@coworker-jp/aidr 0.0.1

package/src/cli.mjs

@@ -0,0 +1,494 @@
+import path from "node:path";
+import os from "node:os";
+import fs from "node:fs/promises";
+import readline from "node:readline";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { Command } from "commander";
+
+const execFileP = promisify(execFile);
+import { AGENT_ORDER, AGENT_REGISTRY, loadAgent } from "./agents/index.mjs";
+import { verifyKey, maskKey } from "./verify.mjs";
+import { fetchBinary, fetchOpengrep } from "./binary-fetcher.mjs";
+import { detectInstalled } from "./detect.mjs";
+import { installBrowserExtension } from "./browser-extension.mjs";
+
+// Package identity — read at module load from the bundled package.json.
+// The PROD publish workflow renames the package to `@coworker-jp/aidr`;
+// DEV keeps `@coworker-jp/aidr-dev`. We key the default environment
+// (verify endpoint + S3 bucket) off the package name so users don't need to
+// remember `--env dev` when they explicitly `npx` the `-dev` package. The
+// PROD publish also pins version to the Cargo.toml release so scanner binary
+// URLs resolve to `v{X.Y.Z}/`; DEV uses a `-dev.<run_number>` prerelease that
+// never matches, so DEV falls back to the latest S3 prefix.
+const __pkgDir = path.dirname(fileURLToPath(import.meta.url));
+const PKG = JSON.parse(
+  await fs.readFile(path.resolve(__pkgDir, "..", "package.json"), "utf8"),
+);
+const IS_PROD_PACKAGE = PKG.name === "@coworker-jp/aidr";
+const PINNED_VERSION = IS_PROD_PACKAGE ? PKG.version : undefined;
+const DEFAULT_ENV = IS_PROD_PACKAGE ? "prod" : "dev";
+
+const ACCESS_KEY_RE = /^ak_[A-Za-z0-9_-]{43}$/;
+
+function validateKey(key) {
+  if (!ACCESS_KEY_RE.test(key)) {
+    throw new Error(`invalid access key format (expected ak_<43-char urlsafe base64>)`);
+  }
+}
+
+function parseAgentList(val) {
+  return String(val).split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
+}
+
+// Shared settings.json paths per agent — only claude and gemini write into a
+// config file that users may have hand-authored. Other agents' hook files are
+// entirely owned by aidr, so no confirmation is needed for them.
+function sharedSettingsPath(agentName, base) {
+  if (agentName === "claude") return path.join(base, ".claude", "settings.json");
+  if (agentName === "gemini") return path.join(base, ".gemini", "settings.json");
+  return null;
+}
+
+async function fileExists(p) {
+  try { await fs.access(p); return true; } catch { return false; }
+}
+
+async function promptYesNo(message) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(`${message} [y/N] `, resolve);
+    });
+    return /^y(es)?$/i.test(String(answer).trim());
+  } finally {
+    rl.close();
+  }
+}
+
+async function cmdInstall(opts) {
+  // `install --uninstall` is a convenience alias so users can toggle
+  // between install/uninstall with a single memorised command. It forwards
+  // the relevant options (agent, all, scope, yes, dry-run) to the uninstall
+  // flow. --key isn't needed but commander requires it via requiredOption,
+  // so we accept and ignore it.
+  if (opts.uninstall) {
+    return cmdUninstall({
+      agent: opts.agent,
+      all: opts.all,
+      scope: opts.scope,
+      yes: opts.yes,
+      dryRun: opts.dryRun,
+    });
+  }
+
+  const home = process.env.HOME || os.homedir();
+  const scope = opts.scope || "user";
+  const base = scope === "user" ? home : process.cwd();
+  validateKey(opts.key);
+
+  if (opts.verify !== false) {
+    try {
+      const info = await verifyKey(opts.key, opts.env || DEFAULT_ENV);
+      console.log(`verified: plan=${info.plan} expires_at=${info.expires_at || "n/a"}`);
+    } catch (e) {
+      console.error(`verify failed: ${e.message}`);
+      process.exit(1);
+    }
+  }
+
+  let agents;
+  if (opts.all) {
+    agents = detectInstalled(home);
+    if (agents.length === 0) {
+      console.error("no agents detected under $HOME; specify --agent explicitly");
+      process.exit(1);
+    }
+  } else if (opts.agent) {
+    agents = parseAgentList(opts.agent);
+  } else {
+    console.error("--agent <list> or --all is required");
+    process.exit(1);
+  }
+
+  for (const name of agents) {
+    if (!AGENT_REGISTRY[name]) {
+      console.error(`unknown agent: ${name} (see 'aidr list-agents')`);
+      process.exit(1);
+    }
+  }
+
+  // Standalone has no hook scripts and no settings.json — scheduled
+  // endpoint-info collection is the whole reason to pick it, so turn
+  // --scheduled on by default when standalone is selected. --binary-only
+  // still short-circuits later.
