@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.1

package/src/tui-compiled/tui/file-logger.ts

@@ -1,145 +0,0 @@
-/**
- * File-backed logger for the OpenTUI sidebar tree.
- *
- * The TUI renders directly into the host terminal. Any stray write to the
- * terminal from inside the render path (or any module it imports) corrupts
- * the frame buffer — a single byte out of place shoves every subsequent
- * cell right and breaks the sidebar.
- *
- * This logger writes to a rotating file under the host's log directory and
- * never touches stdout/stderr. The plugin already wires up the same kind of
- * file logger via `debug.ts`; the sidebar gets its own file so log lines
- * from this tree are easy to attribute.
- */
-
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  statSync,
-  writeFileSync,
-} from 'node:fs'
-import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
-
-export type TuiLogLevel = 'debug' | 'info' | 'warn' | 'error'
-
-export interface TuiLogger {
-  debug(message: string, extra?: Record<string, unknown>): void
-  info(message: string, extra?: Record<string, unknown>): void
-  warn(message: string, extra?: Record<string, unknown>): void
-  error(message: string, extra?: Record<string, unknown>): void
-  /** Resolve the path the logger writes to. `undefined` when file logging is disabled. */
-  getLogPath(): string | undefined
-}
-
-const LOG_PREFIX = '[opencode-antigravity-auth/tui]'
-const DEFAULT_MAX_BYTES = 1_000_000
-const MAX_KEEP_LINES = 200
-/**
- * Owner-read/write only — matches the rest of the plugin's on-disk
- * sensitive state (account storage, signature cache). Windows ignores
- * POSIX mode bits so the assertion in the test is best-effort there.
- */
-const FILE_MODE = 0o600
-
-interface FileLoggerOptions {
-  filePath: string
-  maxBytes?: number
-}
-
-/**
- * Resolve the on-disk path for the TUI's log file.
- *
- * - `ANTIGRAVITY_AUTH_TUI_LOG_FILE` wins when set (used by tests so they
- *   never touch a real user log file).
- * - Otherwise write under `<xdg-state>/cortexkit/antigravity-auth/tui.log`.
- *
- * Falls back to a temp file when the host path cannot be resolved (e.g. no
- * home directory on a hostile CI box); the file logger itself never throws,
- * it just drops the line.
- */
-export function resolveTuiLogPath(): string {
-  const override = process.env.ANTIGRAVITY_AUTH_TUI_LOG_FILE
-  if (override && override.trim().length > 0) return override
-  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
-  return join(base, 'cortexkit', 'antigravity-auth', 'tui.log')
-}
-
-export function createTuiFileLogger(
-  options?: Partial<FileLoggerOptions>,
-): TuiLogger {
-  const filePath = options?.filePath ?? resolveTuiLogPath()
-  const maxBytes = options?.maxBytes ?? DEFAULT_MAX_BYTES
-  return createFileLogger({ filePath, maxBytes })
-}
-
-function createFileLogger(options: FileLoggerOptions): TuiLogger {
-  const { filePath, maxBytes = DEFAULT_MAX_BYTES } = options
-
-  const rotateIfNeeded = (): void => {
-    try {
-      if (!existsSync(filePath)) return
-      const stat = statSync(filePath)
-      if (stat.size < maxBytes) return
-      // Tail-truncate: keep the last MAX_KEEP_LINES, drop the rest. Cheap,
-      // bounded, and good enough for a sidecar debug stream.
-      const text = readFileSync(filePath, 'utf-8')
-      const lines = text.split('\n')
-      const keepFrom = Math.max(0, lines.length - MAX_KEEP_LINES)
-      const tail = lines.slice(keepFrom).join('\n')
-      writeFileSync(filePath, tail, 'utf-8')
-      // `writeFileSync` over an existing file keeps its mode; we rotate
-      // the file specifically to enforce owner-only access, so re-assert
-      // the mode after the truncation.
-      chmodSync(filePath, FILE_MODE)
-    } catch {
-      // Best-effort; ignore rotation errors.
