@drael/code 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drael/code",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Point your coding client at Drael.",
   "type": "module",
   "bin": {

package/src/code.js

@@ -41,12 +41,15 @@ import { isCancel, PasswordPrompt, SelectPrompt } from '@clack/core'
 
 /* ─────────────────────────────────────────────────────────────  where things live  ── */
 
-const CONFIG_HOME =
-  process.env.XDG_CONFIG_HOME ??
-  (platform() === 'win32'
-    ? join(process.env.APPDATA ?? homedir(), 'Config')
-    : join(homedir(), '.config'))
-
+// Home-relative on every platform, Windows included. The clients here document
+// `~/.config/<them>` literally and read nowhere else, so the earlier `%APPDATA%\\Config`
+// branch wrote a valid file into a directory nothing opens: the worst failure this tool
+// has, because it reports success.
+const CONFIG_HOME = process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config')
+
+// The backups do not follow, and that is deliberate: this directory is ours rather than a
+// client's, so it was never in the wrong place, and moving it would strand the records
+// written by an earlier version. An uninstall that cannot find them is not an uninstall.
 const STATE_HOME =
   process.env.XDG_STATE_HOME ??
   (platform() === 'win32'
@@ -55,8 +58,8 @@ const STATE_HOME =
 
 const BACKUPS = join(STATE_HOME, 'drael', 'installer')
 
-// Kilo documents this literal path on every platform, Windows included, so this one
-// does not go through CONFIG_HOME the way the others do.
+// Kilo documents this literal path, so unlike the others it is not moved by
+// XDG_CONFIG_HOME either.
 const KILO_CONFIG = join(homedir(), '.config', 'kilo', 'kilo.jsonc')
 
 // There is one origin (ADR 0017), and this package is published by the people who run
@@ -279,17 +282,24 @@ const askClient = () =>
  * product itself. The one call this makes, and the only one: it is to the host being
  * configured, with the key being configured, and a host that does not answer is not a
  * reason to refuse to write anything, so the published id stands in.
+ *
+ * It is also the only check the reader needs, which is why the frame reports what came
+ * back instead of handing out a curl line: that line carried the key in clear text, on
+ * screen and into the scrollback, one row under the prompt that had just masked it.
  */
-async function servedModel(host, key) {
+async function askHost(host, key) {
   try {
     const response = await fetch(`${host}/v1/models`, {
       headers: { Authorization: `Bearer ${key}` },
       signal: AbortSignal.timeout(4000),
     })
+    if (response.status === 401 || response.status === 403) {
+      return { refused: true }
+    }
     const served = (await response.json())?.data?.[0]?.id
-    return typeof served === 'string' && served ? served : MODEL
+    return { model: typeof served === 'string' && served ? served : null }
   } catch {
-    return MODEL
+    return {}
   }
 }
 
@@ -327,8 +337,9 @@ async function install(args) {
     fail(`unknown client: ${name} (try --list)`)
   }
 
+  const answer = await askHost(host, key)
   const file = client.file()
-  const contents = client.contents(host, key, await servedModel(host, key))
+  const contents = client.contents(host, key, answer.model ?? MODEL)
 
   // An answered prompt leaves its frame on screen and needs a gap after it. With every
   // answer given as a flag there was no frame, and the masthead's own gap is already it.
@@ -367,11 +378,25 @@ async function install(args) {
   console.log()
   console.log(rule())
   console.log()
-  console.log(row('check it', dim(`curl ${host}/v1/models -H "Authorization: Bearer ${key}"`)))
+  console.log(row('the host', dim(`${host}/v1, ${said(answer)}`)))
+  if (answer.refused) {
+    console.log(under(dim(`create one at ${host}/developers, then run this again`)))
+  }
   console.log(row('undo it', dim('npx @drael/code --uninstall')))
   console.log()
 }
 
+/** What the one call came back with, in the frame's own voice. */
+function said(answer) {
+  if (answer.refused) {
+    return 'which refused that key'
+  }
+  if (answer.model) {
+    return `serving ${answer.model}`
+  }
+  return `which did not answer, so ${MODEL} was written`
+}
+
 /**
  * Every write is preceded by a copy. An uninstall that cannot put the file back is not
  * an uninstall, it is a deletion with better manners. It reports what it found rather
@@ -497,7 +522,13 @@ function parse(argv) {
       parsed[name] = true
       continue
     }
-    parsed[name] = argv[++i]
+    // `--client --key dk-…` used to swallow the next flag as the value and then report
+    // `unknown client: --key`, which names neither the mistake nor the fix.
+    const value = argv[++i]
+    if (value === undefined || value.startsWith('--')) {
+      fail(`--${name} needs a value`)
+    }
+    parsed[name] = value
   }
   return parsed
 }