@cortexkit/opencode-antigravity-auth 3.0.5 → 3.0.6

package/src/common-auth-embedded/setup/process-fence.js

@@ -0,0 +1,270 @@
+import { defaultCommandRunner } from './command-runner.js';
+// A cold PowerShell/WMI query took 13.8 s on Windows Server 2022; warm queries
+// took less than 0.5 s. This is the product's one-shot latency budget, not a test
+// deadline: 45 s is about three times the worst measured cold start.
+const WINDOWS_CIM_TIMEOUT_MS = 45_000;
+const HOSTS = new Set(['opencode', 'litecode', 'opencode2', 'pi']);
+const RUNTIMES = new Set(['node', 'bun']);
+const PI_SCRIPT_PATTERN = /(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;
+/** Splits a command line into arguments, keeping double-quoted ones whole. */
+function commandArguments(command) {
+    return [...command.matchAll(/"([^"]*)"|(\S+)/g)].map((match) => match[1] ?? match[2] ?? '');
+}
+function executableName(argument) {
+    return (argument.split(/[/\\]/).pop() ?? '')
+        .toLowerCase()
+        .replace(/\.(?:exe|cmd|bat|m?js)$/, '');
+}
+// Node and Bun options whose value is the next argument, so that value is not
+// mistaken for the script (`node --require ./preload.cjs …/opencode`).
+const VALUE_OPTIONS = new Set([
+    '-r',
+    '--require',
+    '--import',
+    '--loader',
+    '--experimental-loader',
+    '-C',
+    '--conditions',
+    '--env-file',
+    '--title',
+    '--input-type',
+    '--preload',
+    '--cwd',
+    '-c',
+    '--config',
+    '--tsconfig-override',
+    '-d',
+    '--define',
+    '-l',
+    '--main-fields',
+]);
+// Options that run inline code instead of a script file.
+const INLINE_OPTIONS = new Set(['-e', '--eval', '-p', '--print']);
+/** The script a Node or Bun runtime was started with, if any. */
+function runtimeScript(runtime, args) {
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index] ?? '';
+        if (argument === '--')
+            return args[index + 1];
+        if (INLINE_OPTIONS.has(argument))
+            return undefined;
+        if (argument.startsWith('-')) {
+            if (!argument.includes('=') && VALUE_OPTIONS.has(argument))
+                index++;
+            continue;
+        }
+        // `bun run <script>` names the script after the subcommand.
+        if (runtime === 'bun' && argument === 'run')
+            continue;
+        return argument;
+    }
+    return undefined;
+}
+/**
+ * Names the host a process runs, judged by what it executes: the program
+ * itself, or the script a Node or Bun runtime was started with. Any other
+ * argument is ignored, so a shell whose command line merely mentions an
+ * `opencode` folder (`bash -c "cd …/opencode && …"`) is not a running host.
+ * `ps` prints arguments unquoted, so on macOS and Linux a program or script
+ * path containing spaces is not recognized; npm and Bun install OpenCode and Pi
+ * under paths without spaces.
+ */
+function hostName(command) {
+    const [program, ...rest] = commandArguments(command);
+    if (program === undefined)
+        return null;
+    const name = executableName(program);
+    if (HOSTS.has(name))
+        return name;
+    if (!RUNTIMES.has(name))
+        return null;
+    const script = runtimeScript(name, rest);
+    if (script === undefined)
+        return null;
+    const scriptName = executableName(script);
+    if (HOSTS.has(scriptName))
+        return scriptName;
+    return PI_SCRIPT_PATTERN.test(script) ? 'pi' : null;
+}
+export class ProcessInspectionError extends Error {
+    code = 'process-inspection-failed';
+    step;
+    exitCode;
+    signal;
+    timedOut;
+    durationMs;
+    constructor(details) {
+        super('Process inspection failed; setup cannot prove hosts are stopped.');
+        this.name = 'ProcessInspectionError';
+        this.step = details.step;
+        this.exitCode = details.exitCode;
+        this.signal = details.signal;
+        this.timedOut = details.timedOut;
+        this.durationMs = details.durationMs;
+    }
+    get refusalText() {
+        const outcome = this.timedOut
+            ? 'timed out'
+            : this.signal
+                ? `signal ${this.signal}`
+                : this.exitCode === null
+                    ? 'could not start or complete'
+                    : this.exitCode === 0
+                        ? 'invalid output (exit code 0)'
+                        : `exit code ${this.exitCode}`;
+        return `${this.message} ${this.step}: ${outcome} after ${Math.round(this.durationMs)} ms.`;
+    }
+}
+export class ProcessFenceViolationError extends Error {
+    activeHosts;
+    constructor(activeHosts) {
+        // Process arguments may contain credentials; report only the recognized host name.
