@dmrlzz/davecode 0.5.0 → 0.5.2

package/dist/{chunk-HSBJDV3O.js → chunk-QKY3OKVG.js}

@@ -116,7 +116,7 @@ import { z as z8 } from "zod";
 import { randomBytes as randomBytes7 } from "crypto";
 import { createServer } from "http";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes8 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname6, join as join6 } from "path";
 import { z as z9 } from "zod";
 import { z as z10 } from "zod";
@@ -155,6 +155,8 @@ var ENDPOINTS = {
   }
 };
 var PENDING_MS = 10 * 6e4;
+var PENDING_MAX = 1e3;
+var PENDING_PER_PEER = 20;
 var SESSION_MS = 8 * 60 * 6e4;
 var random = () => randomBytes(32).toString("base64url");
 var digest = (value) => createHash("sha256").update(value).digest("base64url");
@@ -200,10 +202,29 @@ var LoginService = class {
   logout(session) {
     if (session) this.sessions.delete(digest(session));
   }
-  begin(provider) {
+  /**
+   * Start a sign-in. `peer` is the connection's address as the HTTP server sees it (never a
+   * forwarded header unless the server was configured to trust its proxy). Unfinished sign-ins
+   * never block a new one: each peer keeps a few, and when the table is full the oldest goes.
+   */
+  begin(provider, peer = "unknown") {
     this.prune();
     const client = this.options.providers[provider];
-    if (!client || this.pending.size >= 1e3) throw new LoginError();
+    if (!client) throw new LoginError();
+    let mine = 0;
+    for (const value of this.pending.values()) if (value.peer === peer) mine++;
+    for (const [key, value] of this.pending) {
+      if (mine < PENDING_PER_PEER) break;
+      if (value.peer === peer) {
+        this.pending.delete(key);
+        mine--;
+      }
+    }
+    while (this.pending.size >= PENDING_MAX) {
+      const oldest = this.pending.keys().next().value;
+      if (oldest === void 0) break;
+      this.pending.delete(oldest);
+    }
     const state = random();
     const binding = random();
     const verifier = random();
@@ -211,6 +232,7 @@ var LoginService = class {
       provider,
       binding: digest(binding),
       verifier,
+      peer,
       expires: this.now() + PENDING_MS
     });
     const url = new URL(ENDPOINTS[provider].authorize);
@@ -1471,6 +1493,53 @@ ${message}`, options);
     this.source = source;
   }
 };
+var PROJECT_SETTABLE_KEYS = {
+  logLevel: true,
+  routing: true,
+  goal: true,
+  runner: {
+    maxRepairCycles: true,
+    branchPrefix: true,
+    baseBranch: true,
+    route: true,
+    executor: true,
+    pullRequests: true,
+    commitBrain: true,
+    commandTimeoutMs: true,
+    idlePollMs: true,
+    maxIterations: true,
+    maxTaskTokens: true,
+    validate: true,
+    claudeCli: { accountId: true, model: true, timeoutMs: true },
+    judge: { kind: true, model: true, threshold: true }
+  }
+};
+function filterProjectLayer(layer) {
+  const dropped = [];
+  const walk = (value, tree, prefix) => {
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+      const rule = Object.hasOwn(tree, key) ? tree[key] : void 0;
+      const path8 = prefix ? `${prefix}.${key}` : key;
+      if (rule === true) {
+        out[key] = v;
+      } else if (rule && isPlainObject(v)) {
+        const inner = walk(v, rule, path8);
+        if (Object.keys(inner).length > 0) out[key] = inner;
+      } else {
+        dropped.push(path8);
+      }
+    }
+    return out;
+  };
+  return { allowed: walk(layer, PROJECT_SETTABLE_KEYS, ""), dropped };
+}
+var warned = /* @__PURE__ */ new Set();
+function defaultWarn(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  process.emitWarning(message, "DaveCodeConfigWarning");
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1483,7 +1552,7 @@ function deepMerge(base, override) {
   }
   return out;
 }
-function readLayer(path8) {
+function readLayer(path8, project) {
   let raw;
   try {
     raw = readFileSync(path8, "utf8");
@@ -1498,9 +1567,15 @@ function readLayer(path8) {
