@cortexkit/opencode-antigravity-auth 3.0.4 → 3.0.6

package/dist/src/common-auth-embedded/setup/detect.js

@@ -0,0 +1,224 @@
+import { accessSync, constants, existsSync, readFileSync, realpathSync, statSync, } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parse } from 'jsonc-parser';
+import { connectClaustrumEnrollmentClient } from '../claustrum/enrollment.js';
+import { defaultCommandRunner, runResolvedCommand } from './command-runner.js';
+import { setupPaths } from './paths.js';
+function stat(path, kind) {
+    try {
+        return statSync(path)[kind]();
+    }
+    catch {
+        return false;
+    }
+}
+export const defaultSetupFileSystem = {
+    exists: existsSync,
+    isFile: (path) => stat(path, 'isFile'),
+    isDirectory: (path) => stat(path, 'isDirectory'),
+    isExecutable(path) {
+        try {
+            accessSync(path, constants.X_OK);
+            return stat(path, 'isFile');
+        }
+        catch {
+            return false;
+        }
+    },
+    readText: (path) => readFileSync(path, 'utf8'),
+    realpath: realpathSync,
+};
+export function findExecutableOnPath(name, io = {}) {
+    const { env, platform, path, cwd } = setupPaths(io);
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const value = Object.entries(env).find(([key]) => platform === 'win32' ? key.toUpperCase() === 'PATH' : key === 'PATH')?.[1] ?? '';
+    // npm also writes an extensionless POSIX shim on Windows; prefer a runnable launcher.
+    const suffixes = platform === 'win32' ? ['.exe', '.cmd', '.bat', ''] : [''];
+    for (const entry of value.split(platform === 'win32' ? ';' : ':')) {
+        const dir = entry.trim().replace(/^"|"$/g, '');
+        if (!dir)
+            continue;
+        for (const suffix of suffixes) {
+            const candidate = path.resolve(cwd, dir, name + suffix);
+            if (platform === 'win32' ? fs.isFile(candidate) : fs.isExecutable(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+export function openCodeDesktopMarkers(io = {}) {
+    const { platform, home, env, path } = setupPaths(io);
+    if (platform === 'darwin')
+        return [
+            '/Applications/OpenCode.app',
+            '/Applications/OpenCode Beta.app',
+            path.join(home, 'Applications', 'OpenCode.app'),
+            path.join(home, 'Applications', 'OpenCode Beta.app'),
+        ];
+    if (platform === 'win32') {
+        const local = env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+        return [
+            path.join(local, 'Programs', 'opencode'),
+            path.join(local, 'opencode'),
+        ];
+    }
+    return [
+        '/opt/OpenCode',
+        '/usr/lib/opencode',
+        path.join(home, '.local', 'share', 'applications', 'opencode.desktop'),
+    ];
+}
+function launcherTarget(file, io) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path } = setupPaths(io);
+    try {
+        const source = fs.readText(file);
+        if (source.length > 64 * 1024)
+            return file;
+        const operands = [...source.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];
+        if (!operands.length)
+            operands.push(...source.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));
+        const relative = operands.at(-1)?.[1];
+        if (relative) {
+            const target = path.join(path.dirname(file), ...relative.split(/[/\\]+/));
+            if (fs.isFile(target))
+                return fs.realpath(target);
+        }
+        return fs.realpath(file);
+    }
+    catch {
+        return file;
+    }
+}
+function diskGeneration(file, io) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path } = setupPaths(io);
+    let dir = path.dirname(launcherTarget(file, io));
+    for (;;) {
+        try {
+            const metadata = JSON.parse(fs.readText(path.join(dir, 'package.json')));
+            if (['@opencode/cli', '@opencode-ai/cli'].includes(metadata.name))
+                return '2';
+            if (metadata.name === 'opencode-ai')
+                return /^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test(metadata.version ?? '')
+                    ? '2'