+        const safeHosts = activeHosts.map((host) => ({
+            pid: host.pid,
+            command: hostName(host.command) ?? 'host',
+        }));
+        super(`OpenCode or Pi processes are currently running:\n${safeHosts.map((host) => `  - PID ${host.pid}: ${host.command}`).join('\n')}\n\nPlease quit all OpenCode, LiteCode, and Pi processes before running setup.`);
+        this.activeHosts = safeHosts;
+        this.name = 'ProcessFenceViolationError';
+    }
+}
+/** List processes before filtering hosts; Windows PID 0 is a valid idle-process row. */
+export async function listSetupProcesses(runner = defaultCommandRunner, options = {}) {
+    const windows = (options.platform ?? process.platform) === 'win32';
+    let inspection = {
+        step: windows ? 'tasklist' : 'ps',
+        exitCode: null,
+        signal: null,
+        timedOut: false,
+        durationMs: 0,
+    };
+    const inspect = async (step, file, args, timeoutMs) => {
+        const started = performance.now();
+        inspection = {
+            step,
+            exitCode: null,
+            signal: null,
+            timedOut: false,
+            durationMs: 0,
+        };
+        try {
+            const result = await runner.run(file, args, {
+                env: options.env,
+                timeoutMs,
+            });
+            inspection = {
+                step,
+                exitCode: result.exitCode,
+                signal: result.signal ?? null,
+                timedOut: result.timedOut ?? false,
+                durationMs: result.durationMs ?? performance.now() - started,
+            };
+            return result;
+        }
+        finally {
+            if (inspection.exitCode === null)
+                inspection.durationMs = performance.now() - started;
+            options.onStep?.({ ...inspection });
+        }
+    };
+    try {
+        const result = await inspect(windows ? 'tasklist' : 'ps', windows ? 'tasklist.exe' : 'ps', windows ? ['/fo', 'csv', '/nh'] : ['-eo', 'pid,command']);
+        if (result.exitCode !== 0)
+            throw new ProcessInspectionError(inspection);
+        const processes = [];
+        for (const line of result.stdout.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let pid;
+            let command;
+            if (windows) {
+                const match = /^"([^"]+)","(\d+)"(?:,|$)/.exec(trimmed);
+                if (!match)
+                    throw new ProcessInspectionError(inspection);
+                command = match[1] ?? '';
+                pid = Number(match[2]);
+            }
+            else {
+                const match = /^(\d+)\s+(.+)$/.exec(trimmed);
+                if (!match) {
+                    if (/^PID\s+COMMAND$/i.test(trimmed))
+                        continue;
+                    throw new ProcessInspectionError(inspection);
+                }
+                pid = Number(match[1]);
+                command = match[2] ?? '';
+            }
+            if (!Number.isSafeInteger(pid) || pid < 0)
+                throw new ProcessInspectionError(inspection);
+            processes.push({ pid, command });
+        }
+        if (!processes.length)
+            throw new ProcessInspectionError(inspection);
+        // tasklist identifies native hosts, but npm Pi/OpenCode scripts appear as Node or Bun.
