@coworker-jp/aidr 0.0.1

package/src/agents/index.mjs

@@ -0,0 +1,36 @@
+export const AGENT_ORDER = [
+  "claude", "cursor", "windsurf", "kiro",
+  "gemini", "codex",
+  "cline", "roo", "copilot", "qwen", "trae", "amazonq",
+  "jetbrains", "opencode", "aider", "amp", "crush", "antigravity", "continue",
+  "standalone",
+];
+
+export const AGENT_REGISTRY = {
+  claude: () => import("./claude.mjs"),
+  cursor: () => import("./cursor.mjs"),
+  windsurf: () => import("./windsurf.mjs"),
+  kiro: () => import("./kiro.mjs"),
+  gemini: () => import("./gemini.mjs"),
+  codex: () => import("./codex.mjs"),
+  cline: () => import("./cline.mjs"),
+  roo: () => import("./roo.mjs"),
+  copilot: () => import("./copilot.mjs"),
+  qwen: () => import("./qwen.mjs"),
+  trae: () => import("./trae.mjs"),
+  amazonq: () => import("./amazonq.mjs"),
+  jetbrains: () => import("./jetbrains.mjs"),
+  opencode: () => import("./opencode.mjs"),
+  aider: () => import("./aider.mjs"),
+  amp: () => import("./amp.mjs"),
+  crush: () => import("./crush.mjs"),
+  antigravity: () => import("./antigravity.mjs"),
+  continue: () => import("./continue.mjs"),
+  standalone: () => import("./standalone.mjs"),
+};
+
+export async function loadAgent(name) {
+  const loader = AGENT_REGISTRY[name];
+  if (!loader) throw new Error(`unknown agent: ${name}`);
+  return await loader();
+}

package/src/agents/jetbrains.mjs

@@ -0,0 +1,5 @@
+import { makeStub } from "./_stub.mjs";
+const s = makeStub("jetbrains", "JetBrains AI", ".jetbrains");
+export const meta = s.meta;
+export const install = s.install;
+export const uninstall = s.uninstall;