+                    : '1';
+        }
+        catch {
+            /* No owning package at this level. */
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function detectOpenCodeGeneration(io = {}) {
+    const first = findExecutableOnPath('opencode', io);
+    const second = findExecutableOnPath('opencode2', io);
+    const shared = first && second && launcherTarget(first, io) === launcherTarget(second, io);
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path, opencode } = setupPaths(io);
+    let inferred = '1';
+    for (const suffix of ['jsonc', 'json']) {
+        const file = path.join(opencode, `opencode.${suffix}`);
+        if (!fs.exists(file))
+            continue;
+        try {
+            if (Object.hasOwn(parse(fs.readText(file)) ?? {}, 'plugins'))
+                inferred = '2';
+        }
+        catch {
+            /* OpenCode registration rejects malformed config before writing it. */
+        }
+        break;
+    }
+    const generation = first
+        ? (diskGeneration(first, io) ?? (shared ? '2' : inferred))
+        : null;
+    if (second && generation === '1' && !shared)
+        return 'ambiguous';
+    return second || shared ? '2' : (generation ?? inferred);
+}
+export async function detectHosts(plugin, io = {}) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { env, platform, opencode: configDir, pi: agentDir } = setupPaths(io);
+    const runner = io.runner ?? defaultCommandRunner;
+    const opencode = findExecutableOnPath('opencode', io) ??
+        findExecutableOnPath('opencode2', io);
+    const pi = findExecutableOnPath('pi', io);
+    const ck = findExecutableOnPath('ck', io);
+    const version = async (file) => {
+        if (!file)
+            return null;
+        let root;
+        try {
+            root = await mkdtemp(join(tmpdir(), 'common-auth-setup-version-'));
+            // A diagnostic host launch must not create state in the user's profile, even on a dry run.
+            const probeEnv = {
+                ...env,
+                HOME: root,
+                USERPROFILE: root,
+                XDG_CONFIG_HOME: root,
+                XDG_DATA_HOME: root,
+                XDG_STATE_HOME: root,
+                XDG_CACHE_HOME: root,
+                OPENCODE_CONFIG_DIR: root,
+                OPENCODE_CONFIG: undefined,
+                OPENCODE_CONFIG_CONTENT: undefined,
+                OPENCODE_AUTH_CONTENT: undefined,
+                PI_CODING_AGENT_DIR: root,
+            };
+            const result = await runResolvedCommand(runner, platform, file, ['--version'], probeEnv, 2000);
+            return result.exitCode === 0
+                ? (/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(result.stdout)?.[0] ?? null)
+                : null;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (root)
+                await rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    };
+    let available = false;
+    if (ck && fs.exists(plugin.vault.connectionFile)) {
+        try {
+            const connect = io.connect ?? connectClaustrumEnrollmentClient;
+            const client = await connect({
+                connectionFile: plugin.vault.connectionFile,
+                handshakeTimeoutMs: 2000,
+            });
+            client.close();
+            available = true;
+        }
+        catch {
+            available = false;
+        }
+    }
+    const [openCodeVersion, piVersion] = await Promise.all([
+        version(opencode),
+        version(pi),
+    ]);
+    return {
+        opencode: {
+            installed: fs.isDirectory(configDir) ||
+                openCodeDesktopMarkers(io).some((marker) => fs.exists(marker)) ||
+                opencode !== null,
+            executable: opencode,
+            version: openCodeVersion,
+            directory: configDir,
+            generation: detectOpenCodeGeneration(io),
+        },
+        pi: {
+            installed: pi !== null || fs.isDirectory(agentDir),
+            executable: pi,
+            version: piVersion,
+            directory: agentDir,
+        },
+        claustrum: { available, executable: ck },
+    };
+}

