@elliotsystems/eai 0.1.2 → 0.1.4

package/README.md

@@ -31,9 +31,11 @@ In precedence order (`lib/resolve.js`):
 | # | Source | Path |
 |---|---|---|
 | 1 | `ELLIOT_OPENCODE_BIN` | the binary itself |
-| 2 | bundled runtime | `vendor/opencode-<platform>-<arch>/bin/opencode[.exe]` |
-| 3 | `ELLIOT_OPENCODE_HOME` | `<home>/packages/opencode/dist/…` or `<home>/opencode-<platform>-<arch>/…` |
-| 4 | sibling fork checkout | **development only**, last resort |
+| 2 | platform npm package | `@elliotsystems/eai-<platform>-<arch>/bin/opencode[.exe]`, via `require.resolve` -- **this is how an installed `eai` finds its runtime** |
+| 3 | bundled runtime | `vendor/opencode-<platform>-<arch>/bin/opencode[.exe]` |
+| 4 | `ELLIOT_OPENCODE_HOME` | `<home>/packages/opencode/dist/…` or `<home>/opencode-<platform>-<arch>/…` |
+| 5 | in-repo fork checkout | `../opencode/packages/opencode/dist/…` -- **development only** |
+| 6 | sibling fork checkout | `../../opencode/packages/opencode/dist/…` -- **development only**, last resort |
 
 Two deliberate rules:
 
@@ -58,8 +60,11 @@ stays clean for piping).
 (`@elliotsystems/elliot-ai`, currently on PATH). Both can coexist, so the legacy
 CLI keeps working untouched and its retirement stays a separate, later decision.
 
-The package is still `private: true` — packaging, publishing and global install
-are out of scope until approved. Run it locally with `node bin/eai`.
+Run it locally, without installing, with `node bin/eai`.
+
+> This section previously said the package was `private: true` and that publishing
+> was out of scope. It has been published as `@elliotsystems/eai` since 0.1.0; the
+> note was left behind and is corrected here.
 
 ## Install
 

package/bin/eai

@@ -25,6 +25,8 @@ const {
   resolveOpencodeBin,
 } = require("../lib/resolve.js")
 const { injectToken } = require("../lib/token-env.js")
+const { stageOverlay } = require("../lib/stage.js")
+const { runSetup, parseArgs } = require("../lib/setup.js")
 
 /**
  * Resolve symlinks before deriving the package root.
@@ -50,6 +52,11 @@ function packageRoot() {
 }
 
 const PACKAGE_ROOT = packageRoot()
+const PACKAGE_VERSION = require("../package.json").version
+// OSC 0 (set icon name and window title), BEL-terminated: every terminal that
+// supports OSC accepts BEL, while some older ones reject ST.
+const ELLIOT_TITLE = String.fromCharCode(27) + "]0;Elliot-AI" + String.fromCharCode(7)
+
 const FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"]
 
 function fail(message) {
@@ -57,6 +64,26 @@ function fail(message) {
   process.exit(127) // conventional "command not found"
 }
 
+// `eai setup` is handled here and never reaches the runtime.
+//
+// It is intercepted BEFORE the runtime is resolved, because setup is what a
+// machine runs when nothing is configured yet -- failing with "could not locate
+// the OpenCode runtime" would be a confusing way to refuse to configure it.
+// `setup` is not an OpenCode command, so nothing is shadowed.
+//
+// This exists so `eai` is the only CLI to install. Onboarding used to hand out
+// a second global package whose whole job was writing two config files, and a
+// user who ran only the first install got a CLI with no backend and no token.
+if (process.argv[2] === "setup") {
+  const options = parseArgs(process.argv.slice(3))
+  runSetup(options).catch((error) => {
+    process.stderr.write(`eai setup: ${error.message}
+`)
+    process.exit(1)
+  })
+  return
+}
+
 const resolved = resolveOpencodeBin({ packageRoot: PACKAGE_ROOT })
 
 if (!resolved) {
@@ -87,10 +114,33 @@ if (process.env.ELLIOT_LAUNCHER_DEBUG) {
 // the child inherits process.env, so setting it here is enough.
 injectToken(process.env)
 
