@cortexkit/opencode-antigravity-auth 3.0.5 → 3.0.6

package/src/common-auth-embedded/setup/command.js

@@ -0,0 +1,215 @@
+import { select } from '../auth-menu/select.js';
+import { isInteractive, printLine, processTerminal, } from '../auth-menu/terminal.js';
+import { hostEnrollmentPaths } from '../claustrum/enrollment.js';
+import { defaultCommandRunner } from './command-runner.js';
+import { detectHosts } from './detect.js';
+import { connectSetupHost } from './enroll.js';
+import { setupPaths } from './paths.js';
+import { assertHostsStopped, createProcessFence, ProcessFenceViolationError, ProcessInspectionError, } from './process-fence.js';
+import { selectSetupHosts } from './prompts.js';
+import { planOpenCodeRegistration, registerOpenCode, registerPi, } from './register.js';
+export const AMBIGUOUS_OPENCODE_MESSAGE = 'Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.';
+function flags(argv) {
+    const result = {
+        yes: false,
+        dryRun: false,
+        claustrum: false,
+        noClaustrum: false,
+        login: false,
+        opencode: undefined,
+    };
+    for (const arg of argv) {
+        if (arg === '--yes')
+            result.yes = true;
+        else if (arg === '--dry-run')
+            result.dryRun = true;
+        else if (arg === '--claustrum')
+            result.claustrum = true;
+        else if (arg === '--no-claustrum')
+            result.noClaustrum = true;
+        else if (arg === '--login')
+            result.login = true;
+        else if (/^--opencode=(1|2|both)$/.test(arg))
+            result.opencode = arg.slice('--opencode='.length);
+        else
+            throw new Error(`Unknown setup argument: ${arg}`);
+    }
+    if (result.claustrum && result.noClaustrum)
+        throw new Error('--claustrum and --no-claustrum cannot be used together.');
+    if (result.login && result.claustrum)
+        throw new Error('--login and --claustrum cannot be used together.');
+    return result;
+}
+function validatePlugin(plugin) {
+    for (const pkg of Object.values(plugin.packages)) {
+        if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(pkg))
+            throw new Error('Setup requires npm package names.');
+    }
+    if (!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(plugin.version))
+        throw new Error('Setup requires a concrete package version.');
+    for (const host of Object.values(plugin.vault.hosts)) {
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(host.name))
+            throw new Error('Setup requires lowercase vault names containing only letters, digits and dashes.');
+    }
+}
+export async function runSetup(plugin, argv = [], io = {}) {
+    const options = flags(argv);
+    validatePlugin(plugin);
+    const terminal = io.terminal ?? processTerminal();
+    const detection = await detectHosts(plugin, io);
+    printLine(terminal, `${plugin.displayName} setup`);
+    for (const [label, host] of [
+        ['OpenCode', detection.opencode],
+        ['Pi', detection.pi],
+    ]) {
+        printLine(terminal, `${label}: ${host.installed ? `found (version ${host.version ?? 'unknown'})` : 'not found'} — ${host.directory}`);
+    }
+    printLine(terminal, `Claustrum: ${detection.claustrum.available ? 'available' : 'not available'}`);
+    // Pi is registered by running its CLI, so a leftover Pi folder without the
+    // CLI cannot be set up. Leave it out instead of failing the whole run, so it
+    // never blocks setting up OpenCode.
+    const piWithoutCli = detection.pi.installed && !detection.pi.executable;
+    if (piWithoutCli)
+        printLine(terminal, 'Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.');
+    const found = ['opencode', 'pi'].filter((host) => detection[host].installed && !(host === 'pi' && piWithoutCli));
+    // A dry run changes nothing, so without a terminal it plans the --yes path
+    // instead of refusing; scripts and CI can preview setup with --dry-run alone.
+    const assumeYes = options.yes || (options.dryRun && !isInteractive(terminal));
+    if (!assumeYes && !isInteractive(terminal))
+        throw new Error('Setup requires a TTY or --yes.');
+    const hosts = assumeYes
+        ? found
+        : ((await selectSetupHosts(terminal, found)) ?? []);
+    let generation = options.opencode ??
+        (detection.opencode.generation === 'ambiguous'
+            ? '1'
+            : detection.opencode.generation);
+    if (hosts.includes('opencode') &&
+        !options.opencode &&
+        detection.opencode.generation === 'ambiguous') {
+        if (assumeYes || !isInteractive(terminal))
+            throw new Error(AMBIGUOUS_OPENCODE_MESSAGE);
+        const choice = await select(terminal, [
+            { value: '1', label: 'OpenCode 1' },
+            { value: '2', label: 'OpenCode 2' },
+            { value: 'both', label: 'Both (one compatible registration)' },
+        ], { message: 'Which OpenCode generation should be registered?' });
+        if (choice === null)
+            return { hosts: [], dryRun: options.dryRun, mode: 'local', detection };
+        generation = choice;
+    }
+    if (!hosts.length) {
+        printLine(terminal, 'No hosts selected. Install OpenCode or Pi and rerun setup.');
+        return { hosts, dryRun: options.dryRun, mode: 'local', detection };
+    }
+    const { env, platform } = setupPaths(io);