package/src/agents/kiro.mjs

@@ -0,0 +1,79 @@
+import path from "node:path";
+import fsp from "node:fs/promises";
+import { writeFileSafe, pathExists, rmdirIfEmpty } from "../fs-utils.mjs";
+import * as T from "../templates.mjs";
+import { downloadBase } from "../verify.mjs";
+
+// agents/ai-scanner.json is user-visible JSON owned by us (kept with backup);
+// all the .sh wrappers are deterministic installer output (no backup needed).
+const AGENT_JSON_REL = ["agents", "ai-scanner.json"];
+const SCRIPT_FILES = [
+  "env.sh",
+  "start_scanner.sh",
+  "start.sh",
+  "pre_shell.sh",
+  "pre_read.sh",
+  "pre_write.sh",
+  "post_shell.sh",
+  "post_read.sh",
+  "post_write.sh",
+];
+const BIN_FILES = ["ai-scanner", "opengrep"];
+
+export const meta = {
+  name: "kiro",
+  displayName: "Kiro CLI",
+  agentDir: ".kiro",
+  configDir: (home) => path.join(home, ".kiro"),
+};
+
+export async function install(installBase, accessKey, opts = {}) {
+  const { dryRun = false, env = "prod", scope = "project", home = installBase } = opts;
+  const base = meta.configDir(installBase);
+  const aidrDir = path.join(base, "coworker-ai");
+  const agentsDir = path.join(base, "agents");
+  const dlBase = downloadBase(env);
+  const agentJsonEntry = [path.join(agentsDir, "ai-scanner.json"), T.getKiroAgentJson(scope, home), 0o644];
+  const scriptEntries = [
+    [path.join(aidrDir, "env.sh"), T.agentEnvSh(accessKey, meta.agentDir), 0o755],
+    [path.join(aidrDir, "start_scanner.sh"), T.getStartScannerSh(dlBase, "kiro"), 0o755],
+    [path.join(aidrDir, "start.sh"), T.KIRO_START_SH, 0o755],
+    [path.join(aidrDir, "pre_shell.sh"), T.KIRO_PRE_SHELL_SH, 0o755],
+    [path.join(aidrDir, "pre_read.sh"), T.KIRO_PRE_READ_SH, 0o755],
+    [path.join(aidrDir, "pre_write.sh"), T.KIRO_PRE_WRITE_SH, 0o755],
+    [path.join(aidrDir, "post_shell.sh"), T.KIRO_POST_SHELL_SH, 0o755],
+    [path.join(aidrDir, "post_read.sh"), T.KIRO_POST_READ_SH, 0o755],
+    [path.join(aidrDir, "post_write.sh"), T.KIRO_POST_WRITE_SH, 0o755],
+  ];
+  const entries = [agentJsonEntry, ...scriptEntries];
+  const [jsonRes, ...scriptResults] = await Promise.all([
+    writeFileSafe(agentJsonEntry[0], agentJsonEntry[1], { dryRun, force: true, mode: agentJsonEntry[2] }),
+    ...scriptEntries.map(([p, c, mode]) => writeFileSafe(p, c, { dryRun, force: true, backup: false, mode })),
+  ]);
+  const backupPaths = [jsonRes, ...scriptResults].map((r) => r && r.backupPath).filter(Boolean);
+  return { installed: entries.map(([p]) => p), backupPaths };
+}
+
+export async function uninstall(installBase, opts = {}) {
+  const { dryRun = false } = opts;
+  const base = meta.configDir(installBase);
+  const aidrDir = path.join(base, "coworker-ai");
+  const agentsDir = path.join(base, "agents");
+  const binDir = path.join(base, "bin");
+  const candidateFiles = [
+    path.join(base, ...AGENT_JSON_REL),
+    ...SCRIPT_FILES.map((n) => path.join(aidrDir, n)),
+    ...BIN_FILES.map((n) => path.join(binDir, n)),
+  ];
+  const removedFiles = [];
+  for (const f of candidateFiles) {
+    if (await pathExists(f)) removedFiles.push(f);
+  }
+  if (dryRun) return { removedFiles, settings: { action: "none" }, dirsRemoved: [] };
+  await Promise.all(removedFiles.map((f) => fsp.rm(f, { force: true })));
+  const dirsRemoved = [];
+  for (const d of [aidrDir, agentsDir, binDir]) {
+    if (await rmdirIfEmpty(d)) dirsRemoved.push(d);
+  }
+  return { removedFiles, settings: { action: "none" }, dirsRemoved };
+}

package/src/agents/opencode.mjs

@@ -0,0 +1,5 @@
+import { makeStub } from "./_stub.mjs";
+const s = makeStub("opencode", "OpenCode", ".opencode");
+export const meta = s.meta;
+export const install = s.install;
+export const uninstall = s.uninstall;

package/src/agents/qwen.mjs

@@ -0,0 +1,5 @@
+import { makeStub } from "./_stub.mjs";
+const s = makeStub("qwen", "Qwen", ".qwen");
+export const meta = s.meta;
+export const install = s.install;
+export const uninstall = s.uninstall;

package/src/agents/roo.mjs

@@ -0,0 +1,5 @@
+import { makeStub } from "./_stub.mjs";
+const s = makeStub("roo", "Roo", ".roo");
+export const meta = s.meta;
+export const install = s.install;
+export const uninstall = s.uninstall;

package/src/agents/standalone.mjs

@@ -0,0 +1,43 @@
+import path from "node:path";
+import fsp from "node:fs/promises";
+import { pathExists, rmdirIfEmpty } from "../fs-utils.mjs";
+
+const BIN_FILES = ["ai-scanner", "opengrep"];
+
+export const meta = {
+  name: "standalone",
+  displayName: "Standalone (no AI agent)",
+  agentDir: ".aidr",
+  configDir: (home) => path.join(home, ".aidr"),
+};
+
+// Standalone mode has no hook scripts and no settings.json. The CLI's
+// shared binary-fetch step drops ai-scanner + opengrep into
+// ~/.aidr/bin/, and the scheduled installer wires up
+// systemd/launchd/cron to invoke the binary periodically.
+export async function install() {
+  return { installed: [], backupPath: null, backupPaths: [] };
+}
+
+export async function uninstall(installBase, opts = {}) {
+  const { dryRun = false } = opts;
+  const base = meta.configDir(installBase);
+  const binDir = path.join(base, "bin");
+
+  const candidateFiles = BIN_FILES.map((n) => path.join(binDir, n));
+  const removedFiles = [];
+  for (const f of candidateFiles) {
+    if (await pathExists(f)) removedFiles.push(f);
+  }
+
+  if (dryRun) {
+    return { removedFiles, settings: { action: "none" }, dirsRemoved: [] };
+  }
+
+  await Promise.all(removedFiles.map((f) => fsp.rm(f, { force: true })));
+  const dirsRemoved = [];
+  for (const d of [binDir, base]) {
+    if (await rmdirIfEmpty(d)) dirsRemoved.push(d);
+  }
+  return { removedFiles, settings: { action: "none" }, dirsRemoved };
+}