+  if (agents.includes("standalone")) {
+    opts.scheduled = true;
+  }
+
+  // --scheduled installs a cron / systemd / launchd entry that runs
+  // `ai-scanner scan endpoint-info` periodically against an agent-independent
+  // binary at ~/.aidr/bin/ai-scanner. Auto-add the standalone install so the
+  // binary fetch loop drops a copy there even when the user only listed AI
+  // agents (claude / cursor / ...) on the command line.
+  if (opts.scheduled && !agents.includes("standalone")) {
+    agents.push("standalone");
+  }
+
+  const intervalHours = parseInt(opts.interval ?? "4", 10);
+  if (opts.scheduled && (isNaN(intervalHours) || intervalHours < 1)) {
+    console.error("--interval must be an integer >= 1");
+    process.exit(1);
+  }
+
+  // Confirmation for existing shared settings.json (claude / gemini).
+  // --yes bypasses; --dry-run doesn't write so skip; otherwise prompt on TTY,
+  // error if non-interactive (safer than silently merging in CI).
+  if (!opts.yes && !opts.dryRun) {
+    const conflicts = (await Promise.all(
+      agents.map(async (name) => {
+        const p = sharedSettingsPath(name, base);
+        return (p && await fileExists(p)) ? p : null;
+      })
+    )).filter(Boolean);
+    if (conflicts.length > 0) {
+      const list = conflicts.map(p => `  - ${p}`).join("\n");
+      if (!process.stdin.isTTY) {
+        console.error(`Existing settings.json detected:\n${list}`);
+        console.error(`aidr will merge into these files and create timestamped backups.`);
+        console.error(`Re-run with -y/--yes to proceed non-interactively, or run in an interactive terminal.`);
+        process.exit(1);
+      }
+      console.error(`Existing settings.json detected:\n${list}`);
+      console.error(`aidr will merge ai-scanner env/hooks into each file and back up the original.`);
+      const ok = await promptYesNo("Proceed?");
+      if (!ok) {
+        console.error("aborted");
+        process.exit(1);
+      }
+    }
+  }
+
+  if (!opts.skipBinary && !opts.dryRun) {
+    const agentBinDirs = [];
+    for (const name of agents) {
+      const mod = await loadAgent(name);
+      const agentDir = mod.meta.agentDir;
+      if (!agentDir) continue;
+      agentBinDirs.push(path.join(home, agentDir, "bin"));
+    }
+    if (agentBinDirs.length === 0) {
+      console.error("no agents with binary support selected; skipping binary fetch");
+    } else {
+      try {
+        const [primaryDir, ...restDirs] = agentBinDirs;
+        const fetchOpts = {
+          env: opts.env || DEFAULT_ENV,
+          accessKey: opts.key,
+          version: PINNED_VERSION,
+        };
+
+        // ai-scanner + bundled Opengrep (LGPL-2.1). Both land in the same bin
+        // dir so ai-scanner's sibling-lookup finds opengrep without relying on
+        // PATH. Users can point AI_SCANNER_OPENGREP elsewhere to substitute
+        // their own LGPL-2.1 build.
+        const scannerRes = await fetchBinary(path.join(primaryDir, "ai-scanner"), fetchOpts);
+        console.log(`binary: ${scannerRes.path} (${scannerRes.platform}${scannerRes.verified ? ", sha256 verified" : ""})`);
+        // Opengrep is fetched unmodified from its public upstream GitHub
+        // release (LGPL-2.1); no access-key gating is needed here.