package/dist/src/common-auth-embedded/setup/enroll.js

@@ -0,0 +1,70 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { writeEnrollmentTokenFile } from '@cortexkit/claustrum-client';
+import { printLine } from '../auth-menu/terminal.js';
+import { ClaustrumEnrollmentManager, connectClaustrumEnrollmentClient, hostEnrollmentPaths, } from '../claustrum/enrollment.js';
+import { ProcessFenceViolationError, ProcessInspectionError, } from './process-fence.js';
+/** Enroll an independently revocable host; plugin callbacks choose its credential store and account permissions. */
+export async function connectSetupHost(plugin, host, io, terminal, fence) {
+    const { name, paths: input } = plugin.vault.hosts[host];
+    const paths = hostEnrollmentPaths(input);
+    await fence();
+    const client = await (io.connect ?? connectClaustrumEnrollmentClient)({
+        connectionFile: plugin.vault.connectionFile,
+        handshakeTimeoutMs: 2000,
+    }).catch(() => {
+        throw new Error('Claustrum connection failed; start ck and rerun setup.');
+    });
+    try {
+        const manager = new ClaustrumEnrollmentManager({
+            proposedName: name,
+            paths,
+            client: {
+                enrollPropose: async (input) => {
+                    await fence();
+                    return client.enrollPropose(input);
+                },
+                enrollPoll: async (input) => {
+                    await fence();
+                    return client.enrollPoll(input);
+                },
+            },
+            writeTokenFile: async (path, file) => {
+                await fence();
+                await writeEnrollmentTokenFile(path, file);
+            },
+        });
+        let printedRequest;
+        for (let tick = 0; tick < 300; tick++) {
+            await fence();
+            const status = await manager.reconcile();
+            if (status.state === 'approved') {
+                printLine(terminal, `Connected ${host} to Claustrum.`);
+                return;
+            }
+            if (status.state !== 'pending' && status.state !== 'busy')
+                throw new Error('Claustrum enrollment refused; inspect its status with ck before rerunning setup.');
+            if (status.state === 'pending' &&
+                status.requestId &&
+                status.requestId !== printedRequest) {
+                if (!/^[a-zA-Z0-9_-]+$/.test(status.requestId))
+                    throw new Error('Invalid enrollment request id.');
+                printedRequest = status.requestId;
+                printLine(terminal, 'Waiting for approval. In another terminal, run:');
+                printLine(terminal, `  ck auth enroll approve --request-id ${status.requestId} --name ${name}`);
+                printLine(terminal, `Enrollment files: ${paths.statePath}, ${paths.tokenPath}`);
+            }
+            await (io.wait ?? delay)(1000);
+        }
+        throw new Error('Claustrum approval is still pending; approve with ck and rerun setup.');
+    }
+    catch (error) {
+        if (error instanceof ProcessFenceViolationError ||
+            error instanceof ProcessInspectionError)
+            throw error;
+        // Enrollment exceptions can carry request secrets or bearer tokens; never display them.
+        throw new Error('Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.');
+    }
+    finally {
+        client.close();
+    }
+}

package/dist/src/common-auth-embedded/setup/index.d.ts

@@ -0,0 +1,5 @@
+export { AMBIGUOUS_OPENCODE_MESSAGE, runSetup } from './command.js';
+export { detectHosts, detectOpenCodeGeneration, findExecutableOnPath, openCodeDesktopMarkers, } from './detect.js';
+export { assertHostsStopped, createProcessFence, listSetupProcesses, ProcessFenceViolationError, ProcessInspectionError, type ProcessInspectionStep, } from './process-fence.js';
+export { type PlannedWrite, planOpenCodeRegistration, registerOpenCode, registerPi, updatePluginConfig, } from './register.js';
+export type { CommandResult, CommandRunner, HostDetection, OpenCodeGeneration, ProcessFence, SetupCallbackContext, SetupDetection, SetupEnvironment, SetupFileSystem, SetupHost, SetupIO, SetupPlugin, SetupResult, } from './types.js';

package/dist/src/common-auth-embedded/setup/index.js

@@ -0,0 +1,4 @@
+export { AMBIGUOUS_OPENCODE_MESSAGE, runSetup } from './command.js';
+export { detectHosts, detectOpenCodeGeneration, findExecutableOnPath, openCodeDesktopMarkers, } from './detect.js';
+export { assertHostsStopped, createProcessFence, listSetupProcesses, ProcessFenceViolationError, ProcessInspectionError, } from './process-fence.js';
+export { planOpenCodeRegistration, registerOpenCode, registerPi, updatePluginConfig, } from './register.js';

package/dist/src/common-auth-embedded/setup/paths.js

@@ -0,0 +1,33 @@
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export function setupPaths(io = {}) {
+    const env = io.env ?? process.env;
+    const platform = io.platform ?? process.platform;
+    const path = platform === 'win32' ? win32 : posix;
+    const home = io.home ?? (platform === 'win32' ? env.USERPROFILE : env.HOME) ?? homedir();
+    const cwd = io.cwd ?? process.cwd();
+    const absolute = (value) => path.resolve(cwd, value);
+    const config = env.OPENCODE_CONFIG_DIR?.trim();
+    const xdg = env.XDG_CONFIG_HOME?.trim();
+    let agent = env.PI_CODING_AGENT_DIR?.trim() || path.join(home, '.pi', 'agent');
+    if (agent === '~')
+        agent = home;
+    else if (/^~[/\\]/.test(agent))
+        agent = path.join(home, agent.slice(2));
+    if (agent.startsWith('file://'))
+        agent = fileURLToPath(agent);
+    return {
+        env,
+        platform,
+        path,
+        home,
+        cwd,
+        opencode: config
+            ? absolute(config)
+            : xdg
+                ? path.join(absolute(xdg), 'opencode')
+                : path.join(home, '.config', 'opencode'),
+        pi: absolute(agent),
+    };
+}