     throw new ConfigError(path8, `malformed JSON: ${err.message}`, { cause: err });
   }
   if (!isPlainObject(parsed)) throw new ConfigError(path8, "expected a JSON object");
-  const result = configSchema.safeParse(parsed);
+  let layer = parsed;
+  if (project) {
+    const { allowed, dropped } = filterProjectLayer(parsed);
+    if (dropped.length > 0) project(dropped);
+    layer = allowed;
+  }
+  const result = configSchema.safeParse(layer);
   if (!result.success) throw new ConfigError(path8, z4.prettifyError(result.error));
-  return parsed;
+  return layer;
 }
 var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off", ""]);
@@ -1558,7 +1633,14 @@ function loadConfig(options = {}) {
   const globalLayer = readLayer(globalPaths(home).config);
   if (globalLayer) merged = deepMerge(merged, globalLayer);
   if (options.projectRoot) {
-    const projectLayer = readLayer(projectPaths(options.projectRoot).config);
+    const projectFile = projectPaths(options.projectRoot).config;
+    const warn = options.onWarning ?? defaultWarn;
+    const projectLayer = readLayer(
+      projectFile,
+      (dropped) => warn(
+        `Ignored ${dropped.join(", ")} in ${projectFile}: project config cannot set these keys. Set them in your user config (~/.davecode/config.json) or with DAVECODE_* environment variables.`
+      )
+    );
     if (projectLayer) merged = deepMerge(merged, projectLayer);
   }
   merged = deepMerge(merged, envLayer(env));
@@ -3875,6 +3957,76 @@ function createProviders(options = {}) {
   ];
   return new Map(providers.map((p) => [p.kind, p]));
 }
+var ENDPOINT_CONFIG_KEYS = ["baseUrl"];
+var MODEL_KEYS = ["models", "defaultModel"];
+var API_CONFIG_KEYS = {
+  anthropic: ["baseUrl", ...MODEL_KEYS],
+  openai: ["baseUrl", "includeUsage", ...MODEL_KEYS],
+  gemini: ["baseUrl", ...MODEL_KEYS],
+  "openai-compatible": ["baseUrl", "includeUsage", ...MODEL_KEYS],
+  "claude-cli": [...MODEL_KEYS],
+  "codex-cli": [...MODEL_KEYS],
+  "gemini-cli": [...MODEL_KEYS],
+  "antigravity-cli": [...MODEL_KEYS],
+  "gemini-web": ["models"]
+};
+function isStringList(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string" && v.length > 0);
+}
+function apiConfigIssues(provider, config, existing = {}) {
+  const allowed = API_CONFIG_KEYS[provider];
+  const issues = [];
+  for (const [key, value] of Object.entries(config)) {
+    if (!allowed.includes(key)) {
+      if (key in existing && JSON.stringify(existing[key]) === JSON.stringify(value)) continue;
+      issues.push(
+        `config.${key} cannot be set through the API for ${provider} accounts` + (allowed.length > 0 ? ` (allowed: ${allowed.join(", ")})` : "")
+      );
+      continue;
+    }
+    if (key === "baseUrl") {
+      if (typeof value !== "string" || !isHttpUrl(value)) {
+        issues.push("config.baseUrl must be an http(s) URL without embedded credentials");
+      }
+    } else if (key === "models") {
+      if (!isStringList(value)) issues.push("config.models must be a list of model ids");
+    } else if (key === "defaultModel") {
+      if (typeof value !== "string" || !value) issues.push("config.defaultModel must be a string");
+    } else if (key === "includeUsage" && typeof value !== "boolean") {
+      issues.push("config.includeUsage must be true or false");
+    }
+  }
+  return issues;
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function mergeApiConfig(provider, existing, incoming) {
+  const allowed = API_CONFIG_KEYS[provider];
+  const kept = Object.fromEntries(
+    Object.entries(existing).filter(([key]) => !allowed.includes(key))
+  );
+  return { ...kept, ...incoming };
+}
+function endpointOf(config) {
+  return ENDPOINT_CONFIG_KEYS.map((key) => {
+    const value = config[key];
+    return typeof value === "string" ? value.trim().replace(/\/+$/, "") : "";
+  }).join("\n");
+}
+function endpointChanged(existing, next) {
+  return endpointOf(existing) !== endpointOf(next);
+}
+function endpointRebindIssue(existing, nextConfig, secretSupplied) {