+        const opengrepRes = await fetchOpengrep(path.join(primaryDir, "opengrep"));
+        console.log(`binary: ${opengrepRes.path} (opengrep ${opengrepRes.platform}${opengrepRes.verified ? ", sha256 verified" : ""})`);
+
+        const copyOps = restDirs.flatMap(restDir =>
+          ["ai-scanner", "opengrep"].map(async (file) => {
+            const src = path.join(primaryDir, file);
+            const dest = path.join(restDir, file);
+            await fs.mkdir(restDir, { recursive: true });
+            await fs.copyFile(src, dest);
+            await fs.chmod(dest, 0o755);
+            if (process.platform === "darwin") {
+              try { await execFileP("xattr", ["-d", "com.apple.quarantine", dest]); } catch {}
+            }
+            console.log(`binary: ${dest} (copied)`);
+          })
+        );
+        await Promise.all(copyOps);
+
+        console.log("Includes Opengrep (LGPL-2.1).");
+      } catch (e) {
+        console.error(`binary fetch failed: ${e.message}`);
+        if (!opts.binaryOnly) console.error("continuing with hook install (use --skip-binary to suppress)");
+        else process.exit(1);
+      }
+    }
+  }
+
+  if (opts.binaryOnly) return;
+
+  const installResults = (await Promise.all(agents.map(async (name) => {
+    const mod = await loadAgent(name);
+    try {
+      const res = await mod.install(base, opts.key, { dryRun: opts.dryRun, force: opts.force, env: opts.env || DEFAULT_ENV, scope, home });
+      console.log(`[${name}] installed (key=${maskKey(opts.key)})`);
+      // Prefer the aggregated backupPaths list (settings + scripts); fall back
+      // to the legacy single backupPath for agents that don't report scripts yet.
+      const backups = (res && res.backupPaths && res.backupPaths.length)
+        ? res.backupPaths
+        : (res && res.backupPath ? [res.backupPath] : []);
+      for (const bp of backups) {
+        console.log(`[${name}] existing file backed up to ${bp}`);
+      }
+      return { name, displayName: mod.meta.displayName || name };
+    } catch (e) {
+      console.error(`[${name}] install failed: ${e.message}`);
+      process.exit(1);
+    }
+  }))).filter(Boolean);
+  // Standalone has no hooks to restart — exclude it from the restart notice.
+  const restartAgents = installResults
+    .filter((r) => r.name !== "standalone")
+    .map((r) => r.displayName);
+
+  if (opts.scheduled && !opts.dryRun) {
+    const { installScheduled } = await import("./scheduled.mjs");
+    // Always point the cron / systemd / launchd entry at the standalone
+    // binary (~/.aidr/bin/ai-scanner). It is agent-independent, self-updates
+    // on every endpoint-info run, and survives an individual agent's removal.
+    const standalone = await loadAgent("standalone");
+    const binaryPath = path.join(home, standalone.meta.agentDir, "bin", "ai-scanner");
+    try {
+      await installScheduled({
+        home,
+        accessKey: opts.key,
+        binaryPath,
+        dryRun: opts.dryRun,
+        interval: intervalHours,
+      });
+    } catch (e) {
+      console.error(`scheduled install failed: ${e.message}`);
+      process.exit(1);
+    }
+  }
+
+  if (opts.browserExtension && !opts.dryRun) {
+    const firstAgentName = agents[0];
+    const firstAgent = await loadAgent(firstAgentName);
+    const binaryPath = path.join(home, firstAgent.meta.agentDir, "bin", "ai-scanner");
+    try {
+      await installBrowserExtension(home, binaryPath);
+    } catch (e) {
+      console.error(`browser extension install warning: ${e.message}`);
+    }
+  }
+
+  if (restartAgents.length > 0 && !opts.dryRun) {
+    const list = restartAgents.join(", ");
+    console.log("");
+    console.log(`Next: restart ${list} so hooks take effect.`);
+    if (process.platform === "darwin") {
+      console.log("On macOS, the first hook run may prompt: \"<your terminal> wants to control System Events\".");
+      console.log("Click Allow — the scanner uses this to collect endpoint info (login items).");
+    }
+  }
+}
+
+async function cmdUninstall(opts) {
+  const home = process.env.HOME || os.homedir();
+  const scope = opts.scope || "user";
+  const base = scope === "user" ? home : process.cwd();
+
+  let agents;
+  if (opts.all) {
+    agents = detectInstalled(home);
+  } else if (opts.agent) {
+    agents = parseAgentList(opts.agent);
+  } else {
+    agents = detectInstalled(home);
+  }
+
+  if (agents.length === 0) {
+    console.error("no agents detected; specify --agent explicitly");
+    process.exit(1);
+  }
+
+  for (const name of agents) {
+    if (!AGENT_REGISTRY[name]) {
+      console.error(`unknown agent: ${name} (see 'aidr list-agents')`);
+      process.exit(1);
+    }
+  }
+
+  // Phase 1: collect plans (dry-run each agent)
+  const plans = await Promise.all(agents.map(async (name) => {
+    const mod = await loadAgent(name);
+    try {
+      const plan = await mod.uninstall(base, { dryRun: true });
+      return { name, mod, plan };
+    } catch (e) {
+      console.error(`[${name}] cannot plan uninstall: ${e.message}`);
+      process.exit(1);
+    }
+  }));
+
+  // Decide whether there's any work to confirm. Includes nested unmerge
+  // sub-actions (codex: { action: "unmerge", hooksJson, configToml }).