package/src/agents/trae.mjs

@@ -0,0 +1,5 @@
+import { makeStub } from "./_stub.mjs";
+const s = makeStub("trae", "Trae", ".trae");
+export const meta = s.meta;
+export const install = s.install;
+export const uninstall = s.uninstall;

package/src/agents/windsurf.mjs

@@ -0,0 +1,105 @@
+import path from "node:path";
+import fsp from "node:fs/promises";
+import {
+  writeFileSafe,
+  writeJsonMerge,
+  unmergeJsonFile,
+  pathExists,
+  rmdirIfEmpty,
+} from "../fs-utils.mjs";
+import * as T from "../templates.mjs";
+import {
+  buildWindsurfHooksJson,
+  mergeWindsurfHooksJson,
+  unmergeWindsurfHooksJson,
+} from "../merge.mjs";
+import { downloadBase } from "../verify.mjs";
+
+const SCRIPT_FILES = [
+  "env.sh",
+  "start_scanner.sh",
+  "ensure_scanner.sh",
+  "pre_command.sh",
+  "pre_read.sh",
+  "pre_write.sh",
+  "post_read.sh",
+  "post_write.sh",
+];
+const BIN_FILES = ["ai-scanner", "opengrep"];
+
+export const meta = {
+  name: "windsurf",
+  displayName: "Windsurf",
+  agentDir: ".windsurf",
+  configDir: (home) => path.join(home, ".windsurf"),
+};
+
+export async function install(installBase, accessKey, opts = {}) {
+  const { dryRun = false, env = "prod", scope = "project", home = installBase } = opts;
+  const base = meta.configDir(installBase);
+  const aidrDir = path.join(base, "coworker-ai");
+  const dlBase = downloadBase(env);
+
+  const hooksRes = await writeJsonMerge(
+    path.join(base, "hooks.json"),
+    buildWindsurfHooksJson(scope, home),
+    mergeWindsurfHooksJson,
+    { dryRun, mode: 0o644 },
+  );
+
+  const entries = [
+    [path.join(aidrDir, "env.sh"), T.agentEnvSh(accessKey, meta.agentDir), 0o755],
+    [path.join(aidrDir, "start_scanner.sh"), T.getStartScannerSh(dlBase, "windsurf"), 0o755],
+    [path.join(aidrDir, "ensure_scanner.sh"), T.WINDSURF_ENSURE_SCANNER_SH, 0o755],
+    [path.join(aidrDir, "pre_command.sh"), T.WINDSURF_PRE_COMMAND_SH, 0o755],
+    [path.join(aidrDir, "pre_read.sh"), T.WINDSURF_PRE_READ_SH, 0o755],
+    [path.join(aidrDir, "pre_write.sh"), T.WINDSURF_PRE_WRITE_SH, 0o755],
+    [path.join(aidrDir, "post_read.sh"), T.WINDSURF_POST_READ_SH, 0o755],
+    [path.join(aidrDir, "post_write.sh"), T.WINDSURF_POST_WRITE_SH, 0o755],
+  ];
+  const scriptResults = await Promise.all(
+    entries.map(([p, c, mode]) => writeFileSafe(p, c, { dryRun, force: true, backup: false, mode })),
+  );
+  const backupPaths = [
+    ...(hooksRes && hooksRes.backupPath ? [hooksRes.backupPath] : []),
+    ...scriptResults.map((r) => r && r.backupPath).filter(Boolean),
+  ];
+  return {
+    installed: [path.join(base, "hooks.json"), ...entries.map(([p]) => p)],
+    backupPaths,
+  };
+}
+
+export async function uninstall(installBase, opts = {}) {
+  const { dryRun = false } = opts;
+  const base = meta.configDir(installBase);
+  const aidrDir = path.join(base, "coworker-ai");
+  const binDir = path.join(base, "bin");
+
+  const candidateFiles = [
+    ...SCRIPT_FILES.map((n) => path.join(aidrDir, n)),
+    ...BIN_FILES.map((n) => path.join(binDir, n)),
+  ];
+  const checks = await Promise.all(
+    candidateFiles.map(async (p) => ((await pathExists(p)) ? p : null)),
+  );
+  const removedFiles = checks.filter((p) => p !== null);
+
+  const hooksAction = await unmergeJsonFile(
+    path.join(base, "hooks.json"),
+    unmergeWindsurfHooksJson,
+    { dryRun },
+  );
+
+  if (dryRun) {
+    return { removedFiles, settings: { action: "unmerge", hooksJson: hooksAction }, dirsRemoved: [] };
+  }
+
+  await Promise.all(removedFiles.map((f) => fsp.rm(f, { force: true })));
+  const dirChecks = await Promise.all(
+    [aidrDir, binDir].map(async (d) => ((await rmdirIfEmpty(d)) ? d : null)),
+  );
+  const dirsRemoved = dirChecks.filter((d) => d !== null);
+
+  return { removedFiles, settings: { action: "unmerge", hooksJson: hooksAction }, dirsRemoved };
+}

