({ pid }) => pid === expectedPid) ?? null
-  }
-
-  if (live.length === 0) return null
-  live.sort((left, right) => right.startedAt - left.startedAt)
-  return live[0] ?? null
-}
-
-function assertPortFileEntry(
-  value: unknown,
-  filenamePid: number,
-): asserts value is PortFileEntry {
-  if (
-    typeof value !== 'object' ||
-    value === null ||
-    !Number.isSafeInteger((value as PortFileEntry).pid) ||
-    (value as PortFileEntry).pid <= 0 ||
-    (value as PortFileEntry).pid !== filenamePid ||
-    !Number.isSafeInteger((value as PortFileEntry).port) ||
-    (value as PortFileEntry).port <= 0 ||
-    (value as PortFileEntry).port > 65_535 ||
-    typeof (value as PortFileEntry).token !== 'string' ||
-    (value as PortFileEntry).token.length === 0
-  ) {
-    throw new Error('Invalid RPC port file')
-  }
-}
-
-function isProcessAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0)
-    return true
-  } catch (error) {
-    return isNodeError(error, 'EPERM')
-  }
-}
+export type { PortFileEntry } from '../common-auth-embedded/rpc/client.js'
 
-function isNodeError(error: unknown, code: string): boolean {
-  return (
-    error instanceof Error &&
-    'code' in error &&
-    (error as NodeJS.ErrnoException).code === code
-  )
+// Discovery reads directory modes without changing them. Only the server writer
+// changes directory permissions; clients discover only the expected PID.
+export function discoverPortFile(dir: string, expectedPid?: number) {
+  return discoverPublicPortFile(dir, expectedPid, { exactPid: true })
 }

package/src/rpc/protocol.ts

@@ -1,31 +1,66 @@
-export type CommandModalName =
-  | 'antigravity-quota'
-  | 'antigravity-account'
-  | 'antigravity-routing'
-  | 'antigravity-killswitch'
-  | 'antigravity-dump'
-  | 'antigravity-logging'
+/**
+ * Wire shapes of the OpenCode 1 RPC between this plugin's server and the TUI
+ * running in the same OpenCode process. The RPC is private to that process:
+ * the server listens only on 127.0.0.1 and accepts only requests that carry
+ * the bearer token from the owner-only port file it writes for its own
+ * process ID.
+ *
+ * The RPC carries the shared `/antigravity` command menu of common-auth's
+ * public `./commands` entry: the TUI sends back a `CommandApplyRequest` on
+ * `/rpc/apply` and receives a `CommandApplyResult`; queued notifications carry
+ * either the menu that opens the drawer (`CommandDialogPayload`) or a toast
+ * (`MenuNotifyPayload`).
+ *
+ * Every library type here is a type-only import, so it disappears from the
+ * compiled JavaScript: the TUI may import this module without loading the
+ * commands module or anything it depends on (store, logger, credentials).
+ */
+import type {
+  CommandApplyRequest,
+  CommandApplyResult,
+  CommandDialogPayload,
+  NotifyKind,
+} from '../common-auth-embedded/commands/index.js'
 
-export interface OpenDialogPayload {
-  command: CommandModalName
-  text: string
-  knobs: Record<string, unknown>
+export type {
+  CommandApplyRequest,
+  CommandApplyResult,
+  CommandDialogPayload,
+  NotifyKind,
 }
 
-export interface RpcNotification {
-  id: number
-  type: 'open-dialog'
-  payload: OpenDialogPayload
-  sessionId?: string
+/**
+ * A message for the user that does not open the drawer. `command` names the
+ * slash command that sent it; the TUI shows `notify` as a toast.
+ */
+export interface MenuNotifyPayload {
+  command: string
+  notify: {
+    message: string
+    kind: NotifyKind
+  }
 }
 
-export interface ApplyRequest {
-  command: CommandModalName
-  arguments: string
-  sessionId?: string
-}
+/**
+ * The payload of one queued notification: the menu that opens the drawer
+ * (`CommandDialogPayload`) or a message shown as a toast
+ * (`MenuNotifyPayload`).
+ */
+export type RpcNotificationPayload = CommandDialogPayload | MenuNotifyPayload
 