package/dist/src/common-auth-embedded/setup/process-fence.d.ts

@@ -0,0 +1,43 @@
+import type { CommandRunner, ProcessFence, SetupEnvironment } from './types.js';
+export interface ProcessInspectionStep {
+    step: 'tasklist' | 'CIM' | 'ps';
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    timedOut: boolean;
+    durationMs: number;
+}
+export declare class ProcessInspectionError extends Error implements ProcessInspectionStep {
+    readonly code = "process-inspection-failed";
+    readonly step: ProcessInspectionStep['step'];
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly timedOut: boolean;
+    readonly durationMs: number;
+    constructor(details: ProcessInspectionStep);
+    get refusalText(): string;
+}
+export declare class ProcessFenceViolationError extends Error {
+    readonly activeHosts: Array<{
+        pid: number;
+        command: string;
+    }>;
+    constructor(activeHosts: Array<{
+        pid: number;
+        command: string;
+    }>);
+}
+/** List processes before filtering hosts; Windows PID 0 is a valid idle-process row. */
+export declare function listSetupProcesses(runner?: CommandRunner, options?: {
+    platform?: string;
+    env?: SetupEnvironment;
+    onStep?: (details: ProcessInspectionStep) => void;
+    /** False skips the Windows PowerShell query for Node and Bun command lines. */
+    inspectRuntimes?: boolean;
+}): Promise<Array<{
+    pid: number;
+    command: string;
+}>>;
+export declare function createProcessFence(runner?: CommandRunner, options?: {
+    platform?: string;
+}): ProcessFence;
+export declare function assertHostsStopped(fence: ProcessFence, env?: SetupEnvironment): Promise<void>;