package/src/binary-fetcher.mjs

@@ -0,0 +1,157 @@
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { downloadBase } from "./verify.mjs";
+
+const execFileP = promisify(execFile);
+
+export function detectPlatform() {
+  const os = process.platform;
+  const arch = process.arch;
+  if (os === "linux" && arch === "x64") return "linux-x86_64";
+  if (os === "linux" && arch === "arm64") return "linux-aarch64";
+  if (os === "darwin" && arch === "arm64") return "darwin-aarch64";
+  if (os === "darwin" && arch === "x64") {
+    throw new Error("Intel Mac (darwin-x86_64) is not supported. Apple Silicon only.");
+  }
+  throw new Error(`Unsupported platform: ${os}/${arch}`);
+}
+
+/**
+ * Map Node.js platform/arch to the Opengrep release platform tag. Opengrep
+ * ships glibc (manylinux) and musl (musllinux) builds for Linux; Node cannot
+ * reliably detect libc, so we default to manylinux which covers the overwhelming
+ * majority of user environments (Debian/Ubuntu/Fedora/macOS Linux VMs).
+ * Users on Alpine can override with AI_SCANNER_OPENGREP.
+ */
+export function detectOpengrepPlatform() {
+  const os = process.platform;
+  const arch = process.arch;
+  if (os === "darwin" && arch === "arm64") return "osx_arm64";
+  if (os === "darwin" && arch === "x64") return "osx_x86";
+  if (os === "linux" && arch === "x64") return "manylinux_x86";
+  if (os === "linux" && arch === "arm64") return "manylinux_aarch64";
+  throw new Error(`Unsupported platform for Opengrep: ${os}/${arch}`);
+}
+
+async function fetchBuffer(url, accessKey) {
+  const headers = accessKey ? { "x-access-key": accessKey } : {};
+  const res = await fetch(url, { redirect: "follow", headers });
+  if (!res.ok) throw new Error(`GET ${url} -> HTTP ${res.status}`);
+  const ab = await res.arrayBuffer();
+  return Buffer.from(ab);
+}
+
+async function fetchText(url, accessKey) {
+  const headers = accessKey ? { "x-access-key": accessKey } : {};
+  const res = await fetch(url, { redirect: "follow", headers });
+  if (!res.ok) return null;
+  return (await res.text()).trim();
+}
+
+async function clearQuarantine(destPath) {
+  if (process.platform !== "darwin") return;
+  try {
+    await execFileP("xattr", ["-d", "com.apple.quarantine", destPath]);
+  } catch {
+    // ignore (xattr may not be present or attribute may not be set)
+  }
+}
+
+/**
+ * Download an asset from `binUrl` into `destPath`, validating SHA256 when a
+ * sibling `.sha256` file is available. Sets executable mode and strips macOS
+ * quarantine. Returns { path, sha256, verified }.
+ */
+export async function fetchAsset(binUrl, destPath, { accessKey } = {}) {
+  const shaUrl = `${binUrl}.sha256`;
+  await fsp.mkdir(path.dirname(destPath), { recursive: true });
+
+  const buf = await fetchBuffer(binUrl, accessKey);
+  const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
+
+  let verified = false;
+  const expected = await fetchText(shaUrl, accessKey).catch(() => null);
+  if (expected) {
+    const want = expected.split(/\s+/)[0].toLowerCase();
+    if (want !== sha256) {
+      throw new Error(`SHA256 mismatch for ${binUrl}: got ${sha256}, expected ${want}`);
+    }