+        const runtimes = processes.filter((entry) => entry.pid !== process.pid && /^(?:node|bun)\.exe$/i.test(entry.command));
+        if (windows && runtimes.length && options.inspectRuntimes !== false) {
+            const details = await inspect('CIM', 'powershell.exe', [
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                "$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter \"Name = 'node.exe' OR Name = 'bun.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress",
+            ], WINDOWS_CIM_TIMEOUT_MS);
+            if (details.exitCode !== 0)
+                throw new ProcessInspectionError(inspection);
+            const value = JSON.parse(details.stdout || 'null');
+            const rows = value === null ? [] : Array.isArray(value) ? value : [value];
+            const commands = new Map();
+            for (const row of rows) {
+                if (!row ||
+                    typeof row !== 'object' ||
+                    !('ProcessId' in row) ||
+                    !('CommandLine' in row) ||
+                    !Number.isSafeInteger(row.ProcessId))
+                    throw new ProcessInspectionError(inspection);
+                if (typeof row.CommandLine === 'string')
+                    commands.set(Number(row.ProcessId), row.CommandLine);
+                else if (runtimes.some((entry) => entry.pid === row.ProcessId))
+                    throw new ProcessInspectionError(inspection);
+            }
+            for (const entry of runtimes) {
+                // A process absent from the later CIM snapshot already exited.
+                entry.command = commands.get(entry.pid) ?? '';
+            }
+        }
+        return processes;
+    }
+    catch (error) {
+        if (error instanceof ProcessInspectionError)
+            throw error;
+        throw new ProcessInspectionError(inspection);
+    }
+}
+export function createProcessFence(runner = defaultCommandRunner, options = {}) {
+    const isHost = (entry) => entry.pid !== process.pid && hostName(entry.command) !== null;
+    return {
+        async listRunningHosts(env) {
+            return (await listSetupProcesses(runner, { ...options, env })).filter(isHost);
+        },
+        async previewRunningHosts(env) {
+            const processes = await listSetupProcesses(runner, {
+                ...options,
+                env,
+                inspectRuntimes: false,
+            });
+            const windows = (options.platform ?? process.platform) === 'win32';
+            return {
+                hosts: processes.filter(isHost),
+                uncheckedRuntimes: windows
+                    ? processes.filter((entry) => entry.pid !== process.pid &&
+                        /^(?:node|bun)\.exe$/i.test(entry.command)).length
+                    : 0,
+            };
+        },
+    };
+}
+export async function assertHostsStopped(fence, env) {
+    const active = await fence.listRunningHosts(env);
+    if (active.length)
+        throw new ProcessFenceViolationError(active);
+}

package/src/common-auth-embedded/setup/prompts.js

@@ -0,0 +1,26 @@
+import { select } from '../auth-menu/select.js';
+/** Reuse the terminal selector for a toggle list with an explicit final choice. */
+export async function selectSetupHosts(terminal, found) {
+    const selected = new Set(found);
+    for (;;) {
+        const choice = await select(terminal, [
+            ...['opencode', 'pi'].map((host) => ({
+                value: host,
+                label: `[${selected.has(host) ? 'x' : ' '}] ${host === 'opencode' ? 'OpenCode' : 'Pi'}`,
+                hint: found.includes(host) ? 'found' : 'not found',
+            })),
+            { value: 'done', label: 'Continue with selected hosts' },
+        ], {
+            message: 'Select hosts to set up',
+            subtitle: 'Enter toggles a host; choose Continue when ready.',
+        });
+        if (choice === null)
+            return null;
+        if (choice === 'done')
+            return [...selected];
+        if (selected.has(choice))
+            selected.delete(choice);
+        else
+            selected.add(choice);
+    }
+}

package/src/common-auth-embedded/setup/register.d.ts

@@ -0,0 +1,11 @@