+// Elliot's identity travels WITH this package, not with the directory the user
+// happens to be standing in. Before this, branding came from a `tui.json` in the
+// Elliot repository root, so an installed `eai` outside that repo rendered as
+// plain OpenCode. `config/` is packaged (see package.json `files`) and holds the
+// theme, the palette and the plugin registration.
+const env = { ...process.env }
+if (!env.OPENCODE_CONFIG_DIR) {
+  // Staged OUTSIDE node_modules, which is not optional: a plugin under
+  // node_modules does not load (its tsconfig, and so its jsxImportSource, is
+  // not applied there), and the TUI comes up as plain OpenCode with nothing
+  // logged. See lib/stage.js.
+  const staged = stageOverlay({ packageRoot: PACKAGE_ROOT, version: PACKAGE_VERSION })
+  if (staged) env.OPENCODE_CONFIG_DIR = staged
+}
+
+// The one branding surface no plugin slot can reach. Upstream sets the terminal
+// title itself from a `createEffect` with no slot and no config key, but it does
+// honour this flag (`core/src/flag/flag.ts`), so we turn its title off and write
+// our own below. This is what lets OpenCode stay stock.
+env.OPENCODE_DISABLE_TERMINAL_TITLE = "1"
+
+// Claim the title before the child paints anything.
+if (process.stdout.isTTY) process.stdout.write(ELLIOT_TITLE)
+
 // argv passes through untouched and WITHOUT a shell, so quoting, spaces and
-// shell metacharacters in a prompt reach the runtime as the user typed them and
-// are never re-interpreted by an intermediate shell.
-const child = childProcess.spawn(resolved.path, process.argv.slice(2), { stdio: "inherit" })
+// shell metacharacters in a prompt reach the runtime as the user typed them.
+const child = childProcess.spawn(resolved.path, process.argv.slice(2), { stdio: "inherit", env })
 
 child.on("error", (error) => fail(error.message))
 

package/config/opencode.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["../plugin/opencode-plugin"]
+}