+    const fence = io.fence ??
+        createProcessFence(io.runner ?? defaultCommandRunner, { platform });
+    const stopped = async () => {
+        try {
+            await assertHostsStopped(fence, env);
+        }
+        catch (error) {
+            if (error instanceof ProcessInspectionError)
+                printLine(terminal, error.refusalText);
+            throw error;
+        }
+    };
+    printLine(terminal, 'Checking that OpenCode and Pi are not running…');
+    if (options.dryRun) {
+        try {
+            const preview = fence.previewRunningHosts
+                ? await fence.previewRunningHosts(env)
+                : { hosts: await fence.listRunningHosts(env), uncheckedRuntimes: 0 };
+            const active = preview.hosts;
+            if (preview.uncheckedRuntimes > 0)
+                printLine(terminal, 'Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.');
+            const names = new Set(new ProcessFenceViolationError(active).activeHosts.map((host) => host.command.toLowerCase() === 'pi' ? 'Pi' : 'OpenCode'));
+            for (const name of names)
+                printLine(terminal, `${name} is running; setup will ask you to quit it.`);
+        }
+        catch (error) {
+            printLine(terminal, 'Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts.');
+            if (error instanceof ProcessInspectionError)
+                printLine(terminal, error.refusalText);
+        }
+    }
+    else
+        await stopped();
+    if (options.claustrum && !detection.claustrum.available)
+        throw new Error('Claustrum is not available. Start ck or use --no-claustrum for local sign-in.');
+    let useVault = Boolean(options.claustrum);
+    if (!useVault &&
+        !options.login &&
+        !options.noClaustrum &&
+        !assumeYes &&
+        detection.claustrum.available &&
+        isInteractive(terminal)) {
+        // Not `confirm`: it reads Escape and Ctrl-C as "No", and "No" here means
+        // a local sign-in. Cancelling must stop setup before anything changes.
+        const choice = await select(terminal, [
+            { label: 'No', value: false },
+            { label: 'Yes', value: true },
+        ], { message: 'Connect these hosts to the Claustrum vault?' });
+        if (choice === null) {
+            printLine(terminal, 'Setup cancelled. Nothing was changed.');
+            return { hosts: [], dryRun: options.dryRun, mode: 'local', detection };
+        }
+        useVault = choice === true;
+    }
+    const mode = useVault ? 'claustrum' : 'local';
+    // Validate every config before login or enrollment can change credential state.
+    const writes = hosts.includes('opencode')
+        ? planOpenCodeRegistration(plugin, generation, io)
+        : [];
+    if (options.dryRun) {
+        printLine(terminal, 'Dry run: no registrations, enrollment, sign-in or migration will be performed.');
+        for (const host of hosts) {
+            if (plugin.beforeSignIn)
+                printLine(terminal, `Would run beforeSignIn(${host}, ${mode}).`);
+            if (useVault) {
+                const paths = hostEnrollmentPaths(plugin.vault.hosts[host].paths);
+                printLine(terminal, `Would Connect ${host}: write ${paths.statePath} and ${paths.tokenPath}; wait for ck auth enroll approve.`);
+            }
+            else
+                printLine(terminal, `Would sign in locally for ${host}.`);
+            if (plugin.beforeRegister)
+                printLine(terminal, `Would run beforeRegister(${host}, ${mode}).`);
+        }
+        for (const write of writes)
+            printLine(terminal, `${write.changed ? 'Would write' : 'Unchanged'} ${write.path}:\n${write.content}`);
+        if (hosts.includes('pi'))
+            printLine(terminal, `Would run ${detection.pi.executable} install npm:${plugin.packages.pi}@${plugin.version}`);
+        for (const host of hosts)
+            printLine(terminal, `Would migrate ${host} using the plugin callback (provider-specific writes).`);
+    }
+    else {
+        const context = {
+            opencodeGeneration: generation,
+            mode,
+            hosts: Object.freeze([...hosts]),
+            piAgentDir: detection.pi.directory,
+        };
+        for (const host of hosts) {
+            await stopped();
+            await plugin.beforeSignIn?.(host, context);
+            await stopped();
+            if (useVault)
+                await connectSetupHost(plugin, host, io, terminal, stopped);
+            else
+                await plugin.signInLocal(host, context);
+            await stopped();
+            await plugin.beforeRegister?.(host, mode, context);
+            await stopped();
+            if (host === 'opencode')
+                await registerOpenCode(writes, stopped);
+            else
+                await registerPi(plugin, detection.pi.executable, io);
+            await stopped();
+            await plugin.migrate(host, context);
+        }
+    }
+    printLine(terminal, `${options.dryRun ? 'Planned' : 'Configured'} ${plugin.displayName} for ${hosts.join(', ')} (${mode}).`);
+    printLine(terminal, `Next: ${hosts.includes('opencode') ? 'start OpenCode' : 'start Pi'} and run ${plugin.slashCommand}.`);
+    return { hosts, dryRun: options.dryRun, mode, detection };
+}