+  if (!nextConfig || secretSupplied || !existing.hasSecret) return void 0;
+  if (!endpointChanged(existing.config, nextConfig)) return void 0;
+  return "Changing the endpoint of an account that has a stored secret requires sending the secret again in the same request";
+}
 var EXPERIMENTAL_PROVIDER_KINDS = ["gemini-web"];
 var SUBSCRIPTION_PROVIDER_KINDS = [
   "claude-cli",
@@ -3883,7 +4035,7 @@ var SUBSCRIPTION_PROVIDER_KINDS = [
   "antigravity-cli",
   "gemini-web"
 ];
-var VERSION = "0.5.0";
+var VERSION = "0.5.2";
 var QUOTA_WINDOWS = ["1m", "5h", "24h"];
 var WINDOW_MS = {
   "1m": 6e4,
@@ -8070,12 +8222,14 @@ function accountService(env = process.env) {
 }
 var OAUTH_PROVIDERS = ["google", "github"];
 var AccountError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "AccountError";
   }
   status;
+  code;
 };
 var userSchema = z8.object({
   id: z8.string().min(1),
@@ -8211,7 +8365,8 @@ var AccountClient = class {
       const detail = error.success ? error.data.error_description ?? error.data.msg ?? error.data.message : void 0;
       throw new AccountError(
         detail ?? `Sign-in failed (HTTP ${response.status}).`,
-        response.status
+        response.status,
+        error.success ? error.data.error : void 0
       );
     }
     return raw;
@@ -8287,8 +8442,9 @@ async function startAccountLogin(options) {
     () => setTimeout(() => void close(), 1e3).unref(),
     () => setTimeout(() => void close(), 1e3).unref()
   );
+  const redirectTo = `http://127.0.0.1:${port}${callbackPath}`;
   return {
-    url: client.loginUrl(`http://127.0.0.1:${port}${callbackPath}`, pkce.challenge),
+    url: options.provider ? client.authorizeUrl(options.provider, redirectTo, pkce.challenge) : client.loginUrl(redirectTo, pkce.challenge),
     session,
     close: async () => {
       clearTimeout(timeout);
@@ -8299,6 +8455,16 @@ async function startAccountLogin(options) {
 }
 var AAD = Buffer.from("davecode-account", "utf8");
 var REFRESH_MARGIN_MS = 6e4;
+var LOCK_STALE_MS = 6e4;
+var LOCK_WAIT_MS = 3e4;
+var LOCK_POLL_MS = 50;
+var INVALID_TOKEN_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "refresh_token_not_found",
+  "refresh_token_already_used",
+  "session_not_found",
+  "session_expired"
+]);
 var fileSchema = z9.object({
   v: z9.literal(1),
   iv: z9.string(),
@@ -8375,22 +8541,133 @@ var AccountStore = class {
    * or when the service revoked the session; offline, an unexpired session is still returned.
    */
   async current(client, now = Date.now()) {
-    const session = this.load();
-    if (!session) return void 0;
-    if (session.expiresAt - REFRESH_MARGIN_MS > now) return session;
+    const first = this.load();
+    if (!first) return void 0;
+    if (first.expiresAt - REFRESH_MARGIN_MS > now) return first;
+    const release = await this.lock();
     try {
-      const fresh = await client.refresh(session.refreshToken);
-      this.save(fresh);
-      return fresh;
-    } catch (err) {
-      if (err instanceof AccountError && err.status !== void 0 && err.status < 500) {
-        this.clear();
-        return void 0;
+      const session = this.load();
+      if (!session) return void 0;
+      if (session.expiresAt - REFRESH_MARGIN_MS > now) return session;
+      try {
+        const fresh = await client.refresh(session.refreshToken);
+        this.save(fresh);
+        return fresh;
+      } catch (err) {
+        if (isInvalidToken(err)) {
+          if (this.load()?.refreshToken === session.refreshToken) this.clear();
+          return this.load();
+        }
+        return session;
       }
-      return session;
+    } finally {
+      release();
+    }
+  }
+  /**
+   * A cross-process lock: a file created exclusively next to account.json. A lock older than
+   * LOCK_STALE_MS belongs to a process that died, and is taken over. After LOCK_WAIT_MS the
+   * refresh goes ahead without it (the service tolerates two refreshes racing).