package/config/themes/elliot.json

@@ -0,0 +1,105 @@
+{
+  "$schema": "https://opencode.ai/theme.json",
+  "defs": {
+    "brandOrange": "#FF6600",
+    "accentOrange": "#FF7A2E",
+    "accentOrangeLit": "#FF9354",
+    "accentOrangeSoft": "#FFB07A",
+    "accentOrangeDeep": "#C2410C",
+    "accentOrangeInk": "#7C2D12",
+
+    "ground": "#0B0C0E",
+    "panel": "#121315",
+    "elevated": "#191B1D",
+    "elevated2": "#212325",
+    "border": "#262829",
+    "borderSoft": "#1C1E20",
+
+    "text": "#F5F6F8",
+    "textFaint": "#A0A3A8",
+    "textDim": "#8E9297",
+    "textGhost": "#3A3D3F",
+
+    "success": "#5DD89B",
+    "warning": "#E8C33A",
+    "error": "#F7768E",
+    "teal": "#5EEAD4",
+
+    "lightGround": "#FFFFFF",
+    "lightPanel": "#FAFAFA",
+    "lightElevated": "#F2F2F4",
+    "lightElevated2": "#E9E9EC",
+    "lightBorder": "#D9D9DE",
+    "lightBorderSoft": "#EDEDF0",
+    "lightText": "#0B0C0E",
+    "lightTextDim": "#6B6E73",
+    "lightTextFaint": "#8E9297",
+    "lightTextGhost": "#C4C6CA",
+    "lightSuccess": "#1B7F4F",
+    "lightWarning": "#8A6D0B",
+    "lightError": "#C2334C",
+    "lightTeal": "#0F766E"
+  },
+  "theme": {
+    "primary": { "dark": "brandOrange", "light": "brandOrange" },
+    "accent": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "secondary": { "dark": "teal", "light": "lightTeal" },
+    "info": { "dark": "accentOrangeSoft", "light": "accentOrangeDeep" },
+
+    "error": { "dark": "error", "light": "lightError" },
+    "warning": { "dark": "warning", "light": "lightWarning" },
+    "success": { "dark": "success", "light": "lightSuccess" },
+
+    "text": { "dark": "text", "light": "lightText" },
+    "textMuted": { "dark": "textDim", "light": "lightTextDim" },
+
+    "selectedListItemText": { "dark": "ground", "light": "lightGround" },
+
+    "background": { "dark": "ground", "light": "lightGround" },
+    "backgroundPanel": { "dark": "panel", "light": "lightPanel" },
+    "backgroundElement": { "dark": "elevated", "light": "lightElevated" },
+    "backgroundMenu": { "dark": "elevated2", "light": "lightElevated2" },
+
+    "border": { "dark": "border", "light": "lightBorder" },
+    "borderActive": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "borderSubtle": { "dark": "borderSoft", "light": "lightBorderSoft" },
+
+    "diffAdded": { "dark": "success", "light": "lightSuccess" },
+    "diffRemoved": { "dark": "error", "light": "lightError" },
+    "diffContext": { "dark": "textDim", "light": "lightTextDim" },
+    "diffHunkHeader": { "dark": "textFaint", "light": "lightTextFaint" },
+    "diffHighlightAdded": { "dark": "#8DE8B8", "light": "#12603B" },
+    "diffHighlightRemoved": { "dark": "#FF9BAC", "light": "#A62740" },
+    "diffAddedBg": { "dark": "#0F2018", "light": "#E4F5EB" },
+    "diffRemovedBg": { "dark": "#241318", "light": "#FBE4E9" },
+    "diffContextBg": { "dark": "panel", "light": "lightPanel" },
+    "diffLineNumber": { "dark": "textGhost", "light": "lightTextGhost" },
+    "diffAddedLineNumberBg": { "dark": "#0C1913", "light": "#D6EDDF" },
+    "diffRemovedLineNumberBg": { "dark": "#1D0F13", "light": "#F6D8DF" },
+
+    "markdownText": { "dark": "text", "light": "lightText" },
+    "markdownHeading": { "dark": "brandOrange", "light": "accentOrangeDeep" },
+    "markdownLink": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "markdownLinkText": { "dark": "accentOrangeSoft", "light": "accentOrangeDeep" },
+    "markdownCode": { "dark": "accentOrangeSoft", "light": "accentOrangeDeep" },
+    "markdownBlockQuote": { "dark": "textFaint", "light": "lightTextFaint" },
+    "markdownEmph": { "dark": "accentOrangeLit", "light": "accentOrangeDeep" },
+    "markdownStrong": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "markdownHorizontalRule": { "dark": "borderSoft", "light": "lightBorderSoft" },
+    "markdownListItem": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "markdownListEnumeration": { "dark": "accentOrangeLit", "light": "accentOrangeDeep" },
+    "markdownImage": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "markdownImageText": { "dark": "textFaint", "light": "lightTextFaint" },
+    "markdownCodeBlock": { "dark": "text", "light": "lightText" },
+
+    "syntaxComment": { "dark": "textGhost", "light": "lightTextGhost" },
+    "syntaxKeyword": { "dark": "accentOrange", "light": "accentOrangeDeep" },
+    "syntaxFunction": { "dark": "accentOrangeLit", "light": "accentOrangeInk" },
+    "syntaxVariable": { "dark": "text", "light": "lightText" },
+    "syntaxString": { "dark": "success", "light": "lightSuccess" },
+    "syntaxNumber": { "dark": "accentOrangeSoft", "light": "accentOrangeDeep" },
+    "syntaxType": { "dark": "teal", "light": "lightTeal" },
+    "syntaxOperator": { "dark": "textFaint", "light": "lightTextFaint" },
+    "syntaxPunctuation": { "dark": "textDim", "light": "lightTextDim" }
+  }
+}

package/config/tui.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://opencode.ai/tui.json",
+  "theme": "elliot",
+  "mouse": true,
+  "plugin": ["../plugin/opencode-plugin"],
+  "plugin_enabled": {
+    "internal:home-tips": false
+  }
+}

package/lib/resolve.js

@@ -15,6 +15,7 @@ const path = require("path")
 const os = require("os")
 
 const DEV_FALLBACK = "in-repo fork checkout (dev)"
+const STOCK_RUNTIME = "stock upstream runtime"
 const SIBLING_FALLBACK = "sibling fork checkout (dev)"
 
 const PLATFORM_MAP = { darwin: "darwin", linux: "linux", win32: "windows" }
@@ -50,21 +51,51 @@ function candidates(opts) {
     out.push({ source: "ELLIOT_OPENCODE_BIN", path: env.ELLIOT_OPENCODE_BIN })
   }
 