package/src/common-auth-embedded/setup/config-write.js

@@ -0,0 +1,60 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, rename, stat, unlink } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+/** Ordinary host config inherits Windows ACLs and preserves an existing POSIX mode. */
+export async function writeHostConfigAtomic(file, content, options = {}) {
+    const windows = (options.platform ?? process.platform) === 'win32';
+    const parent = dirname(file);
+    await mkdir(parent, { recursive: true });
+    let mode;
+    if (!windows) {
+        try {
+            mode = (await stat(file)).mode & 0o7777;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    const stage = join(parent, `.${basename(file)}.${(options.stageName ?? randomUUID)()}.tmp`);
+    let created = false;
+    try {
+        const handle = await open(stage, 'wx', mode ?? 0o666);
+        created = true;
+        try {
+            await handle.writeFile(content, 'utf8');
+            // An existing mode is deliberate; restore bits masked by the current umask.
+            if (mode !== undefined)
+                await handle.chmod(mode);
+        }
+        finally {
+            await handle.close();
+        }
+        const now = options.now ?? (() => performance.now());
+        const started = now();
+        for (let attempt = 0;; attempt++) {
+            await options.beforeRename?.();
+            try {
+                await (options.rename ?? rename)(stage, file);
+                created = false;
+                return;
+            }
+            catch (error) {
+                const code = error.code;
+                const remaining = 2000 - (now() - started);
+                if (!windows ||
+                    !['EPERM', 'EBUSY', 'EACCES'].includes(code ?? '') ||
+                    remaining <= 0 ||
+                    attempt >= 40)
+                    throw new Error(`Unable to replace host config ${file}. Close editors or other programs using the file, then rerun setup.`);
+                await (options.wait ?? delay)(Math.min(remaining, 25 * 2 ** Math.min(attempt, 2)));
+            }
+        }
+    }
+    finally {
+        // Never remove a colliding stage that this call did not create.
+        if (created)
+            await unlink(stage).catch(() => { });
+    }
+}