+  const settingsHasWork = (settings) => {
+    if (!settings || settings.action === "none") return false;
+    if (settings.action === "unmerge") {
+      return ["hooksJson", "configToml"].some((k) => {
+        const sub = settings[k];
+        return sub && sub.action !== "none" && sub.action !== "noop";
+      });
+    }
+    return settings.action === "delete" || settings.action === "modify";
+  };
+
+  const hasWork = plans.some(({ plan }) =>
+    plan && (plan.removedFiles?.length > 0 || settingsHasWork(plan.settings))
+  );
+  if (!hasWork) {
+    console.log("nothing to uninstall");
+    return;
+  }
+
+  // Print plan
+  console.error("aidr uninstall — the following will be removed/modified:");
+  for (const { name, plan } of plans) {
+    if (!plan) continue;
+    for (const f of plan.removedFiles || []) {
+      console.error(`  [${name}] remove  ${f}`);
+    }
+    if (plan.settings) {
+      if (plan.settings.action === "delete") {
+        console.error(`  [${name}] delete  ${plan.settings.path} (no ai-scanner entries left)`);
+      } else if (plan.settings.action === "modify") {
+        console.error(`  [${name}] modify  ${plan.settings.path} (strip ai-scanner env/hooks, backup created)`);
+      } else if (plan.settings.action === "unmerge") {
+        // Nested plan (codex): surface each sub-action so `-y` users can see
+        // hooks.json / config.toml will be touched.
+        for (const sub of [plan.settings.hooksJson, plan.settings.configToml]) {
+          if (!sub || sub.action === "none" || sub.action === "noop") continue;
+          if (sub.action === "delete") {
+            console.error(`  [${name}] delete  ${sub.path} (no ai-scanner entries left)`);
+          } else {
+            console.error(`  [${name}] modify  ${sub.path} (strip ai-scanner entries, backup created)`);
+          }
+        }
+      }
+    }
+  }
+
+  if (opts.dryRun) return;
+
+  // Phase 2: confirm
+  if (!opts.yes) {
+    if (!process.stdin.isTTY) {
+      console.error("");
+      console.error("Re-run with -y/--yes to proceed non-interactively.");
+      process.exit(1);
+    }
+    const ok = await promptYesNo("Proceed?");
+    if (!ok) {
+      console.error("aborted");
+      process.exit(1);
+    }
+  }
+
+  // Phase 3: execute
+  await Promise.all(plans.map(async ({ name, mod }) => {
+    try {
+      const res = await mod.uninstall(base, { dryRun: false });
+      console.log(`[${name}] uninstalled`);
+      if (res?.settings?.backupPath) {
+        console.log(`[${name}] existing settings backed up to ${res.settings.backupPath}`);
+      }
+    } catch (e) {
+      console.error(`[${name}] uninstall failed: ${e.message}`);
+      process.exit(1);
+    }
+  }));
+
+  try {
+    const { uninstallScheduled } = await import("./scheduled.mjs");
+    await uninstallScheduled({ home, dryRun: opts.dryRun });
+  } catch (e) {
+    console.error(`scheduled uninstall warning: ${e.message}`);
+  }
+}
+
+async function cmdDoctor() {
+  const home = process.env.HOME || os.homedir();
+  console.log(`home: ${home}`);
+  console.log(`node: ${process.version}`);
+  console.log(`platform: ${process.platform}/${process.arch}`);
+  const installed = detectInstalled(home);
+  console.log(`detected agents: ${installed.join(", ") || "(none)"}`);
+  const lines = await Promise.all(installed.map(async (name) => {
+    const mod = await loadAgent(name);
+    const agentDir = mod.meta.agentDir;
+    if (!agentDir) return null;
+    const bin = path.join(home, agentDir, "bin", "ai-scanner");
+    let present = false;
+    try {
+      await fs.access(bin, fs.constants.F_OK);
+      present = true;
+    } catch {}
+    return `binary: ${bin} ${present ? "[present]" : "[missing]"}`;
+  }));
+  for (const line of lines) {