+    verified = true;
+  } else {
+    console.warn(`warning: ${shaUrl} unavailable; skipping SHA256 verification`);
+  }
+
+  const tmp = `${destPath}.tmp-${process.pid}`;
+  await fsp.writeFile(tmp, buf);
+  await fsp.chmod(tmp, 0o755);
+  await fsp.rename(tmp, destPath);
+
+  await clearQuarantine(destPath);
+
+  return { path: destPath, sha256, verified };
+}
+
+/**
+ * Download ai-scanner for the current platform into `destPath`.
+ * Returns { path, platform, sha256, verified }.
+ */
+export async function fetchBinary(destPath, { env = "prod", accessKey, version } = {}) {
+  const platform = detectPlatform();
+  const base = downloadBase(env);
+  const pathPrefix = version ? `v${version}/` : "";
+  const binUrl = `${base}/${pathPrefix}${platform}`;
+
+  const result = await fetchAsset(binUrl, destPath, { accessKey });
+  return { ...result, platform };
+}
+
+// Pinned Opengrep release used by aidr. Must be updated in lockstep with
+// scripts/.opengrep-version, LICENSES/opengrep-LGPL-2.1.txt, and the Dockerfile
+// ARGs. Fetched directly from GitHub Releases (public, LGPL-2.1) rather than
+// proxying via the licensed download endpoint: aidr's role here is to
+// place the upstream binary beside ai-scanner, not to gate access to it.
+const OPENGREP_VERSION = "v1.19.0";
+const OPENGREP_SHA256 = {
+  osx_arm64: "8e9f2ecfd2b6f0c824aa111b9663f93b1d5fd2e59d5e5a25b5d6f84f922087ae",
+  osx_x86: "6159af8070d28c0e2df642a68b3be4ce512442b5b31fae85fb3218dac5301f9d",
+  manylinux_x86: "1d69a41beb88e8e7917f26cc6a16c1edf298f31402807e6d1afbb5d8684c3590",
+  manylinux_aarch64: "7141748e929292e2b672f12515035a01643705010f28970c66ae43612162213e",
+  musllinux_x86: "02cf0b1be28d4bafd21fc836d59f4bdccf3ff0635dc3ec3c1a33560ab76a65e5",
+  musllinux_aarch64: "cbe97968569491bbaea33cf88384177cf602319550d10da066297c2421c24466",
+};
+
+/**
+ * Download the bundled Opengrep binary (LGPL-2.1) for the current platform
+ * into `destPath`. Opengrep is invoked by ai-scanner as a separate process;
+ * shipping it as a standalone file (not baked into ai-scanner) preserves the
+ * LGPL replace-ability requirement. Override the resolved path at runtime
+ * with the `AI_SCANNER_OPENGREP` environment variable.
+ *
+ * Returns { path, platform, sha256, verified }.
+ */
+export async function fetchOpengrep(destPath) {
+  const platform = detectOpengrepPlatform();
+  const expectedSha = OPENGREP_SHA256[platform];
+  if (!expectedSha) throw new Error(`no pinned SHA256 for Opengrep platform ${platform}`);
+
+  const binUrl = `https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_${platform}`;
+
+  await fsp.mkdir(path.dirname(destPath), { recursive: true });
+  const buf = await fetchBuffer(binUrl);
+  const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
+  if (sha256 !== expectedSha) {
+    throw new Error(`SHA256 mismatch for opengrep_${platform}: got ${sha256}, expected ${expectedSha}`);
+  }
+
+  const tmp = `${destPath}.tmp-${process.pid}`;
+  await fsp.writeFile(tmp, buf);
+  await fsp.chmod(tmp, 0o755);
+  await fsp.rename(tmp, destPath);
+  await clearQuarantine(destPath);
+
+  return { path: destPath, platform, sha256, verified: true };
+}