package/src/common-auth-embedded/setup/detect.d.ts

@@ -0,0 +1,6 @@
+import type { SetupDetection, SetupFileSystem, SetupIO, SetupPlugin } from './types.js';
+export declare const defaultSetupFileSystem: SetupFileSystem;
+export declare function findExecutableOnPath(name: string, io?: SetupIO): string | null;
+export declare function openCodeDesktopMarkers(io?: SetupIO): string[];
+export declare function detectOpenCodeGeneration(io?: SetupIO): '1' | '2' | 'ambiguous';
+export declare function detectHosts(plugin: SetupPlugin, io?: SetupIO): Promise<SetupDetection>;

package/src/common-auth-embedded/setup/detect.js

@@ -0,0 +1,224 @@
+import { accessSync, constants, existsSync, readFileSync, realpathSync, statSync, } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parse } from 'jsonc-parser';
+import { connectClaustrumEnrollmentClient } from '../claustrum/enrollment.js';
+import { defaultCommandRunner, runResolvedCommand } from './command-runner.js';
+import { setupPaths } from './paths.js';
+function stat(path, kind) {
+    try {
+        return statSync(path)[kind]();
+    }
+    catch {
+        return false;
+    }
+}
+export const defaultSetupFileSystem = {
+    exists: existsSync,
+    isFile: (path) => stat(path, 'isFile'),
+    isDirectory: (path) => stat(path, 'isDirectory'),
+    isExecutable(path) {
+        try {
+            accessSync(path, constants.X_OK);
+            return stat(path, 'isFile');
+        }
+        catch {
+            return false;
+        }
+    },
+    readText: (path) => readFileSync(path, 'utf8'),
+    realpath: realpathSync,
+};
+export function findExecutableOnPath(name, io = {}) {
+    const { env, platform, path, cwd } = setupPaths(io);
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const value = Object.entries(env).find(([key]) => platform === 'win32' ? key.toUpperCase() === 'PATH' : key === 'PATH')?.[1] ?? '';
+    // npm also writes an extensionless POSIX shim on Windows; prefer a runnable launcher.
+    const suffixes = platform === 'win32' ? ['.exe', '.cmd', '.bat', ''] : [''];
+    for (const entry of value.split(platform === 'win32' ? ';' : ':')) {
+        const dir = entry.trim().replace(/^"|"$/g, '');
+        if (!dir)
+            continue;
+        for (const suffix of suffixes) {
+            const candidate = path.resolve(cwd, dir, name + suffix);
+            if (platform === 'win32' ? fs.isFile(candidate) : fs.isExecutable(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+export function openCodeDesktopMarkers(io = {}) {
+    const { platform, home, env, path } = setupPaths(io);
+    if (platform === 'darwin')
+        return [
+            '/Applications/OpenCode.app',
+            '/Applications/OpenCode Beta.app',
+            path.join(home, 'Applications', 'OpenCode.app'),
+            path.join(home, 'Applications', 'OpenCode Beta.app'),
+        ];
+    if (platform === 'win32') {
+        const local = env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+        return [
+            path.join(local, 'Programs', 'opencode'),
+            path.join(local, 'opencode'),
+        ];
+    }
+    return [
+        '/opt/OpenCode',
+        '/usr/lib/opencode',
+        path.join(home, '.local', 'share', 'applications', 'opencode.desktop'),
+    ];
+}
+function launcherTarget(file, io) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path } = setupPaths(io);
+    try {
+        const source = fs.readText(file);
+        if (source.length > 64 * 1024)
+            return file;
+        const operands = [...source.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];
+        if (!operands.length)
+            operands.push(...source.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));
+        const relative = operands.at(-1)?.[1];
+        if (relative) {
+            const target = path.join(path.dirname(file), ...relative.split(/[/\\]+/));
+            if (fs.isFile(target))
+                return fs.realpath(target);
+        }
+        return fs.realpath(file);
+    }
+    catch {
+        return file;
+    }
+}
+function diskGeneration(file, io) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path } = setupPaths(io);
+    let dir = path.dirname(launcherTarget(file, io));
+    for (;;) {
+        try {
+            const metadata = JSON.parse(fs.readText(path.join(dir, 'package.json')));
+            if (['@opencode/cli', '@opencode-ai/cli'].includes(metadata.name))