-  // 2. Per-platform npm optionalDependency package — the shape a published,
-  //    `npm install`-ed `@elliotsystems/eai` gets its runtime from. Resolved via
-  //    `require.resolve` so it works no matter where npm hoisted node_modules.
+  // 2. Stock upstream OpenCode, from upstream's OWN per-platform npm package.
+  //
+  //    Resolved DIRECTLY rather than through `opencode-ai/bin/opencode.exe`,
+  //    and that distinction is the difference between working and not. The path
+  //    inside `opencode-ai` is a 479-byte placeholder shell script until its
+  //    postinstall replaces it with the real binary -- and postinstall does not
+  //    always run: `--ignore-scripts`, pnpm's defaults, and npm's newer
+  //    script-gating all skip it. Observed on a clean install here: the platform
+  //    package unpacked its 146MB binary fine while the stub was still in place.
+  //    The platform package needs no script at all, so this path is the reliable
+  //    one.
+  //
+  //    Baseline variant second: upstream ships `-baseline` for x64 CPUs without
+  //    AVX2, so it is the correct fallback rather than an error.
+  for (const suffix of ['', '-baseline']) {
+    try {
+      const spec = `opencode-${platform}-${arch}${suffix}/package.json`
+      const p = requireResolve(spec)
+      out.push({
+        source: suffix ? STOCK_RUNTIME + ' (baseline)' : STOCK_RUNTIME,
+        path: path.join(path.dirname(p), 'bin', binary),
+      })
+    } catch {
+      // Not installed for this platform/arch; try the next shape.
+    }
+  }
+
+  //    Last stock shape: `opencode-ai`'s own bin, valid once its postinstall HAS
+  //    run. Kept so an install that did run scripts still resolves.
   try {
-    const p = requireResolve(`@elliotsystems/eai-${platform}-${arch}/package.json`)
-    out.push({ source: "platform package (optionalDependency)", path: path.join(path.dirname(p), "bin", binary) })
+    const p = requireResolve('opencode-ai/package.json')
+    out.push({ source: STOCK_RUNTIME + ' (via opencode-ai postinstall)', path: path.join(path.dirname(p), 'bin', 'opencode.exe') })
   } catch {
-    // Platform package not installed (e.g. running from a dev checkout).
+    // opencode-ai not installed.
   }
 
-  // 3. Bundled runtime — the shape a published/installed Elliot package will
-  //    have. Nothing populates this yet; packaging is a later, approved phase.
-  out.push({ source: "bundled vendor runtime", path: path.join(root, "vendor", dir, "bin", binary) })
+  // The fork's per-platform packages (@elliotsystems/eai-<os>-<arch>) and the
+  // `vendor/` directory used to sit here. Both shipped a fork-built OpenCode;
+  // the runtime now comes from upstream's own opencode-ai above, the packages
+  // are being retired on npm, and nothing populates `vendor/` since the script
+  // that did was removed. Kept as a note rather than dead branches so nobody
+  // re-adds them wondering why stock is the only source.
 
-  // 4. A configured fork location. Accepts either a checkout root or a dist
+  // 3. A configured fork location. Accepts either a checkout root or a dist
+  // 5. A configured fork location. Accepts either a checkout root or a dist
   //    root, because both are things a person reasonably points this at.
   if (env.ELLIOT_OPENCODE_HOME) {
     const home = env.ELLIOT_OPENCODE_HOME
@@ -75,7 +106,7 @@ function candidates(opts) {
     out.push({ source: "ELLIOT_OPENCODE_HOME (dist)", path: path.join(home, dir, "bin", binary) })
   }
 
-  // 5. Development convenience ONLY: the fork lives in this repo at `opencode/`
+  // 4. Development convenience ONLY: the fork lives in this repo at `opencode/`
   //    (subtree), so from the launcher package root that is one level up. Kept
   //    explicitly last before PATH so a dev build can never silently win over an
   //    override or a packaged runtime.
@@ -129,4 +160,5 @@ function resolveOpencodeBin(opts) {
   return null
 }
 
-module.exports = { DEV_FALLBACK, SIBLING_FALLBACK, candidates, isExplicitlyConfigured, platformTriple, resolveOpencodeBin }
+module.exports = {
+  STOCK_RUNTIME, DEV_FALLBACK, SIBLING_FALLBACK, candidates, isExplicitlyConfigured, platformTriple, resolveOpencodeBin }