+import type { OpenCodeGeneration, SetupIO, SetupPlugin } from './types.js';
+export interface PlannedWrite {
+    path: string;
+    content: string;
+    changed: boolean;
+}
+/** Edit only array entries so unrelated JSONC text, including comments, survives. */
+export declare function updatePluginConfig(text: string, key: 'plugin' | 'plugins', pkg: string, version: string): string;
+export declare function planOpenCodeRegistration(plugin: SetupPlugin, generation: OpenCodeGeneration, io?: SetupIO): PlannedWrite[];
+export declare function registerOpenCode(writes: readonly PlannedWrite[], beforeWrite?: () => Promise<void>): Promise<void>;
+export declare function registerPi(plugin: SetupPlugin, executable: string, io?: SetupIO): Promise<void>;

package/src/common-auth-embedded/setup/register.js

@@ -0,0 +1,130 @@
+import { applyEdits, createScanner, findNodeAtLocation, modify, parse, parseTree, } from 'jsonc-parser';
+import { defaultCommandRunner, runResolvedCommand } from './command-runner.js';
+import { writeHostConfigAtomic } from './config-write.js';
+import { defaultSetupFileSystem } from './detect.js';
+import { setupPaths } from './paths.js';
+function packageOf(value) {
+    const entry = typeof value === 'string'
+        ? value
+        : Array.isArray(value)
+            ? value[0]
+            : value && typeof value === 'object' && 'package' in value
+                ? value.package
+                : null;
+    if (typeof entry !== 'string')
+        return null;
+    const at = entry.indexOf('@', entry.startsWith('@') ? 1 : 0);
+    return at < 0 ? entry : entry.slice(0, at);
+}
+function removeArrayEntry(text, key, index) {
+    const tree = parseTree(text);
+    const array = tree && findNodeAtLocation(tree, [key]);
+    const nodes = array?.children ?? [];
+    const node = nodes[index];
+    if (!node || !array)
+        throw new Error('Invalid plugin array edit.');
+    const edits = [{ offset: node.offset, length: node.length, content: '' }];
+    const removeComma = (start, end) => {
+        const scanner = createScanner(text.slice(start, end), true);
+        scanner.scan();
+        if (text[start + scanner.getTokenOffset()] === ',')
+            edits.push({
+                offset: start + scanner.getTokenOffset(),
+                length: 1,
+                content: '',
+            });
+    };
+    // Delete punctuation separately so comments beside other entries are not removed.
+    if (index === nodes.length - 1) {
+        const previous = nodes[index - 1];
+        if (previous)
+            removeComma(previous.offset + previous.length, node.offset);
+        removeComma(node.offset + node.length, array.offset + array.length - 1);
+    }
+    else
+        removeComma(node.offset + node.length, nodes[index + 1]?.offset ?? node.offset + node.length);
+    return applyEdits(text, edits);
+}
+/** Edit only array entries so unrelated JSONC text, including comments, survives. */
+export function updatePluginConfig(text, key, pkg, version) {
+    const errors = [];
+    const value = parse(text, errors, { allowTrailingComma: true });
+    if (errors.length ||
+        !value ||
+        typeof value !== 'object' ||
+        Array.isArray(value))
+        throw new Error('Invalid OpenCode config; refusing to overwrite it.');
+    const options = {
+        formattingOptions: {
+            insertSpaces: !/^\t+/m.test(text),
+            tabSize: /^([ ]+)"/m.exec(text)?.[1]?.length ?? 2,
+            eol: text.includes('\r\n') ? '\r\n' : '\n',
+        },
+    };
+    let output = text;
+    const array = value[key];
+    if (array !== undefined && !Array.isArray(array))
+        throw new Error(`OpenCode ${key} must be an array.`);
+    const entries = Array.isArray(array) ? [...array] : [];
+    const matches = entries.flatMap((entry, index) => packageOf(entry) === pkg ? [index] : []);
+    const entry = `${pkg}@${version}`;
+    if (!matches.length) {
+        output = applyEdits(output, modify(output, array === undefined ? [key] : [key, entries.length], array === undefined ? [entry] : entry, options));
+    }
+    else {
+        const first = matches[0];
+        const previous = entries[first];
+        // Preserve options in OpenCode's [package, options] and { package, options } entries.