+                return '2';
+            if (metadata.name === 'opencode-ai')
+                return /^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test(metadata.version ?? '')
+                    ? '2'
+                    : '1';
+        }
+        catch {
+            /* No owning package at this level. */
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function detectOpenCodeGeneration(io = {}) {
+    const first = findExecutableOnPath('opencode', io);
+    const second = findExecutableOnPath('opencode2', io);
+    const shared = first && second && launcherTarget(first, io) === launcherTarget(second, io);
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path, opencode } = setupPaths(io);
+    let inferred = '1';
+    for (const suffix of ['jsonc', 'json']) {
+        const file = path.join(opencode, `opencode.${suffix}`);
+        if (!fs.exists(file))
+            continue;
+        try {
+            if (Object.hasOwn(parse(fs.readText(file)) ?? {}, 'plugins'))
+                inferred = '2';
+        }
+        catch {
+            /* OpenCode registration rejects malformed config before writing it. */
+        }
+        break;
+    }
+    const generation = first
+        ? (diskGeneration(first, io) ?? (shared ? '2' : inferred))
+        : null;
+    if (second && generation === '1' && !shared)
+        return 'ambiguous';
+    return second || shared ? '2' : (generation ?? inferred);
+}
+export async function detectHosts(plugin, io = {}) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { env, platform, opencode: configDir, pi: agentDir } = setupPaths(io);
+    const runner = io.runner ?? defaultCommandRunner;
+    const opencode = findExecutableOnPath('opencode', io) ??
+        findExecutableOnPath('opencode2', io);
+    const pi = findExecutableOnPath('pi', io);
+    const ck = findExecutableOnPath('ck', io);
+    const version = async (file) => {
+        if (!file)
+            return null;
+        let root;
+        try {
+            root = await mkdtemp(join(tmpdir(), 'common-auth-setup-version-'));
+            // A diagnostic host launch must not create state in the user's profile, even on a dry run.
+            const probeEnv = {
+                ...env,
+                HOME: root,
+                USERPROFILE: root,
+                XDG_CONFIG_HOME: root,
+                XDG_DATA_HOME: root,
+                XDG_STATE_HOME: root,
+                XDG_CACHE_HOME: root,
+                OPENCODE_CONFIG_DIR: root,
+                OPENCODE_CONFIG: undefined,
+                OPENCODE_CONFIG_CONTENT: undefined,
+                OPENCODE_AUTH_CONTENT: undefined,
+                PI_CODING_AGENT_DIR: root,
+            };
+            const result = await runResolvedCommand(runner, platform, file, ['--version'], probeEnv, 2000);
+            return result.exitCode === 0
+                ? (/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(result.stdout)?.[0] ?? null)
+                : null;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (root)
+                await rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    };
+    let available = false;
+    if (ck && fs.exists(plugin.vault.connectionFile)) {
+        try {
+            const connect = io.connect ?? connectClaustrumEnrollmentClient;
+            const client = await connect({
+                connectionFile: plugin.vault.connectionFile,
+                handshakeTimeoutMs: 2000,
+            });
+            client.close();
+            available = true;
+        }
+        catch {
+            available = false;
+        }
+    }
+    const [openCodeVersion, piVersion] = await Promise.all([
+        version(opencode),
+        version(pi),
+    ]);
+    return {
+        opencode: {
+            installed: fs.isDirectory(configDir) ||
+                openCodeDesktopMarkers(io).some((marker) => fs.exists(marker)) ||
+                opencode !== null,
+            executable: opencode,
+            version: openCodeVersion,
+            directory: configDir,
+            generation: detectOpenCodeGeneration(io),
+        },
+        pi: {
+            installed: pi !== null || fs.isDirectory(agentDir),
+            executable: pi,
+            version: piVersion,
+            directory: agentDir,
+        },
+        claustrum: { available, executable: ck },
+    };
+}