package/lib/setup.js

@@ -0,0 +1,231 @@
+"use strict"
+
+/**
+ * `eai setup` — configure this machine against an Elliot backend.
+ *
+ * This is a port of `elliot-ai setup`, so that `eai` is the ONLY CLI a user has
+ * to install. Onboarding previously handed out two global installs plus a
+ * second binary whose entire job was writing two files; a user who ran only the
+ * first got a CLI with no backend and no token, and nothing said why.
+ *
+ * It writes exactly what the old command wrote, because the launcher and the
+ * TUI already read those files and neither should have to care which CLI
+ * produced them:
+ *
+ *   ~/.elliot/config.json          the org config plus the token the launcher
+ *                                  copies into ELLIOT_TOKEN on every run.
+ *                                  Mode 0600 in a 0700 directory: it holds a
+ *                                  bearer token and a refresh token.
+ *   ~/.config/opencode/opencode.json   the `elliot` provider, merged into
+ *                                  whatever else is already in that file.
+ *
+ * Two behaviours are deliberately preserved rather than simplified:
+ *
+ *  - The pasted browser token is EXCHANGED at `/auth/cli-token` for a
+ *    longer-lived credential with a refresh token. Storing the pasted token
+ *    directly would work for an hour and then start failing silently.
+ *  - The exchange is best-effort. If the endpoint is missing or errors, setup
+ *    continues with the pasted token and says so; a backend that predates the
+ *    endpoint should still be configurable.
+ */
+
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+const PROVIDER_ID = "elliot"
+const MODEL_ID = "elliot-governed"
+
+/** Matches OpenCode's own resolution (xdg-basedir, whose fallback is ~/.config everywhere). */
+function opencodeConfigDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config")
+  return path.join(base, "opencode")
+}
+
+function elliotConfigPath() {
+  return path.join(os.homedir(), ".elliot", "config.json")
+}
+
+/**
+ * Decode a JWT payload without verifying it.
+ *
+ * Verification is the backend's job — every token here is sent straight back to
+ * it and rejected if bad. This only reads `tenant_id` so setup can address the
+ * right config, so a malformed token must return undefined rather than throw.
+ */
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split(".")[1]
+    if (!part) return undefined
+    const padded = part.replace(/-/g, "+").replace(/_/g, "/")
+    const json = Buffer.from(padded + "=".repeat((4 - (padded.length % 4)) % 4), "base64").toString("utf8")
+    const parsed = JSON.parse(json)
+    return parsed && typeof parsed === "object" ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The `provider.elliot` block.
+ *
+ * `baseURL` ends in `/v1` on purpose: @ai-sdk/anthropic appends `/messages`,
+ * and the route is `/llm-proxy/v1/messages`. Dropping the `/v1` yields a 404.
+ *
+ * `apiKey` is the literal string `{env:ELLIOT_TOKEN}`, not the token. OpenCode
+ * substitutes it at config-load time and the launcher sets ELLIOT_TOKEN from
+ * ~/.elliot/config.json on every run, which keeps that file the single source
+ * of truth for an hourly-expiring credential — a refresh there is picked up
+ * without rewriting this one.
+ */
+function elliotProvider(backendUrl) {
+  const base = String(backendUrl).replace(/\/+$/, "")
+  return {
+    npm: "@ai-sdk/anthropic",
+    name: "Elliot (LightLLM proxy)",
+    options: { baseURL: `${base}/llm-proxy/v1`, apiKey: "{env:ELLIOT_TOKEN}" },
+    models: { [MODEL_ID]: { name: "Elliot Governed" } },
+  }
+}
+
+/**
+ * Merge the provider into the user's opencode.json, preserving every other key.
+ *
+ * `enabled_providers` pins OpenCode to this one provider: `eai` is
+ * governed-only, so there must be no direct-to-vendor path. `model` is only set
+ * when absent, so a user who picked a model keeps it.
+ */
+function writeOpencodeConfig(backendUrl, env = process.env) {
+  const dir = opencodeConfigDir(env)
+  const file = path.join(dir, "opencode.json")
+  let existing = {}
+  try {
+    existing = JSON.parse(fs.readFileSync(file, "utf8")) || {}
+  } catch {
+    // Absent or unparseable. Overwriting unparseable JSON is the lesser evil:
+    // OpenCode would refuse to start on it anyway.
+  }