package/src/browser-extension.mjs

@@ -0,0 +1,83 @@
+import { writeFileSync, mkdirSync, readFileSync, chmodSync } from "fs";
+import { join } from "path";
+
+// Extension ID will be determined after Chrome Web Store publication.
+// For now use a placeholder that operators can override via AIDR_EXTENSION_ID env var.
+const DEFAULT_EXTENSION_ID = "AIDR_EXTENSION_ID_PLACEHOLDER";
+
+export async function installBrowserExtension(homeDir, binaryPath) {
+  const extensionId = process.env.AIDR_EXTENSION_ID || DEFAULT_EXTENSION_ID;
+  const platform = process.platform;
+
+  // 1. Write Native Messaging Host manifests for Chrome/Edge/Brave/Chromium
+
+  // Generate a wrapper script so the binary is invoked in native-messaging-host mode
+  const binDir = join(homeDir, ".claude", "bin");
+  mkdirSync(binDir, { recursive: true });
+  const wrapperPath = join(binDir, "ai-scanner-nativehost.sh");
+  const wrapperContent = `#!/bin/sh\nexec "${binaryPath}" native-messaging-host "$@"\n`;
+  try {
+    writeFileSync(wrapperPath, wrapperContent, { mode: 0o755 });
+  } catch (_e) {
+    // fall back to binary path directly
+  }
+
+  const nativeManifest = {
+    name: "jp.coworker.aidr.browser",
+    description: "AIDR Shadow IT Monitor bridge",
+    path: wrapperPath,
+    type: "stdio",
+    allowed_origins: [`chrome-extension://${extensionId}/`],
+  };
+
+  const chromePaths = getNativeMessagingPaths(platform, homeDir);
+  for (const dir of chromePaths) {
+    try {
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(
+        join(dir, "jp.coworker.aidr.browser.json"),
+        JSON.stringify(nativeManifest, null, 2)
+      );
+    } catch (_e) {
+      // fail-open: skip paths we can't write
+    }
+  }
+
+  // 2. Record in ~/.claude/ai-scanner-config.json
+  const configPath = join(homeDir, ".claude", "ai-scanner-config.json");
+  let config = {};
+  try {
+    config = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (_e) {
+    // file doesn't exist yet or is unreadable; start fresh
+  }
+  config.browser_extension = true;
+  config.extension_id = extensionId;
+  try {
+    writeFileSync(configPath, JSON.stringify(config, null, 2));
+  } catch (_e) {
+    // fail-open: config write is best-effort
+  }
+
+  console.log("✓ Browser extension native messaging host installed");
+  console.log(`  Extension ID: ${extensionId}`);
+  console.log("  Open Chrome and install the AIDR Shadow IT Monitor extension to complete setup.");
+}
+
+function getNativeMessagingPaths(platform, homeDir) {
+  if (platform === "darwin") {
+    return [
+      join(homeDir, "Library/Application Support/Google/Chrome/NativeMessagingHosts"),
+      join(homeDir, "Library/Application Support/Microsoft Edge/NativeMessagingHosts"),
+      join(homeDir, "Library/Application Support/BraveSoftware/Brave-Browser/NativeMessagingHosts"),
+      join(homeDir, "Library/Application Support/Chromium/NativeMessagingHosts"),
+    ];
+  } else {
+    return [
+      join(homeDir, ".config/google-chrome/NativeMessagingHosts"),
+      join(homeDir, ".config/microsoft-edge/NativeMessagingHosts"),
+      join(homeDir, ".config/BraveSoftware/Brave-Browser/NativeMessagingHosts"),
+      join(homeDir, ".config/chromium/NativeMessagingHosts"),
+    ];
+  }
+}