+   */
+  async lock() {
+    const path8 = `${this.path}.lock`;
+    const owner = `${process.pid}:${randomBytes8(8).toString("hex")}`;
+    mkdirSync7(dirname6(path8), { recursive: true });
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (; ; ) {
+      try {
+        writeFileSync3(path8, owner, { flag: "wx", mode: 384 });
+        return () => {
+          try {
+            if (readFileSync3(path8, "utf8") === owner) rmSync3(path8, { force: true });
+          } catch {
+          }
+        };
+      } catch (err) {
+        if (err.code !== "EEXIST" && !isWindowsBusy(err))
+          return () => void 0;
+      }
+      try {
+        if (Date.now() - statSync2(path8).mtimeMs > LOCK_STALE_MS) rmSync3(path8, { force: true });
+      } catch {
+      }
+      if (Date.now() >= deadline) return () => void 0;
+      await new Promise((resolve5) => setTimeout(resolve5, LOCK_POLL_MS));
     }
   }
 };
+function isInvalidToken(err) {
+  if (!(err instanceof AccountError) || err.status === void 0) return false;
+  if (err.code) return INVALID_TOKEN_CODES.has(err.code);
+  return err.status === 400 || err.status === 401;
+}
+var isWindowsBusy = (err) => ["EPERM", "EBUSY"].includes(err.code ?? "");
+var SIGN_IN_FAILED = "Sign-in did not finish. Please try again.";
+function createAccountControl(options) {
+  const service = options.service ?? accountService(options.env);
+  if (!service) return void 0;
+  const client = new AccountClient(service, options.fetch ? { fetch: options.fetch } : {});
+  const store = () => new AccountStore(options.home, options.env);
+  let active;
+  let error = null;
+  async function stop() {
+    const login = active;
+    active = void 0;
+    await login?.close();
+  }
+  async function finish(login) {
+    try {
+      const session = await login.session;
+      if (active !== login) return;
+      active = void 0;
+      store().save(session);
+    } catch {
+      if (active !== login) return;
+      active = void 0;
+      error = SIGN_IN_FAILED;
+    }
+  }
+  return {
+    async state() {
+      const session = await store().current(client);
+      return {
+        signedIn: Boolean(session),
+        user: session?.user ?? null,
+        pending: active !== void 0,
+        error
+      };
+    },
+    async login(provider) {
+      await stop();
+      error = null;
+      const login = await startAccountLogin({
+        client,
+        ...provider ? { provider } : {},
+        ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {}
+      });
+      active = login;
+      void finish(login);
+      const opened = await options.open(login.url).catch(() => false);
+      return { url: login.url, opened };
+    },
+    async cancel() {
+      error = null;
+      await stop();
+    },
+    async logout() {
+      await stop();
+      error = null;
+      const accounts = store();
+      const session = accounts.load();
+      try {
+        if (session) await client.signOut(session.accessToken);
+      } catch {
+      }
+      accounts.clear();
+    },
+    close: stop
+  };
+}