+  const next = {
+    ...existing,
+    $schema: existing.$schema || "https://opencode.ai/config.json",
+    provider: { ...(existing.provider || {}), [PROVIDER_ID]: elliotProvider(backendUrl) },
+    enabled_providers: [PROVIDER_ID],
+    model: existing.model || `${PROVIDER_ID}/${MODEL_ID}`,
+  }
+  fs.mkdirSync(dir, { recursive: true })
+  fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n")
+  return file
+}
+
+/** Owner-only: this file holds a bearer token and a refresh token. */
+function writeElliotConfig(config) {
+  const file = elliotConfigPath()
+  const dir = path.dirname(file)
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  fs.writeFileSync(file, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 })
+  try {
+    fs.chmodSync(dir, 0o700)
+  } catch {
+    // Windows and some mounts do not honour POSIX modes; not worth failing over.
+  }
+  return file
+}
+
+async function exchangeForCliToken(backendUrl, token) {
+  try {
+    const res = await fetch(`${backendUrl}/auth/cli-token`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    })
+    if (!res.ok) return undefined
+    const body = await res.json()
+    if (!body || typeof body.access_token !== "string") return undefined
+    return {
+      access_token: body.access_token,
+      refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : undefined,
+      expires_at: typeof body.access_token_expires_at === "string" ? body.access_token_expires_at : undefined,
+    }
+  } catch {
+    // Offline, or a backend that predates the endpoint.
+    return undefined
+  }
+}
+
+async function fetchOnboardingConfig(backendUrl, tenantId, token) {
+  const res = await fetch(`${backendUrl}/onboarding/config/${tenantId}`, {
+    headers: { Authorization: `Bearer ${token}` },
+  })
+  if (!res.ok) {
+    throw new Error(`backend returned ${res.status} fetching the organisation config`)
+  }
+  return (await res.json()) || {}
+}
+
+/**
+ * @param {{token: string, backendUrl: string, tenantId?: string, log?: (s: string) => void}} opts
+ */
+async function runSetup(opts) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const backendUrl = String(opts.backendUrl || "").replace(/\/+$/, "")
+  if (!opts.token) throw new Error("a --token is required; copy the command from the Elliot portal")
+  if (!backendUrl) throw new Error("a --backend-url is required")
+
+  const claims = decodeJwtPayload(opts.token) || {}
+  const tenantId = opts.tenantId || claims.tenant_id
+  if (!tenantId) {
+    throw new Error("no tenant_id in the token; pass --tenant-id, or copy a fresh command from the portal")
+  }
+
+  const exchanged = await exchangeForCliToken(backendUrl, opts.token)
+  if (!exchanged) {
+    log("Note: could not exchange for a CLI token — continuing with the pasted token (silent refresh unavailable).")
+  }
+  const bearer = exchanged ? exchanged.access_token : opts.token
+
+  log("Fetching configuration from backend...")
+  const orgConfig = await fetchOnboardingConfig(backendUrl, tenantId, bearer)
+
+  const elliotConfig = {
+    ...orgConfig,
+    backend_url: orgConfig.backend_url || backendUrl,
+    tenant_id: tenantId,
+    jwt_token: bearer,
+    ...(exchanged && exchanged.refresh_token ? { refresh_token: exchanged.refresh_token } : {}),
+    ...(exchanged && exchanged.expires_at ? { access_token_expires_at: exchanged.expires_at } : {}),
+    configured_at: new Date().toISOString(),
+  }
+
+  const elliotFile = writeElliotConfig(elliotConfig)
+  const opencodeFile = writeOpencodeConfig(elliotConfig.backend_url)
+
+  log(`Wrote ${elliotFile}`)
+  log(`Wrote ${opencodeFile}`)
+  log("")
+  log("Setup complete. Run `eai` from any directory.")
+  return { elliotFile, opencodeFile, tenantId, exchanged: Boolean(exchanged) }
+}
+
+/** Minimal `--flag value` parsing; the launcher has no dependencies by design. */
+function parseArgs(argv) {
+  const out = {}
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === "--token") out.token = argv[++i]
+    else if (arg === "--backend-url") out.backendUrl = argv[++i]
+    else if (arg === "--tenant-id") out.tenantId = argv[++i]
+  }
+  return out
+}
+
+module.exports = {
+  runSetup,
+  parseArgs,
+  decodeJwtPayload,
+  elliotProvider,
+  writeOpencodeConfig,
+  writeElliotConfig,
+  opencodeConfigDir,
+  elliotConfigPath,
+  PROVIDER_ID,
+  MODEL_ID,
+}