-    }
-  }
-
-  const write = (
-    level: TuiLogLevel,
-    message: string,
-    extra?: Record<string, unknown>,
-  ): void => {
-    try {
-      rotateIfNeeded()
-      // Enforce 0o700 on the parent directory even when it already
-      // exists — `mkdirSync({ recursive: true, mode })` only sets the
-      // mode on the leaf directory it creates, so an existing leaky
-      // directory would keep its old mode. The post-hoc chmodSync
-      // closes the gap.
-      mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 })
-      chmodSync(dirname(filePath), 0o700)
-      const payload: Record<string, unknown> = {
-        ts: Date.now(),
-        level,
-        message,
-      }
-      if (extra && Object.keys(extra).length > 0) payload.extra = extra
-      // `mode: 0o600` so the log file is owner-only — the same default the
-      // plugin's account storage applies. `appendFileSync` only honours the
-      // mode flag when the file is created, so existing files keep whatever
-      // mode they had. `chmodSync` below re-asserts the mode after every
-      // append so a leaked-permissions file is repaired on the next write.
-      appendFileSync(filePath, `${LOG_PREFIX} ${JSON.stringify(payload)}\n`, {
-        encoding: 'utf-8',
-        mode: FILE_MODE,
-      })
-      chmodSync(filePath, FILE_MODE)
-    } catch {
-      // Drop the line — file logging must never throw into the render path.
-    }
-  }
-
-  return {
-    debug: (message, extra) => write('debug', message, extra),
-    info: (message, extra) => write('info', message, extra),
-    warn: (message, extra) => write('warn', message, extra),
-    error: (message, extra) => write('error', message, extra),
-    getLogPath: () => filePath,
-  }
-}

package/src/tui-compiled/tui-preferences.ts

@@ -1,416 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import { watch } from 'node:fs'
-import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { basename, dirname, join } from 'node:path'
-import {
-  clearTimeout as nativeClearTimeout,
-  setTimeout as nativeSetTimeout,
-} from 'node:timers'
-import { acquireFencedFileLock } from '@cortexkit/antigravity-auth-core/file-lock'
-import { applyEdits, modify, type ParseError, parse } from 'jsonc-parser'
-
-export const TUI_PREFS_FILE_ENV = 'OPENCODE_TUI_PREFERENCES_FILE'
-const FILE_NAME = 'tui-preferences.jsonc'
-const PREFERENCES_LOCK_NAME = 'preferences'
-const PREFERENCES_LOCK_TTL_MS = 10_000
-const PREFERENCES_LOCK_TIMEOUT_MS = 2_000
-const PREFERENCES_LOCK_RETRY_MS = 25
-
-// Shared preferences file for opencode TUI plugins. One top-level key per
-// plugin (short name, e.g. "antigravity-auth"). The file is optional: every
-// reader must fall back to defaults when it is missing or malformed.
-export function getTuiPreferencesFile(): string {
-  const override = process.env[TUI_PREFS_FILE_ENV]
-  if (override) return override
-  const configDir =
-    process.env.OPENCODE_CONFIG_DIR ||
-    join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode')
-  return join(configDir, FILE_NAME)
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-// Tolerant read: missing file, parse errors, or a non-object root all resolve
-// to {} so the sidebar never crashes on user-edited content. jsonc-parser's
-// fault-tolerant parse can still hand back a partial object for an
-// unterminated/bracketed file or trailing garbage, so we collect errors and
-// treat any reported fault as malformed.
-export async function readTuiPreferencesFile(): Promise<
-  Record<string, unknown>
-> {
-  try {
-    const raw = await readFile(getTuiPreferencesFile(), 'utf8')
-    const errors: ParseError[] = []
-    const root: unknown = parse(raw, errors, { allowTrailingComma: true })
-    if (errors.length > 0) return {}
-    return isRecord(root) ? root : {}
-  } catch {
-    return {}
-  }
-}
-
-export const PLUGIN_KEY = 'antigravity-auth'
-export const DEFAULT_SLOT_ORDER = 160
-
-export interface AntigravityAuthTuiPrefs {
-  forceToTop: boolean
-  order: number
-  startCollapsed: boolean
-  rememberCollapsed: boolean
-  // null = never persisted; seed the UI from startCollapsed instead.
