@elliotsystems/eai 0.1.3 → 0.1.4

package/README.md

@@ -31,16 +31,11 @@ In precedence order (`lib/resolve.js`):
 | # | Source | Path |
 |---|---|---|
 | 1 | `ELLIOT_OPENCODE_BIN` | the binary itself |
-| 2 | **stock upstream runtime** | `opencode-ai/bin/opencode.exe`, resolved via `require.resolve` — **this is production** |
-| 3 | Elliot platform package | `@elliotsystems/eai-<os>-<arch>/bin/…` — fork builds, legacy, no longer a dependency |
-| 4 | bundled runtime | `vendor/opencode-<platform>-<arch>/bin/…` |
-| 5 | `ELLIOT_OPENCODE_HOME` | `<home>/packages/opencode/dist/…` or `<home>/opencode-<platform>-<arch>/…` |
-| 6 | in-repo fork checkout | `../opencode/…` — **development only** |
-| 7 | sibling fork checkout | `../../opencode/…` — **development only**, last resort |
-
-Stock sits ahead of the Elliot platform packages deliberately. Those are fork
-builds, and preferring them would quietly reintroduce the patched OpenCode this
-architecture exists to remove.
+| 2 | platform npm package | `@elliotsystems/eai-<platform>-<arch>/bin/opencode[.exe]`, via `require.resolve` -- **this is how an installed `eai` finds its runtime** |
+| 3 | bundled runtime | `vendor/opencode-<platform>-<arch>/bin/opencode[.exe]` |
+| 4 | `ELLIOT_OPENCODE_HOME` | `<home>/packages/opencode/dist/…` or `<home>/opencode-<platform>-<arch>/…` |
+| 5 | in-repo fork checkout | `../opencode/packages/opencode/dist/…` -- **development only** |
+| 6 | sibling fork checkout | `../../opencode/packages/opencode/dist/…` -- **development only**, last resort |
 
 Two deliberate rules:
 
@@ -67,6 +62,10 @@ CLI keeps working untouched and its retirement stays a separate, later decision.
 
 Run it locally, without installing, with `node bin/eai`.
 