package/lib/stage.js

@@ -0,0 +1,116 @@
+"use strict"
+
+/**
+ * Stage the Elliot overlay outside `node_modules` before launching.
+ *
+ * This exists because of a hard runtime constraint, found by installing the
+ * tarball and watching it fail: a plugin that lives under `node_modules` does
+ * not load. The same files, byte for byte, load fine one directory outside it.
+ * The runtime does not apply the plugin's own `tsconfig.json` — and therefore
+ * its `jsxImportSource` — to anything under `node_modules`, so the plugin's JSX
+ * never compiles. Nothing is logged: the TUI simply comes up as plain OpenCode,
+ * which is the failure mode that looks like success.
+ *
+ * So the tarball ships the overlay (it must be self-contained, since
+ * `@elliotsystems/opencode-plugin` is not published), and this copies it to a
+ * writable location outside `node_modules` on first run. That location doubles
+ * as `OPENCODE_CONFIG_DIR`, which also solves a second problem: the plugin's
+ * `api.theme.install()` writes into the config dir, and a global npm install
+ * directory is not reliably writable.
+ *
+ * The generated `tui.json` names the plugin by ABSOLUTE path. A relative one
+ * would resolve against the staged config file and work, but an absolute path
+ * is what makes a broken stage obvious instead of silently falling back to
+ * upstream's own chrome.
+ */
+
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+/**
+ * Where the staged overlay lives.
+ *
+ * Keyed by version so an upgrade stages fresh rather than reusing a stale tree,
+ * and so two installed versions cannot fight over one directory.
+ */
+function stageRoot(version, env = process.env) {
+  const base =
+    env.ELLIOT_STAGE_DIR ||
+    (process.platform === "win32" && env.LOCALAPPDATA
+      ? path.join(env.LOCALAPPDATA, "elliot", "eai")
+      : path.join(os.homedir(), ".elliot", "eai"))
+  return path.join(base, version)
+}
+
+function copyDir(from, to) {
+  fs.mkdirSync(to, { recursive: true })
+  for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+    // node_modules is deliberately not copied: the host supplies solid-js and
+    // @opentui/* to runtime-loaded plugins, and a second copy of solid-js in the
+    // TUI process would break reactivity across the slot boundary.
+    if (entry.name === "node_modules") continue
+    const src = path.join(from, entry.name)
+    const dst = path.join(to, entry.name)
+    if (entry.isDirectory()) copyDir(src, dst)
+    else fs.copyFileSync(src, dst)
+  }
+}
+
+/**
+ * Ensure the overlay is staged, and return the directory to use as
+ * OPENCODE_CONFIG_DIR. Returns undefined if staging is not possible, so the
+ * caller can still launch — an unbranded TUI beats no TUI.
+ */
+function stageOverlay(opts) {
+  const packageRoot = opts.packageRoot
+  const version = opts.version
+  const env = opts.env || process.env
+
+  const pluginSource = path.join(packageRoot, "plugin", "opencode-plugin")
+  const themeSource = path.join(packageRoot, "config", "themes")
+  if (!fs.existsSync(pluginSource)) return undefined
+
+  const root = stageRoot(version, env)
+  const marker = path.join(root, ".staged")
+  const pluginDir = path.join(root, "plugin", "opencode-plugin")
+
+  try {
+    // `.staged` records the version this tree was built from. Re-staging on
+    // every launch would add hundreds of file copies to startup.
+    const done = fs.existsSync(marker) && fs.readFileSync(marker, "utf8").trim() === version
+    if (!done) {
+      fs.rmSync(root, { recursive: true, force: true })
+      copyDir(pluginSource, pluginDir)
+      if (fs.existsSync(themeSource)) copyDir(themeSource, path.join(root, "themes"))
+
+      const plugin = [pluginDir]
+      fs.writeFileSync(
+        path.join(root, "tui.json"),
+        JSON.stringify(
+          {
+            $schema: "https://opencode.ai/tui.json",
+            theme: "elliot",
+            mouse: true,
+            plugin,
+            plugin_enabled: { "internal:home-tips": false },
+          },
+          null,
+          2,
+        ),
+      )
+      fs.writeFileSync(
+        path.join(root, "opencode.json"),
+        JSON.stringify({ $schema: "https://opencode.ai/config.json", plugin }, null, 2),
+      )
+      fs.writeFileSync(marker, version)
+    }
+    return root
+  } catch {
+    // Read-only home, exotic permissions, a racing install. Branding is worth
+    // less than starting up, so this is not fatal.
+    return undefined
+  }
+}
+
+module.exports = { stageOverlay, stageRoot }