-  collapsed: boolean | null
-  pollMs: number
-  refreshDebounceMs: number
-  header: {
-    label: string
-    showVersion: boolean
-  }
-  sections: {
-    quota: boolean
-    fallbackAccounts: boolean
-    routing: boolean
-    health: boolean
-  }
-  appearance: {
-    barWidth: number
-    barFilledChar: string
-    barEmptyChar: string
-    warnThreshold: number
-    errorThreshold: number
-  }
-}
-
-export type AppearancePrefs = AntigravityAuthTuiPrefs['appearance']
-
-export const DEFAULT_PREFS: AntigravityAuthTuiPrefs = {
-  forceToTop: false,
-  order: DEFAULT_SLOT_ORDER,
-  startCollapsed: false,
-  rememberCollapsed: true,
-  collapsed: null,
-  pollMs: 1500,
-  refreshDebounceMs: 200,
-  header: { label: 'ANTIGRAVITY', showVersion: true },
-  sections: {
-    quota: true,
-    fallbackAccounts: true,
-    routing: true,
-    health: true,
-  },
-  appearance: {
-    barWidth: 10,
-    barFilledChar: '█',
-    barEmptyChar: '░',
-    warnThreshold: 50,
-    errorThreshold: 80,
-  },
-}
-
-function bool(value: unknown, fallback: boolean): boolean {
-  return typeof value === 'boolean' ? value : fallback
-}
-
-function int(
-  value: unknown,
-  fallback: number,
-  min: number,
-  max: number,
-): number {
-  if (typeof value !== 'number' || !Number.isFinite(value)) return fallback
-  return Math.min(Math.max(Math.round(value), min), max)
-}
-
-function label(value: unknown, fallback: string, maxLength: number): string {
-  if (typeof value !== 'string' || value.length === 0) return fallback
-  return value.slice(0, maxLength)
-}
-
-function char(value: unknown, fallback: string): string {
-  if (typeof value !== 'string') return fallback
-  const first = [...value][0]
-  return first ?? fallback
-}
-
-// Per-key validation: every value is independently clamped/defaulted so one
-// bad entry never poisons the rest. Never throws.
-//
-// Antigravity reads the thresholds as remaining-percent: healthy when the
-// remaining is above `warnThreshold`, warn between `errorThreshold` and
-// `warnThreshold`, error below `errorThreshold`. So `errorThreshold` is the
-// smaller number (the danger floor) and must stay strictly below `warnThreshold`.
-export function resolveAntigravityAuthPrefs(
-  root: Record<string, unknown>,
-): AntigravityAuthTuiPrefs {
-  const entry = root[PLUGIN_KEY]
-  if (!isRecord(entry)) return structuredClone(DEFAULT_PREFS)
-
-  const d = DEFAULT_PREFS
-  const header = isRecord(entry.header) ? entry.header : {}
-  const sections = isRecord(entry.sections) ? entry.sections : {}
-  const appearance = isRecord(entry.appearance) ? entry.appearance : {}
-
-  const configuredWarnThreshold = int(
-    appearance.warnThreshold,
-    d.appearance.warnThreshold,
-    0,
-    99,
-  )
-  const configuredErrorThreshold = int(
-    appearance.errorThreshold,
-    d.appearance.errorThreshold,
-    0,
-    100,
-  )
-  // Older preferences stored remaining-percent thresholds, whose error value
-  // was lower than warn. Convert that shape while accepting the fleet's new
-  // used-percent ordering without a preferences schema migration.