+    if (line) console.log(line);
+  }
+}
+
+async function cmdListAgents() {
+  for (const name of AGENT_ORDER) {
+    const mod = await loadAgent(name);
+    const d = mod.meta.displayName || name;
+    const stub = mod.meta.stub ? " (stub)" : "";
+    console.log(`${name}\t${d}${stub}`);
+  }
+}
+
+export async function run(argv) {
+  const program = new Command();
+  program
+    .name("aidr")
+    .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
+    .version("0.0.1");
+
+  program
+    .command("install")
+    .description("Install ai-scanner hooks for one or more agents")
+    .option("--agent <list>", "comma-separated agent names")
+    .option("--all", "install for all detected agents")
+    .requiredOption("--key <ak_xxx>", "access key (ak_<43-char>)")
+    .option("--env <env>", "target environment: dev|prod (default: auto-detected from package name — `-dev` suffix ⇒ dev, otherwise prod)")
+    .option("--dry-run", "print planned writes, do not touch disk", false)
+    .option("--force", "overwrite existing hook scripts (settings.json is always merged, never overwritten)", false)
+    .option("--binary-only", "fetch binary and exit", false)
+    .option("--no-verify", "skip /verify call")
+    .option("--skip-binary", "skip binary download", false)
+    .option("--scope <project|user>", "installation scope: user ($HOME) or project (cwd)", "user")
+    .option("-y, --yes", "proceed without confirmation when existing settings.json is detected", false)
+    .option("--uninstall", "remove all ai-scanner hooks/scripts/binaries for the selected agents (see 'uninstall' command)", false)
+    .option("--scheduled", "enable scheduled endpoint-info collection (creates a cron/systemd/launchd entry; without this flag endpoint-info is never collected)", false)
+    .option("--interval <hours>", "scheduled scan interval in hours (min 1, default 4; requires --scheduled)", "4")
+    .option("--browser-extension", "install browser extension native messaging host for Shadow IT network monitoring (default: disabled)", false)
+    .action(cmdInstall);
+
+  program
+    .command("uninstall")
+    .description("Remove ai-scanner hooks, scripts, and binaries for one or more agents")
+    .option("--agent <list>", "comma-separated agent names (default: all detected)")
+    .option("--all", "uninstall for all detected agents")
+    .option("--scope <project|user>", "scope: user ($HOME) or project (cwd)", "user")
+    .option("-y, --yes", "proceed without confirmation prompt", false)
+    .option("--dry-run", "print what would be removed without touching disk", false)
+    .action(cmdUninstall);
+
+  program.command("doctor").action(cmdDoctor);
+  program.command("list-agents").action(cmdListAgents);
+
+  await program.parseAsync(argv);
+}

package/src/detect.mjs

@@ -0,0 +1,39 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const ENTRIES = [
+  ["claude", ".claude"],
+  ["cursor", ".cursor"],
+  ["windsurf", ".windsurf"],
+  ["kiro", ".kiro"],
+  ["gemini", ".gemini"],
+  ["codex", ".codex"],
+  ["cline", ".cline"],
+  ["roo", ".roo"],
+  ["copilot", ".github/copilot"],
+  ["qwen", ".qwen"],
+  ["trae", ".trae"],
+  ["amazonq", ".aws/amazonq"],
+  ["jetbrains", null], // IDE-managed, skip home detection
+  ["opencode", ".opencode"],
+  ["aider", ".aider"],
+  ["amp", ".amp"],
+  ["crush", ".crush"],
+  ["antigravity", ".antigravity"],
+  ["continue", ".continue"],
+];
+
+export function detectInstalled(home = process.env.HOME || "") {
+  const out = [];
+  for (const [name, rel] of ENTRIES) {
+    if (!rel) continue;
+    const p = path.join(home, rel);
+    try {
+      const st = fs.statSync(p);
+      if (st.isDirectory()) out.push(name);
+    } catch {
+      // not present
+    }
+  }
+  return out;
+}