package/dist/src/common-auth-embedded/setup/process-fence.js

@@ -0,0 +1,270 @@
+import { defaultCommandRunner } from './command-runner.js';
+// A cold PowerShell/WMI query took 13.8 s on Windows Server 2022; warm queries
+// took less than 0.5 s. This is the product's one-shot latency budget, not a test
+// deadline: 45 s is about three times the worst measured cold start.
+const WINDOWS_CIM_TIMEOUT_MS = 45_000;
+const HOSTS = new Set(['opencode', 'litecode', 'opencode2', 'pi']);
+const RUNTIMES = new Set(['node', 'bun']);
+const PI_SCRIPT_PATTERN = /(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;
+/** Splits a command line into arguments, keeping double-quoted ones whole. */
+function commandArguments(command) {
+    return [...command.matchAll(/"([^"]*)"|(\S+)/g)].map((match) => match[1] ?? match[2] ?? '');
+}
+function executableName(argument) {
+    return (argument.split(/[/\\]/).pop() ?? '')
+        .toLowerCase()
+        .replace(/\.(?:exe|cmd|bat|m?js)$/, '');
+}
+// Node and Bun options whose value is the next argument, so that value is not
+// mistaken for the script (`node --require ./preload.cjs …/opencode`).
+const VALUE_OPTIONS = new Set([
+    '-r',
+    '--require',
+    '--import',
+    '--loader',
+    '--experimental-loader',
+    '-C',
+    '--conditions',
+    '--env-file',
+    '--title',
+    '--input-type',
+    '--preload',
+    '--cwd',
+    '-c',
+    '--config',
+    '--tsconfig-override',
+    '-d',
+    '--define',
+    '-l',
+    '--main-fields',
+]);
+// Options that run inline code instead of a script file.
+const INLINE_OPTIONS = new Set(['-e', '--eval', '-p', '--print']);
+/** The script a Node or Bun runtime was started with, if any. */
+function runtimeScript(runtime, args) {
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index] ?? '';
+        if (argument === '--')
+            return args[index + 1];
+        if (INLINE_OPTIONS.has(argument))
+            return undefined;
+        if (argument.startsWith('-')) {
+            if (!argument.includes('=') && VALUE_OPTIONS.has(argument))
+                index++;
+            continue;
+        }
+        // `bun run <script>` names the script after the subcommand.
+        if (runtime === 'bun' && argument === 'run')
+            continue;
+        return argument;
+    }
+    return undefined;
+}
+/**
+ * Names the host a process runs, judged by what it executes: the program
+ * itself, or the script a Node or Bun runtime was started with. Any other
+ * argument is ignored, so a shell whose command line merely mentions an
+ * `opencode` folder (`bash -c "cd …/opencode && …"`) is not a running host.
+ * `ps` prints arguments unquoted, so on macOS and Linux a program or script
+ * path containing spaces is not recognized; npm and Bun install OpenCode and Pi
+ * under paths without spaces.
+ */
+function hostName(command) {
+    const [program, ...rest] = commandArguments(command);
+    if (program === undefined)
+        return null;
+    const name = executableName(program);
+    if (HOSTS.has(name))
+        return name;
+    if (!RUNTIMES.has(name))
+        return null;
+    const script = runtimeScript(name, rest);
+    if (script === undefined)
+        return null;
+    const scriptName = executableName(script);
+    if (HOSTS.has(scriptName))
+        return scriptName;
+    return PI_SCRIPT_PATTERN.test(script) ? 'pi' : null;
+}
+export class ProcessInspectionError extends Error {
+    code = 'process-inspection-failed';
+    step;
+    exitCode;
+    signal;
+    timedOut;
+    durationMs;
+    constructor(details) {
+        super('Process inspection failed; setup cannot prove hosts are stopped.');
+        this.name = 'ProcessInspectionError';
+        this.step = details.step;
+        this.exitCode = details.exitCode;
+        this.signal = details.signal;
+        this.timedOut = details.timedOut;
+        this.durationMs = details.durationMs;
+    }
+    get refusalText() {
+        const outcome = this.timedOut
+            ? 'timed out'
+            : this.signal
+                ? `signal ${this.signal}`
+                : this.exitCode === null
+                    ? 'could not start or complete'
+                    : this.exitCode === 0
+                        ? 'invalid output (exit code 0)'
+                        : `exit code ${this.exitCode}`;
+        return `${this.message} ${this.step}: ${outcome} after ${Math.round(this.durationMs)} ms.`;
+    }
+}
+export class ProcessFenceViolationError extends Error {
+    activeHosts;
+    constructor(activeHosts) {
+        // Process arguments may contain credentials; report only the recognized host name.
+        const safeHosts = activeHosts.map((host) => ({
+            pid: host.pid,
+            command: hostName(host.command) ?? 'host',
+        }));
+        super(`OpenCode or Pi processes are currently running:\n${safeHosts.map((host) => `  - PID ${host.pid}: ${host.command}`).join('\n')}\n\nPlease quit all OpenCode, LiteCode, and Pi processes before running setup.`);
+        this.activeHosts = safeHosts;
+        this.name = 'ProcessFenceViolationError';
+    }
+}
+/** List processes before filtering hosts; Windows PID 0 is a valid idle-process row. */
+export async function listSetupProcesses(runner = defaultCommandRunner, options = {}) {
+    const windows = (options.platform ?? process.platform) === 'win32';
+    let inspection = {
+        step: windows ? 'tasklist' : 'ps',
+        exitCode: null,
+        signal: null,
+        timedOut: false,
+        durationMs: 0,
+    };
+    const inspect = async (step, file, args, timeoutMs) => {
+        const started = performance.now();
+        inspection = {
+            step,
+            exitCode: null,
+            signal: null,
+            timedOut: false,
+            durationMs: 0,
+        };
+        try {
+            const result = await runner.run(file, args, {
+                env: options.env,
+                timeoutMs,
+            });
+            inspection = {
+                step,
+                exitCode: result.exitCode,