package/src/common-auth-embedded/setup/enroll.js

@@ -0,0 +1,70 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { writeEnrollmentTokenFile } from '@cortexkit/claustrum-client';
+import { printLine } from '../auth-menu/terminal.js';
+import { ClaustrumEnrollmentManager, connectClaustrumEnrollmentClient, hostEnrollmentPaths, } from '../claustrum/enrollment.js';
+import { ProcessFenceViolationError, ProcessInspectionError, } from './process-fence.js';
+/** Enroll an independently revocable host; plugin callbacks choose its credential store and account permissions. */
+export async function connectSetupHost(plugin, host, io, terminal, fence) {
+    const { name, paths: input } = plugin.vault.hosts[host];
+    const paths = hostEnrollmentPaths(input);
+    await fence();
+    const client = await (io.connect ?? connectClaustrumEnrollmentClient)({
+        connectionFile: plugin.vault.connectionFile,
+        handshakeTimeoutMs: 2000,
+    }).catch(() => {
+        throw new Error('Claustrum connection failed; start ck and rerun setup.');
+    });
+    try {
+        const manager = new ClaustrumEnrollmentManager({
+            proposedName: name,
+            paths,
+            client: {
+                enrollPropose: async (input) => {
+                    await fence();
+                    return client.enrollPropose(input);
+                },
+                enrollPoll: async (input) => {
+                    await fence();
+                    return client.enrollPoll(input);
+                },
+            },
+            writeTokenFile: async (path, file) => {
+                await fence();
+                await writeEnrollmentTokenFile(path, file);
+            },
+        });
+        let printedRequest;
+        for (let tick = 0; tick < 300; tick++) {
+            await fence();
+            const status = await manager.reconcile();
+            if (status.state === 'approved') {
+                printLine(terminal, `Connected ${host} to Claustrum.`);
+                return;
+            }
+            if (status.state !== 'pending' && status.state !== 'busy')
+                throw new Error('Claustrum enrollment refused; inspect its status with ck before rerunning setup.');
+            if (status.state === 'pending' &&
+                status.requestId &&
+                status.requestId !== printedRequest) {
+                if (!/^[a-zA-Z0-9_-]+$/.test(status.requestId))
+                    throw new Error('Invalid enrollment request id.');
+                printedRequest = status.requestId;
+                printLine(terminal, 'Waiting for approval. In another terminal, run:');
+                printLine(terminal, `  ck auth enroll approve --request-id ${status.requestId} --name ${name}`);
+                printLine(terminal, `Enrollment files: ${paths.statePath}, ${paths.tokenPath}`);
+            }
+            await (io.wait ?? delay)(1000);
+        }
+        throw new Error('Claustrum approval is still pending; approve with ck and rerun setup.');
+    }
+    catch (error) {
+        if (error instanceof ProcessFenceViolationError ||
+            error instanceof ProcessInspectionError)
+            throw error;
+        // Enrollment exceptions can carry request secrets or bearer tokens; never display them.
+        throw new Error('Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.');
+    }
+    finally {
+        client.close();
+    }
+}

package/src/common-auth-embedded/setup/index.d.ts

@@ -0,0 +1,5 @@
+export { AMBIGUOUS_OPENCODE_MESSAGE, runSetup } from './command.js';
+export { detectHosts, detectOpenCodeGeneration, findExecutableOnPath, openCodeDesktopMarkers, } from './detect.js';
+export { assertHostsStopped, createProcessFence, listSetupProcesses, ProcessFenceViolationError, ProcessInspectionError, type ProcessInspectionStep, } from './process-fence.js';
+export { type PlannedWrite, planOpenCodeRegistration, registerOpenCode, registerPi, updatePluginConfig, } from './register.js';
+export type { CommandResult, CommandRunner, HostDetection, OpenCodeGeneration, ProcessFence, SetupCallbackContext, SetupDetection, SetupEnvironment, SetupFileSystem, SetupHost, SetupIO, SetupPlugin, SetupResult, } from './types.js';