+        const replacement = Array.isArray(previous)
+            ? [entry, ...previous.slice(1)]
+            : previous && typeof previous === 'object'
+                ? { ...previous, package: entry }
+                : entry;
+        if (JSON.stringify(previous) !== JSON.stringify(replacement))
+            output = applyEdits(output, modify(output, [key, first], replacement, options));
+        for (const index of matches.slice(1).reverse())
+            output = removeArrayEntry(output, key, index);
+    }
+    const other = key === 'plugin' ? 'plugins' : 'plugin';
+    if (Array.isArray(value[other])) {
+        const otherEntries = value[other];
+        for (let index = otherEntries.length - 1; index >= 0; index--) {
+            if (packageOf(otherEntries[index]) === pkg)
+                output = removeArrayEntry(output, other, index);
+        }
+    }
+    return output;
+}
+export function planOpenCodeRegistration(plugin, generation, io = {}) {
+    const fs = io.fs ?? defaultSetupFileSystem;
+    const { path, opencode } = setupPaths(io);
+    const key = generation === '2' ? 'plugins' : 'plugin';
+    const names = generation === '2' ? ['opencode'] : ['opencode', 'tui'];
+    return names.map((name) => {
+        const jsonc = path.join(opencode, `${name}.jsonc`);
+        const json = path.join(opencode, `${name}.json`);
+        const file = fs.exists(jsonc) ? jsonc : fs.exists(json) ? json : jsonc;
+        const exists = fs.exists(file);
+        const before = exists
+            ? fs.readText(file)
+            : `${JSON.stringify({ $schema: `https://opencode.ai/${name === 'tui' ? 'tui' : 'config'}.json` }, null, 2)}\n`;
+        const content = updatePluginConfig(before, key, plugin.packages.opencode, plugin.version);
+        return { path: file, content, changed: !exists || content !== before };
+    });
+}
+export async function registerOpenCode(writes, beforeWrite) {
+    for (const write of writes) {
+        if (!write.changed)
+            continue;
+        await beforeWrite?.();
+        await writeHostConfigAtomic(write.path, write.content, {
+            beforeRename: beforeWrite,
+        });
+    }
+}
+export async function registerPi(plugin, executable, io = {}) {
+    const { platform, env } = setupPaths(io);
+    const result = await runResolvedCommand(io.runner ?? defaultCommandRunner, platform, executable, ['install', `npm:${plugin.packages.pi}@${plugin.version}`], env);
+    if (result.exitCode !== 0)
+        throw new Error('Pi install failed; run pi install after checking your npm connection.');
+}

package/src/common-auth-embedded/setup/types.d.ts

@@ -0,0 +1,136 @@
+import type { MenuTerminal } from '../auth-menu/terminal.js';
+import type { ClaustrumEnrollmentConnection, hostEnrollmentPaths } from '../claustrum/index.js';
+export type SetupHost = 'opencode' | 'pi';
+export type OpenCodeGeneration = '1' | '2' | 'both';
+export type SetupEnvironment = Record<string, string | undefined>;
+/**
+ * What setup decided before calling a plugin callback. The OpenCode generation
+ * is the one being registered, after `--opencode` or the interactive choice, so
+ * a plugin can sign in the way that generation expects (OpenCode 2 does not
+ * read OpenCode 1's login file).
+ */
+export interface SetupCallbackContext {
+    opencodeGeneration: OpenCodeGeneration;
+    mode: 'local' | 'claustrum';
+    /**
+     * Every host this run sets up, in order, so the first `beforeSignIn` can
+     * check conditions across all of them (for example that their storage paths
+     * do not overlap) before any host is changed.
+     */
+    hosts: readonly SetupHost[];
+    /**
+     * Pi's agent folder, resolved the way Pi itself does (`PI_CODING_AGENT_DIR`,
+     * with `~` expanded, else `~/.pi/agent`). Pi's own `auth.json` lives here;
+     * use it rather than a plugin path setting, which can point elsewhere.