+                signal: result.signal ?? null,
+                timedOut: result.timedOut ?? false,
+                durationMs: result.durationMs ?? performance.now() - started,
+            };
+            return result;
+        }
+        finally {
+            if (inspection.exitCode === null)
+                inspection.durationMs = performance.now() - started;
+            options.onStep?.({ ...inspection });
+        }
+    };
+    try {
+        const result = await inspect(windows ? 'tasklist' : 'ps', windows ? 'tasklist.exe' : 'ps', windows ? ['/fo', 'csv', '/nh'] : ['-eo', 'pid,command']);
+        if (result.exitCode !== 0)
+            throw new ProcessInspectionError(inspection);
+        const processes = [];
+        for (const line of result.stdout.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let pid;
+            let command;
+            if (windows) {
+                const match = /^"([^"]+)","(\d+)"(?:,|$)/.exec(trimmed);
+                if (!match)
+                    throw new ProcessInspectionError(inspection);
+                command = match[1] ?? '';
+                pid = Number(match[2]);
+            }
+            else {
+                const match = /^(\d+)\s+(.+)$/.exec(trimmed);
+                if (!match) {
+                    if (/^PID\s+COMMAND$/i.test(trimmed))
+                        continue;
+                    throw new ProcessInspectionError(inspection);
+                }
+                pid = Number(match[1]);
+                command = match[2] ?? '';
+            }
+            if (!Number.isSafeInteger(pid) || pid < 0)
+                throw new ProcessInspectionError(inspection);
+            processes.push({ pid, command });
+        }
+        if (!processes.length)
+            throw new ProcessInspectionError(inspection);
+        // tasklist identifies native hosts, but npm Pi/OpenCode scripts appear as Node or Bun.
+        const runtimes = processes.filter((entry) => entry.pid !== process.pid && /^(?:node|bun)\.exe$/i.test(entry.command));
+        if (windows && runtimes.length && options.inspectRuntimes !== false) {
+            const details = await inspect('CIM', 'powershell.exe', [
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                "$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter \"Name = 'node.exe' OR Name = 'bun.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress",
+            ], WINDOWS_CIM_TIMEOUT_MS);
+            if (details.exitCode !== 0)
+                throw new ProcessInspectionError(inspection);
+            const value = JSON.parse(details.stdout || 'null');
+            const rows = value === null ? [] : Array.isArray(value) ? value : [value];
+            const commands = new Map();
+            for (const row of rows) {
+                if (!row ||
+                    typeof row !== 'object' ||
+                    !('ProcessId' in row) ||
+                    !('CommandLine' in row) ||
+                    !Number.isSafeInteger(row.ProcessId))
+                    throw new ProcessInspectionError(inspection);
+                if (typeof row.CommandLine === 'string')
+                    commands.set(Number(row.ProcessId), row.CommandLine);
+                else if (runtimes.some((entry) => entry.pid === row.ProcessId))
+                    throw new ProcessInspectionError(inspection);
+            }
+            for (const entry of runtimes) {
+                // A process absent from the later CIM snapshot already exited.
+                entry.command = commands.get(entry.pid) ?? '';
+            }
+        }
+        return processes;
+    }
+    catch (error) {
+        if (error instanceof ProcessInspectionError)
+            throw error;
+        throw new ProcessInspectionError(inspection);
+    }
+}
+export function createProcessFence(runner = defaultCommandRunner, options = {}) {
+    const isHost = (entry) => entry.pid !== process.pid && hostName(entry.command) !== null;
+    return {
+        async listRunningHosts(env) {
+            return (await listSetupProcesses(runner, { ...options, env })).filter(isHost);
+        },
+        async previewRunningHosts(env) {
+            const processes = await listSetupProcesses(runner, {
+                ...options,
+                env,
+                inspectRuntimes: false,
+            });
+            const windows = (options.platform ?? process.platform) === 'win32';
+            return {
+                hosts: processes.filter(isHost),
+                uncheckedRuntimes: windows
+                    ? processes.filter((entry) => entry.pid !== process.pid &&
+                        /^(?:node|bun)\.exe$/i.test(entry.command)).length
+                    : 0,
+            };
+        },
+    };
+}
+export async function assertHostsStopped(fence, env) {
+    const active = await fence.listRunningHosts(env);
+    if (active.length)
+        throw new ProcessFenceViolationError(active);
+}

package/dist/src/common-auth-embedded/setup/prompts.js

@@ -0,0 +1,26 @@
+import { select } from '../auth-menu/select.js';
+/** Reuse the terminal selector for a toggle list with an explicit final choice. */
+export async function selectSetupHosts(terminal, found) {
+    const selected = new Set(found);
+    for (;;) {
+        const choice = await select(terminal, [
+            ...['opencode', 'pi'].map((host) => ({
+                value: host,
+                label: `[${selected.has(host) ? 'x' : ' '}] ${host === 'opencode' ? 'OpenCode' : 'Pi'}`,
+                hint: found.includes(host) ? 'found' : 'not found',
+            })),
+            { value: 'done', label: 'Continue with selected hosts' },
+        ], {
+            message: 'Select hosts to set up',
+            subtitle: 'Enter toggles a host; choose Continue when ready.',
+        });
+        if (choice === null)
+            return null;
+        if (choice === 'done')
+            return [...selected];
+        if (selected.has(choice))
+            selected.delete(choice);
+        else
+            selected.add(choice);
+    }
+}