-export interface ApplyResult {
-  text: string
-  knobs: Record<string, unknown>
+/**
+ * The envelope `{id, payload, sessionId?}` of one queued notification, as
+ * `/rpc/pending-notifications` returns it inside `{ messages: [...] }`.
+ *
+ * `id` comes from one counter shared by every session of this server
+ * process: it starts at 1 and grows by one per notification. The TUI sends
+ * the last `id` it received back as `lastReceivedId` and then receives only
+ * notifications with a larger `id`. A notification with `sessionId` goes
+ * only to that session; one without it is a broadcast that every session
+ * receives.
+ */
+export interface RpcNotification {
+  id: number
+  payload: RpcNotificationPayload
+  sessionId?: string
 }

package/src/rpc/rpc-client.ts

@@ -1,102 +1,132 @@
-// Subpath import (not the barrel): this module ships into the TUI's
-// compiled tree, which must not pull the credential-bearing barrel into
-// the host's render path.
-import { fetchWithActiveTimeout } from '@cortexkit/antigravity-auth-core/fetch-timeout'
-
-import { discoverPortFile } from './port-file'
-import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
+// This client-only public entry point keeps server and writer modules out of
+// the TUI's dependency graph. This file imports nothing else, not even types:
+// the TUI build copies every relative module a file imports, type-only ones
+// included, so importing `./protocol` here would bring the commands, store
+// and fs modules into the TUI. The client is a raw JSON transport; the
+// renderer builds and validates the menu shapes, and the server parses every
+// apply request with the commands module before acting on it.
+import { createRpcClient as createPublicRpcClient } from '../common-auth-embedded/rpc/client.js'
 
 const DEFAULT_TIMEOUT_MS = 2_000
 
-const APPLY_FALLBACK: ApplyResult = { text: 'apply failed', knobs: {} }
-const PENDING_FALLBACK: RpcNotification[] = []
+const PENDING_FALLBACK: ReceivedNotification[] = []
+
+// The public client sends the fields of any object as the request body, but
+// types `apply`'s request as the older per-command dialog request
+// `{command, arguments, sessionId?}`.
+type PublicApplyRequest = Parameters<
+  ReturnType<typeof createPublicRpcClient>['apply']
+>[0]
 
 export interface RpcRequestOptions {
   timeoutMs?: number
 }
 
+/**
+ * The wire envelope of one queued notification, after this client's check:
+ * exactly `{id, payload, sessionId?}`, with `payload` a JSON object. `payload` is still unchecked JSON; the
+ * renderer must validate it as a menu or notify payload before showing
+ * anything from it.
+ */
+export interface ReceivedNotification {
+  id: number
+  payload: object
+  sessionId?: string
+}
+
 export interface RpcClient {
+  /**
+   * Sends one menu action, given as the JSON object the renderer built (a
+   * `CommandApplyRequest`); the server parses it and refuses anything else
+   * with 400. Resolves the server's answer as unchecked JSON, which the
+   * renderer must validate as a `CommandApplyResult` before using it, or
+   * `undefined` when there was no answer object: no server published
+   * for `expectedPid` (the process ID of the OpenCode process hosting the
+   * server), a refusal or other non-2xx status, a timeout, or a body that is
+   * not a JSON object.
+   */
   apply(
-    request: ApplyRequest,
+    request: unknown,
     options?: RpcRequestOptions,
-  ): Promise<ApplyResult>
+  ): Promise<object | undefined>
+  /**
+   * Notifications after `lastReceivedId`. Resolves `[]` when the call fails
+   * or when any message in the answer has a malformed envelope.
+   */
   pendingNotifications(
     lastReceivedId: number,
     sessionId?: string,
     options?: RpcRequestOptions,
-  ): Promise<RpcNotification[]>
+  ): Promise<ReceivedNotification[]>
 }
 