-  const [warnThreshold, errorThreshold] =
-    configuredErrorThreshold < configuredWarnThreshold
-      ? [100 - configuredWarnThreshold, 100 - configuredErrorThreshold]
-      : [
-          configuredWarnThreshold,
-          Math.max(
-            configuredErrorThreshold,
-            Math.min(configuredWarnThreshold + 1, 100),
-          ),
-        ]
-
-  return {
-    forceToTop: bool(entry.forceToTop, d.forceToTop),
-    order: int(entry.order, d.order, -10000, 10000),
-    startCollapsed: bool(entry.startCollapsed, d.startCollapsed),
-    rememberCollapsed: bool(entry.rememberCollapsed, d.rememberCollapsed),
-    collapsed: typeof entry.collapsed === 'boolean' ? entry.collapsed : null,
-    pollMs: int(entry.pollMs, d.pollMs, 500, 30000),
-    refreshDebounceMs: int(
-      entry.refreshDebounceMs,
-      d.refreshDebounceMs,
-      50,
-      5000,
-    ),
-    header: {
-      label: label(header.label, d.header.label, 20),
-      showVersion: bool(header.showVersion, d.header.showVersion),
-    },
-    sections: {
-      quota: bool(sections.quota, d.sections.quota),
-      fallbackAccounts: bool(
-        sections.fallbackAccounts,
-        d.sections.fallbackAccounts,
-      ),
-      routing: bool(sections.routing, d.sections.routing),
-      health: bool(sections.health, d.sections.health),
-    },
-    appearance: {
-      barWidth: int(appearance.barWidth, d.appearance.barWidth, 4, 40),
-      barFilledChar: char(appearance.barFilledChar, d.appearance.barFilledChar),
-      barEmptyChar: char(appearance.barEmptyChar, d.appearance.barEmptyChar),
-      warnThreshold,
-      errorThreshold,
-    },
-  }
-}
-
-const FORCE_TOP_BASE = -100000
-
-// Shared forceToTop convention: forced plugins sort below FORCE_TOP_BASE,
-// ordered among themselves by their top-level key's position in the file, so
-// users reprioritize by reordering keys. The user-facing `order` knob clamps
-// to -10000..10000, strictly above the forced band, so a manual order can
-// never beat forceToTop. Host slots render ascending by order; opencode's
-// built-ins occupy 100-500.
-//
-// Key-naming requirement: plugin keys must be non-integer-like short names
-// (e.g. "antigravity-auth"). JavaScript object key iteration order hoists
-// integer-like keys ("0", "1", "42") ahead of any string keys, which would
-// skew the indexOf-based ordering of forced plugins. The shared
-// `tui-preferences.jsonc` convention requires non-numeric names, so this
-// implementation does not paper over the JS quirk.
-export function computeEffectiveOrder(
-  root: Record<string, unknown>,
-  pluginKey: string,
-  defaultOrder: number,
-): number {
-  const entry = root[pluginKey]
-  if (!isRecord(entry)) return defaultOrder
-  if (entry.forceToTop === true) {
-    return FORCE_TOP_BASE + Object.keys(root).indexOf(pluginKey)
-  }
-  return int(entry.order, defaultOrder, -10000, 10000)
-}
-
-const TEMPLATE = `// Shared preferences for opencode TUI plugins.
-// One top-level key per plugin (short name). See each plugin's README for
-// its supported settings. This file is safe to hand-edit; plugins update
-// individual keys in place and preserve comments.
-{}
-`
-
-type JsonValue = string | number | boolean | null
-
-async function acquirePreferencesLock(file: string) {
-  const deadline = Date.now() + PREFERENCES_LOCK_TIMEOUT_MS
-  for (;;) {
-    const lock = await acquireFencedFileLock({
-      path: file,
-      name: PREFERENCES_LOCK_NAME,
-      ttlMs: PREFERENCES_LOCK_TTL_MS,
-      renew: true,
-    })
-    if (lock) return lock
-    if (Date.now() >= deadline) {
-      throw new Error(`Timed out acquiring TUI preferences lock: ${file}`)
-    }
-    await new Promise<void>((resolve) =>
-      nativeSetTimeout(resolve, PREFERENCES_LOCK_RETRY_MS),
-    )
-  }
-}
-
-async function writePreference(
-  pluginKey: string,
-  path: string[],
-  value: JsonValue,
-): Promise<void> {
-  const file = getTuiPreferencesFile()
-  await mkdir(dirname(file), { recursive: true })
-  const lock = await acquirePreferencesLock(file)
-  const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`
-  try {
-    let text: string
-    try {
-      text = await readFile(file, 'utf8')
-    } catch {
-      text = ''
-    }
-    if (text.trim() === '') text = TEMPLATE
-    const edits = modify(text, [pluginKey, ...path], value, {
-      formattingOptions: { insertSpaces: true, tabSize: 2 },
-    })
-    const next = applyEdits(text, edits)
-    await writeFile(tmp, next, { encoding: 'utf8', mode: 0o600 })
-    await lock.assertOwned()
-    await rename(tmp, file)
-  } finally {
-    await rm(tmp, { force: true }).catch(() => {})
-    await lock.release()
-  }
-}
-
-let writeChain: Promise<void> = Promise.resolve()
-
-// Writes are serialized on a promise chain: each update re-reads the file,
-// applies a minimal comment-preserving edit to one property, and replaces the
-// file atomically (temp + rename in the same directory). Best-effort by
-// design — preferences are never worth crashing the TUI over.