+     */
+    piAgentDir: string;
+}
+/** Provider login, credential migration and vault activation stay in plugin callbacks. */
+export interface SetupPlugin {
+    packages: {
+        opencode: string;
+        pi: string;
+    };
+    version: string;
+    displayName: string;
+    slashCommand: string;
+    vault: {
+        connectionFile: string;
+        hosts: Record<SetupHost, {
+            name: string;
+            paths: Parameters<typeof hostEnrollmentPaths>[0];
+        }>;
+    };
+    /**
+     * Runs for each host on a real run after the host, mode and generation are
+     * chosen and before the vault ceremony or `signInLocal`, while nothing has
+     * changed yet. Rejecting stops setup for that host, so a plugin can ask for
+     * consent or check preconditions before any credential or authority change.
+     */
+    beforeSignIn?(host: SetupHost, context: SetupCallbackContext): Promise<void>;
+    signInLocal(host: SetupHost, context: SetupCallbackContext): Promise<void>;
+    migrate(host: SetupHost, context: SetupCallbackContext): Promise<void>;
+    /** Reject mixed local/vault credentials and activate provider-specific vault access before registration. */
+    beforeRegister?(host: SetupHost, mode: 'local' | 'claustrum', context: SetupCallbackContext): Promise<void>;
+}
+export interface CommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    signal?: NodeJS.Signals | null;
+    timedOut?: boolean;
+    durationMs?: number;
+}
+export interface CommandRunner {
+    run(file: string, args: readonly string[], options?: {
+        env?: SetupEnvironment;
+        timeoutMs?: number;
+        windowsVerbatimArguments?: boolean;
+    }): Promise<CommandResult>;
+}
+export interface SetupFileSystem {
+    exists(path: string): boolean;
+    isDirectory(path: string): boolean;
+    isFile(path: string): boolean;
+    isExecutable(path: string): boolean;
+    readText(path: string): string;
+    realpath(path: string): string;
+}
+export interface ProcessFence {
+    listRunningHosts(env?: SetupEnvironment): Promise<Array<{
+        pid: number;
+        command: string;
+    }>>;
+    /**
+     * For a dry run, which must change nothing: the hosts found without starting
+     * any program that writes files. On Windows that skips the PowerShell query
+     * for Node and Bun command lines (PowerShell writes a startup cache into the
+     * user's profile), so Node or Bun processes are only counted. A fence without
+     * it is previewed with `listRunningHosts`.
+     */
+    previewRunningHosts?(env?: SetupEnvironment): Promise<{
+        hosts: Array<{
+            pid: number;
+            command: string;
+        }>;
+        uncheckedRuntimes: number;
+    }>;
+}
+/** Defaults use the process terminal and environment; overrides are test seams. */
+export interface SetupIO {
+    terminal?: MenuTerminal;
+    env?: SetupEnvironment;
+    platform?: string;
+    home?: string;
+    cwd?: string;
+    fs?: SetupFileSystem;
+    runner?: CommandRunner;
+    fence?: ProcessFence;
+    connect?: (options: {
+        connectionFile: string;
+        handshakeTimeoutMs: number;
+    }) => Promise<ClaustrumEnrollmentConnection>;
+    wait?: (ms: number) => Promise<void>;
+}
+export interface HostDetection {
+    installed: boolean;
+    executable: string | null;
+    version: string | null;
+    directory: string;
+}
+export interface SetupDetection {
+    opencode: HostDetection & {
+        generation: '1' | '2' | 'ambiguous';
+    };
+    pi: HostDetection;
+    claustrum: {
+        available: boolean;
+        executable: string | null;
+    };
+}
+export interface SetupResult {
+    hosts: SetupHost[];
+    dryRun: boolean;
+    mode: 'local' | 'claustrum';
+    detection: SetupDetection;
+}