@elbow-dev/acp 0.0.0-stage → 0.1.0

package/bin.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { execFileSync, spawn } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// The package an app installs from the ACP Registry: `elbow acp` without the elbow command. It signs in, keeps the
+// key and keeps threads where the elbow command does, so either finds what the other saved.
+const url = process.env.ELBOW_URL ?? 'https://api.elbow.dev';
+const dir = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'elbow');
+const keyFile = path.join(dir, 'key');
+const { version } = JSON.parse(fs.readFileSync(new URL('package.json', import.meta.url), 'utf8'));
+const mac = process.platform === 'darwin';
+
+const keychain = (...args) => {
+  if (!mac) return null;
+  try {
+    return execFileSync('security', args, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return null;
+  }
+};
+const keyOf = () => {
+  if (process.env.ELBOW_KEY) return process.env.ELBOW_KEY;
+  const saved = keychain('find-generic-password', '-s', 'elbow', '-a', url, '-w');
+  if (saved) return saved;
+  try {
+    return fs.readFileSync(keyFile, 'utf8').trim();
+  } catch {
+    return '';
+  }
+};
+const save = (key) => {
+  // Through security's own prompt, so the key never shows in the process list.
+  if (mac) {
+    try {
+      execFileSync('security', ['-i'], {
+        input: `add-generic-password -U -s elbow -l Elbow -a "${url}" -w "${key}"\n`,
+        stdio: ['pipe', 'ignore', 'ignore'],
+      });
+      if (keychain('find-generic-password', '-s', 'elbow', '-a', url, '-w') === key) return;
+    } catch {}
+  }
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(keyFile, key, { mode: 0o600 });
+};
+const deviceName = () => {
+  let name = '';
+  try {
+    if (mac) name = execFileSync('scutil', ['--get', 'ComputerName'], { encoding: 'utf8' }).trim();
+  } catch {}
+  return (name || os.hostname()).replace(/[^\w .-]/g, '').slice(0, 64);
+};
+
+// The device flow `elbow login` uses: a short code, confirmed in the browser where the person is signed in.
+const login = async () => {
+  const post = (route, body) =>
+    fetch(`${url}${route}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+  const start = await (await post('/auth/device', {})).json();
+  const link = `${start.verification_uri}?code=${start.user_code}`;
+  console.error(`Your code is ${start.user_code}. Confirm it in your browser:\n  ${link}`);
+  if (!process.env.ELBOW_NO_BROWSER) {
+    const opener = mac ? 'open' : process.platform === 'win32' ? 'explorer' : 'xdg-open';
+    spawn(opener, [link], { stdio: 'ignore', detached: true }).on('error', () => {}).unref();
+  }
+  const until = Date.now() + (start.expires_in ?? 600) * 1000;
+  while (Date.now() < until) {
+    await new Promise((ok) => setTimeout(ok, (start.interval ?? 5) * 1000));
+    // A dropped connection is retried: Elbow hands out the same token again for a minute.
+    const res = await post('/auth/device/token', { device_code: start.device_code, name: deviceName() }).catch(
+      () => null,
+    );
+    if (!res || res.status === 503) continue;
+    const reply = await res.json().catch(() => ({}));
+    if (res.ok && reply.status === 'pending') continue;
+    if (res.ok && reply.status === 'ok' && reply.token?.startsWith('elbow-')) {
+      save(reply.token);
+      console.error('Signed in to Elbow. Go back to your app.');
+      return;
+    }
+    if (res.ok && reply.status !== 'expired') throw new Error("Elbow didn't send a key; sign in again.");
+    if (!res.ok) throw new Error(`Elbow answered ${res.status}: ${reply.error?.message ?? reply.message ?? ''}`);
+    break;
+  }
+  throw new Error('That code expired; sign in again.');
+};
+
+if (process.argv.includes('--login')) {
+  await login().catch((e) => {
+    console.error(e.message);
+    process.exit(1);
+  });
+} else {
+  const { start } = await import('./acp.mjs');
+  const agent = await import('./agent.mjs');
+  await start({ agent, key: keyOf(), url, version, saved: path.join(dir, 'acp-sessions') });
+}

package/package.json

@@ -1,6 +1,23 @@
 {
   "name": "@elbow-dev/acp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Elbow's coding agent for apps that speak the Agent Client Protocol, such as T3 Code and Zed.",
+  "type": "module",
+  "bin": {
+    "elbow-acp": "bin.mjs"
+  },
+  "files": [
+    "bin.mjs",
+    "acp.mjs",
+    "agent.mjs",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://elbow.dev",
+  "scripts": {
+    "prepack": "node copy.mjs"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.