 export function createRpcClient(dir: string, expectedPid?: number): RpcClient {
+  const client = createPublicRpcClient(dir, expectedPid, undefined, {
+    exactPid: true,
+  })
   return {
     async apply(request, options) {
-      const result = await post<ApplyResult>(
-        dir,
-        expectedPid,
-        '/rpc/apply',
-        request,
-        options,
-      )
-      return result ?? APPLY_FALLBACK
+      try {
+        const result: unknown = await client.apply(
+          request as PublicApplyRequest,
+          options?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        )
+        return isRecord(result) && !isPublicApplyFailure(result)
+          ? result
+          : undefined
+      } catch {
+        return undefined
+      }
     },
     async pendingNotifications(lastReceivedId, sessionId, options) {
-      const result = await post<{ messages: RpcNotification[] }>(
-        dir,
-        expectedPid,
-        '/rpc/pending-notifications',
-        {
+      try {
+        const messages: unknown = await client.pending(
           lastReceivedId,
-          ...(sessionId === undefined ? {} : { sessionId }),
-        },
-        options,
-      )
-      return result?.messages ?? PENDING_FALLBACK
+          sessionId,
+          options?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        )
+        return Array.isArray(messages) && messages.every(isNotification)
+          ? messages
+          : PENDING_FALLBACK
+      } catch {
+        return PENDING_FALLBACK
+      }
     },
   }
 }
 
-async function post<T>(
-  dir: string,
-  expectedPid: number | undefined,
-  path: string,
-  body: unknown,
-  options: RpcRequestOptions | undefined,
-): Promise<T | null> {
-  // Internal nullable — every RPC call site (apply, pending) must absorb a
-  // missing/unreachable server gracefully. The TUI render path never
-  // crashes because the server is dead; the user sees a fallback text and
-  // a fresh poll retries the next tick.
-  const entry = await discoverPortFileSafe(dir, expectedPid)
-  if (!entry) return null
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
 
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS
-  try {
-    const response = await fetchWithActiveTimeout(
-      `http://127.0.0.1:${entry.port}${path}`,
-      {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${entry.token}`,
-          'content-type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      },
-      { timeoutMs },
-    )
-    if (!response.ok) return null
-    return (await response.json()) as T
-  } catch {
-    return null
-  }
+// When an apply gets no answer (no server for the PID, a non-2xx status, a
+// timeout or an unparseable body), the public client resolves the fixed
+// object `{text: 'apply failed', knobs: {}}` instead of a server answer: the
+// failure result of the older per-command dialogs, whose results were
+// `{text, knobs}`. A menu result always carries `command`, `ok` and `menu`,
+// so it cannot match.
+function isPublicApplyFailure(value: Record<string, unknown>): boolean {
+  return (
+    Object.keys(value).length === 2 &&
+    value.text === 'apply failed' &&
+    isRecord(value.knobs) &&
+    Object.keys(value.knobs).length === 0
+  )
 }
 
-async function discoverPortFileSafe(
-  dir: string,
-  expectedPid: number | undefined,
-): Promise<Awaited<ReturnType<typeof discoverPortFile>>> {
-  try {
-    return await discoverPortFile(dir, expectedPid)
-  } catch {
-    return null
-  }
+const ENVELOPE_KEYS = new Set(['id', 'payload', 'sessionId'])
+
+// Checks only the envelope: exactly the keys `id`, `payload` and optional
+// `sessionId`. Any other key, such as the `type: 'open-dialog'` field of the
+// older per-command dialog notifications, refuses the message.
+function isNotification(value: unknown): value is ReceivedNotification {
+  return (
+    isRecord(value) &&
+    Object.keys(value).every((key) => ENVELOPE_KEYS.has(key)) &&
+    typeof value.id === 'number' &&
+    Number.isSafeInteger(value.id) &&
+    value.id >= 1 &&
+    (value.sessionId === undefined || typeof value.sessionId === 'string') &&
+    isRecord(value.payload)
+  )
 }