 var BRAND_MARK_SVG = '<svg viewBox="0 0 1214 1214" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path fill="currentColor" fill-rule="evenodd" d="M324.3 1096.5C324.6 1095.4 326.5 1088.3 328.5 1080.8C341.4 1031.3 375.8 953.4 419.7 874.0C445.8 826.9 448.4 822.4 471.8 783.0C501.5 733.1 530.1 687.6 556.4 648.5C563.7 637.5 569.7 628.4 569.5 628.2C569.4 628.1 563.1 631.7 555.4 636.3C513.8 661.4 468.0 683.9 411.0 707.5C337.2 737.9 321.7 744.7 296.0 757.2C241.9 783.5 199.1 809.4 152.0 844.3C119.5 868.4 98.8 885.9 71.3 912.4C64.0 919.5 58.0 925.0 58.0 924.7C58.0 923.1 64.7 902.4 68.8 891.0C116.1 762.1 215.0 644.2 351.0 554.8C385.2 532.3 411.6 516.9 445.5 499.4C521.4 460.4 589.4 435.7 636.0 430.0C676.8 425.1 715.1 437.0 743.9 463.6C763.4 481.6 779.0 509.9 785.2 538.5C787.7 550.1 788.7 579.7 787.1 592.5C782.6 626.4 769.7 661.5 746.5 702.0C717.7 752.5 675.6 806.9 627.0 856.4C599.5 884.4 575.9 905.4 542.5 931.6C510.0 957.1 500.7 964.2 432.5 1015.0C409.4 1032.3 382.6 1052.5 373.0 1060.0C354.5 1074.4 327.4 1095.5 325.1 1097.4C324.0 1098.3 323.8 1098.1 324.3 1096.5ZM783.2 1017.8C797.1 999.5 820.2 966.0 831.7 947.5C868.5 888.3 888.8 840.5 903.4 778.5C917.9 716.9 921.2 643.7 912.0 591.0C904.6 549.3 889.7 511.9 866.7 477.5C856.6 462.3 853.1 457.8 837.4 439.6C817.4 416.6 806.6 402.0 800.5 389.5C793.6 375.5 791.7 368.1 791.7 356.0C791.7 335.3 799.3 319.6 819.0 299.9C849.7 269.2 900.2 247.9 956.8 241.9C963.0 241.2 967.7 240.3 967.3 239.9C966.1 238.8 948.5 236.3 933.0 234.9C913.6 233.2 875.2 234.3 859.0 237.0C839.7 240.2 827.8 242.9 813.0 247.5C753.9 265.9 700.6 300.9 659.2 348.5C648.9 360.4 636.6 376.5 632.4 383.5C630.3 387.1 629.0 388.2 624.7 389.6C603.8 396.4 554.6 417.6 513.5 437.5C447.6 469.4 395.4 496.8 341.5 528.1L337.5 530.4L339.5 527.9C340.6 526.6 346.2 520.3 352.0 514.0C374.4 489.6 390.2 470.8 411.2 443.5C429.3 419.9 444.6 398.2 488.5 333.5C510.5 301.0 529.1 278.0 550.9 256.3C593.0 214.1 640.3 183.6 691.5 165.5C727.7 152.8 756.5 147.7 792.5 147.7C854.3 147.8 906.4 164.9 954.1 200.6C967.5 210.8 974.1 214.6 981.5 217.0C991.4 220.1 1022.1 231.9 1038.5 238.8C1061.9 248.7 1099.0 267.4 1097.7 268.7C1097.4 268.9 1089.3 268.5 1079.7 267.9C1033.7 264.7 984.5 274.1 946.2 293.4C932.3 300.4 915.0 313.0 903.4 324.5C881.0 346.6 870.0 369.6 870.0 394.4C870.0 413.7 876.8 433.1 894.7 465.2C908.8 490.3 914.6 501.1 922.8 517.5C961.3 594.3 980.0 662.5 980.0 725.4C980.0 770.9 967.3 818.9 944.4 860.4C927.6 890.8 912.0 911.0 882.5 940.6C856.5 966.7 828.5 989.7 797.0 1010.7C779.6 1022.2 780.0 1022.0 783.2 1017.8Z"/></svg>';
 var LOGO_ART = [
   "           \u2584\u2584\u2584\u2588\u2584\u2584\u2584",
@@ -9462,6 +9739,8 @@ export {
   routeSchema,
   configSchema,
   ConfigError,
+  PROJECT_SETTABLE_KEYS,
+  filterProjectLayer,
   deepMerge,
   envLayer,
   loadConfig,
@@ -9486,6 +9765,12 @@ export {
   OpenAIProvider,
   OpenAICompatibleProvider,
   createProviders,
+  ENDPOINT_CONFIG_KEYS,
+  API_CONFIG_KEYS,
+  apiConfigIssues,
+  mergeApiConfig,
+  endpointChanged,
+  endpointRebindIssue,
   EXPERIMENTAL_PROVIDER_KINDS,
   SUBSCRIPTION_PROVIDER_KINDS,
   VERSION,
@@ -9587,6 +9872,7 @@ export {
   startAccountLogin,
   accountFile,
   AccountStore,
+  createAccountControl,
   BRAND_MARK_SVG,
   brandLogo,
   DEFAULT_ROLES,
@@ -9605,4 +9891,4 @@ export {
   GoalStore,
   createGoalService
 };
-//# sourceMappingURL=chunk-HSBJDV3O.js.map
+//# sourceMappingURL=chunk-QKY3OKVG.js.map