package/src/common-auth-embedded/setup/index.js

@@ -0,0 +1,4 @@
+export { AMBIGUOUS_OPENCODE_MESSAGE, runSetup } from './command.js';
+export { detectHosts, detectOpenCodeGeneration, findExecutableOnPath, openCodeDesktopMarkers, } from './detect.js';
+export { assertHostsStopped, createProcessFence, listSetupProcesses, ProcessFenceViolationError, ProcessInspectionError, } from './process-fence.js';
+export { planOpenCodeRegistration, registerOpenCode, registerPi, updatePluginConfig, } from './register.js';

package/src/common-auth-embedded/setup/paths.js

@@ -0,0 +1,33 @@
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export function setupPaths(io = {}) {
+    const env = io.env ?? process.env;
+    const platform = io.platform ?? process.platform;
+    const path = platform === 'win32' ? win32 : posix;
+    const home = io.home ?? (platform === 'win32' ? env.USERPROFILE : env.HOME) ?? homedir();
+    const cwd = io.cwd ?? process.cwd();
+    const absolute = (value) => path.resolve(cwd, value);
+    const config = env.OPENCODE_CONFIG_DIR?.trim();
+    const xdg = env.XDG_CONFIG_HOME?.trim();
+    let agent = env.PI_CODING_AGENT_DIR?.trim() || path.join(home, '.pi', 'agent');
+    if (agent === '~')
+        agent = home;
+    else if (/^~[/\\]/.test(agent))
+        agent = path.join(home, agent.slice(2));
+    if (agent.startsWith('file://'))
+        agent = fileURLToPath(agent);
+    return {
+        env,
+        platform,
+        path,
+        home,
+        cwd,
+        opencode: config
+            ? absolute(config)
+            : xdg
+                ? path.join(absolute(xdg), 'opencode')
+                : path.join(home, '.config', 'opencode'),
+        pi: absolute(agent),
+    };
+}

package/src/common-auth-embedded/setup/process-fence.d.ts

@@ -0,0 +1,43 @@
+import type { CommandRunner, ProcessFence, SetupEnvironment } from './types.js';
+export interface ProcessInspectionStep {
+    step: 'tasklist' | 'CIM' | 'ps';
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    timedOut: boolean;
+    durationMs: number;
+}
+export declare class ProcessInspectionError extends Error implements ProcessInspectionStep {
+    readonly code = "process-inspection-failed";
+    readonly step: ProcessInspectionStep['step'];
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly timedOut: boolean;
+    readonly durationMs: number;
+    constructor(details: ProcessInspectionStep);
+    get refusalText(): string;
+}
+export declare class ProcessFenceViolationError extends Error {
+    readonly activeHosts: Array<{
+        pid: number;
+        command: string;
+    }>;
+    constructor(activeHosts: Array<{
+        pid: number;
+        command: string;
+    }>);
+}
+/** List processes before filtering hosts; Windows PID 0 is a valid idle-process row. */
+export declare function listSetupProcesses(runner?: CommandRunner, options?: {
+    platform?: string;
+    env?: SetupEnvironment;
+    onStep?: (details: ProcessInspectionStep) => void;
+    /** False skips the Windows PowerShell query for Node and Bun command lines. */
+    inspectRuntimes?: boolean;
+}): Promise<Array<{
+    pid: number;
+    command: string;
+}>>;
+export declare function createProcessFence(runner?: CommandRunner, options?: {
+    platform?: string;
+}): ProcessFence;
+export declare function assertHostsStopped(fence: ProcessFence, env?: SetupEnvironment): Promise<void>;