-export function queueTuiPreferenceUpdate(
-  pluginKey: string,
-  path: string[],
-  value: JsonValue,
-): Promise<void> {
-  writeChain = writeChain
-    .then(() => writePreference(pluginKey, path, value))
-    .catch(() => {})
-  return writeChain
-}
-
-const WATCH_DEBOUNCE_MS = 150
-const WATCH_POLL_MS = 100
-
-// Watches the directory rather than the file: editors and our own atomic
-// writes replace the file via rename, which kills file-level watchers.
-//
-// Filtering is two-stage:
-//   1. Filename pre-filter: only debounce events for the preferences file
-//      name, or our atomic-write temp file. This is a cheap first pass that
-//      drops the common case (unrelated sibling files).
-//   2. Content check inside the debounce: after the timer fires, re-read
-//      the file and compare it against the last seen content. Only fire
-//      `onChange` when the content actually changed. This is the authority.
-//      Some platforms (notably macOS FSEvents and a few inotify backends)
-//      can misattribute a rename of an unrelated sibling file to the
-//      real preferences filename in addition to emitting the sibling's
-//      own event, so a name-only filter still produces a stray callback.
-//      A content comparison is robust against that, against coalesced
-//      events, and against mtime granularity.
-//
-// Returns a disposer; never throws.
-export function watchTuiPreferences(onChange: () => void): () => void {
-  const file = getTuiPreferencesFile()
-  const name = basename(file)
-  let timer: ReturnType<typeof nativeSetTimeout> | null = null
-  let lastSeen: string | null = null
-  let observedEvent = false
-  let disposed = false
-
-  const checkForChange = async () => {
-    const text = await readFile(file, 'utf8').catch(() => null)
-    if (disposed || text === null) return
-    if (text === lastSeen) return
-    lastSeen = text
-    onChange()
-  }
-
-  const scheduleCheck = () => {
-    observedEvent = true
-    if (timer) nativeClearTimeout(timer)
-    timer = nativeSetTimeout(() => {
-      timer = null
-      void checkForChange()
-    }, WATCH_DEBOUNCE_MS)
-  }
-
-  // Seed asynchronously. If a real file event arrives before the read resolves,
-  // do not let the seed overwrite that pending change; the debounced re-read
-  // will compare against the previous value and fire.
-  void readFile(file, 'utf8')
-    .then((text) => {
-      if (!observedEvent && lastSeen === null) lastSeen = text
-    })
-    .catch(() => {})
-
-  try {
-    const watcher = watch(dirname(file), (_event, filename) => {
-      // Exact match against the preferences file name, plus the temp file
-      // we use for atomic writes (carrying our pid + `.tmp`).
-      const isOurs =
-        filename === name ||
-        (filename?.startsWith(`${name}.`) && filename.endsWith('.tmp'))
-      if (filename != null && !isOurs) return
-      scheduleCheck()
-    })
-
-    // Bun's fs.watch can miss atomic temp-file rename updates on some
-    // backends, so keep a low-cost polling loop as the correctness path.
-    // Use recursive timers instead of fs.watchFile because watchFile can keep
-    // Bun test processes alive long after unwatchFile().
-    let pollTimer: ReturnType<typeof nativeSetTimeout> | null = null
-    let pollInFlight = false
-    const schedulePoll = () => {
-      if (disposed || pollTimer) return
-      pollTimer = nativeSetTimeout(() => {
-        pollTimer = null
-        if (disposed || pollInFlight) return
-        pollInFlight = true
-        void checkForChange().finally(() => {
-          pollInFlight = false
-          schedulePoll()
-        })
-      }, WATCH_POLL_MS)
-      pollTimer.unref?.()
-    }
-    schedulePoll()
-
-    return () => {
-      disposed = true
-      if (timer) nativeClearTimeout(timer)
-      if (pollTimer) nativeClearTimeout(pollTimer)
-      watcher.close()
-    }
-  } catch {
-    return () => {}
-  }
-}