+> This section previously said the package was `private: true` and that publishing
+> was out of scope. It has been published as `@elliotsystems/eai` since 0.1.0; the
+> note was left behind and is corrected here.
+
 ## Install
 
 ```
@@ -105,43 +104,3 @@ To publish a new release to npm:
 ```
 npm test        # node --test, no dependencies
 ```
-
-## Architecture
-
-```
-stock upstream OpenCode  (opencode-ai, an npm dependency)
-          |
-   Elliot launcher  (this package)
-     |-- config/            OPENCODE_CONFIG_DIR: theme + plugin registration
-     |-- config/themes/     the Elliot palette
-     |-- plugin/            the bundled Elliot plugin (wordmark, chrome)
-     +-- bin/eai            OSC 0 terminal title
-          |
-        eai  ->  Elliot-branded TUI
-```
-
-**OpenCode core modifications: 0.** Elliot ships no compiled OpenCode. An
-upstream upgrade is a version bump of `opencode-ai` in `package.json`.
-
-Three mechanisms carry the branding, none of which touch OpenCode source:
-
-| Surface | Mechanism |
-|---|---|
-| Wordmark, palette, accent, chrome | the bundled plugin, via `home_logo` (`mode="replace"`) and theme discovery |
-| Theme selection + plugin registration | `OPENCODE_CONFIG_DIR` -> this package's `config/` |
-| Terminal title | `OPENCODE_DISABLE_TERMINAL_TITLE=1`, then the launcher writes OSC 0 |
-
-### Why the plugin is bundled rather than depended on
-
-`@elliotsystems/opencode-plugin` is not published to npm. A config that named it
-by package name would install cleanly and then render as plain OpenCode, which
-is the worst failure mode available -- it looks like it worked. `scripts/bundle.js`
-copies it in from `opencode-plugin/` (the single source of truth) and runs from
-`prepack`, so `npm pack` and `npm publish` cannot forget it.
-
-### Why the theme file is shipped as well
-
-The plugin can install the palette itself via `api.theme.install()`, but that
-WRITES into the config directory, and a global npm install directory is not
-reliably writable. Shipping `config/themes/elliot.json` means the theme resolves
-read-only.

package/bin/eai

@@ -26,6 +26,7 @@ const {
 } = require("../lib/resolve.js")
 const { injectToken } = require("../lib/token-env.js")
 const { stageOverlay } = require("../lib/stage.js")
+const { runSetup, parseArgs } = require("../lib/setup.js")
 
 /**
  * Resolve symlinks before deriving the package root.
@@ -63,6 +64,26 @@ function fail(message) {
   process.exit(127) // conventional "command not found"
 }
 
+// `eai setup` is handled here and never reaches the runtime.
+//
+// It is intercepted BEFORE the runtime is resolved, because setup is what a
+// machine runs when nothing is configured yet -- failing with "could not locate
+// the OpenCode runtime" would be a confusing way to refuse to configure it.
+// `setup` is not an OpenCode command, so nothing is shadowed.
+//
+// This exists so `eai` is the only CLI to install. Onboarding used to hand out
+// a second global package whose whole job was writing two config files, and a
+// user who ran only the first install got a CLI with no backend and no token.
+if (process.argv[2] === "setup") {
+  const options = parseArgs(process.argv.slice(3))
+  runSetup(options).catch((error) => {
+    process.stderr.write(`eai setup: ${error.message}
+`)
+    process.exit(1)
+  })
+  return
+}
+
 const resolved = resolveOpencodeBin({ packageRoot: PACKAGE_ROOT })
 
 if (!resolved) {

package/lib/resolve.js

@@ -87,20 +87,14 @@ function candidates(opts) {
     // opencode-ai not installed.
   }
 
-  // 3. Per-platform npm optionalDependency package — the shape a published,
-  //    `npm install`-ed `@elliotsystems/eai` gets its runtime from. Resolved via
-  //    `require.resolve` so it works no matter where npm hoisted node_modules.
-  try {
-    const p = requireResolve(`@elliotsystems/eai-${platform}-${arch}/package.json`)
-    out.push({ source: "platform package (optionalDependency)", path: path.join(path.dirname(p), "bin", binary) })
-  } catch {
-    // Platform package not installed (e.g. running from a dev checkout).
-  }
-
-  // 4. Bundled runtime — the shape a published/installed Elliot package will
-  //    have. Nothing populates this yet; packaging is a later, approved phase.
-  out.push({ source: "bundled vendor runtime", path: path.join(root, "vendor", dir, "bin", binary) })
-
+  // The fork's per-platform packages (@elliotsystems/eai-<os>-<arch>) and the
+  // `vendor/` directory used to sit here. Both shipped a fork-built OpenCode;
+  // the runtime now comes from upstream's own opencode-ai above, the packages
+  // are being retired on npm, and nothing populates `vendor/` since the script
+  // that did was removed. Kept as a note rather than dead branches so nobody
+  // re-adds them wondering why stock is the only source.
+
+  // 3. A configured fork location. Accepts either a checkout root or a dist
   // 5. A configured fork location. Accepts either a checkout root or a dist
   //    root, because both are things a person reasonably points this at.
   if (env.ELLIOT_OPENCODE_HOME) {
@@ -112,7 +106,7 @@ function candidates(opts) {
     out.push({ source: "ELLIOT_OPENCODE_HOME (dist)", path: path.join(home, dir, "bin", binary) })
   }
 
-  // 5. Development convenience ONLY: the fork lives in this repo at `opencode/`
+  // 4. Development convenience ONLY: the fork lives in this repo at `opencode/`
   //    (subtree), so from the launcher package root that is one level up. Kept
   //    explicitly last before PATH so a dev build can never silently win over an
   //    override or a packaged runtime.

package/lib/setup.js

@@ -0,0 +1,231 @@
+"use strict"
+
+/**
+ * `eai setup` — configure this machine against an Elliot backend.
+ *
+ * This is a port of `elliot-ai setup`, so that `eai` is the ONLY CLI a user has
+ * to install. Onboarding previously handed out two global installs plus a
+ * second binary whose entire job was writing two files; a user who ran only the
+ * first got a CLI with no backend and no token, and nothing said why.
+ *
+ * It writes exactly what the old command wrote, because the launcher and the
+ * TUI already read those files and neither should have to care which CLI
+ * produced them:
+ *
+ *   ~/.elliot/config.json          the org config plus the token the launcher
+ *                                  copies into ELLIOT_TOKEN on every run.
+ *                                  Mode 0600 in a 0700 directory: it holds a
+ *                                  bearer token and a refresh token.
+ *   ~/.config/opencode/opencode.json   the `elliot` provider, merged into
+ *                                  whatever else is already in that file.
+ *
+ * Two behaviours are deliberately preserved rather than simplified:
+ *
+ *  - The pasted browser token is EXCHANGED at `/auth/cli-token` for a
+ *    longer-lived credential with a refresh token. Storing the pasted token
+ *    directly would work for an hour and then start failing silently.
+ *  - The exchange is best-effort. If the endpoint is missing or errors, setup
+ *    continues with the pasted token and says so; a backend that predates the
+ *    endpoint should still be configurable.
+ */
+
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+const PROVIDER_ID = "elliot"
+const MODEL_ID = "elliot-governed"
+
+/** Matches OpenCode's own resolution (xdg-basedir, whose fallback is ~/.config everywhere). */
+function opencodeConfigDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config")
+  return path.join(base, "opencode")
+}
+
+function elliotConfigPath() {
+  return path.join(os.homedir(), ".elliot", "config.json")
+}
+
+/**
+ * Decode a JWT payload without verifying it.
+ *
+ * Verification is the backend's job — every token here is sent straight back to
+ * it and rejected if bad. This only reads `tenant_id` so setup can address the
+ * right config, so a malformed token must return undefined rather than throw.
+ */
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split(".")[1]
+    if (!part) return undefined
+    const padded = part.replace(/-/g, "+").replace(/_/g, "/")
+    const json = Buffer.from(padded + "=".repeat((4 - (padded.length % 4)) % 4), "base64").toString("utf8")
+    const parsed = JSON.parse(json)
+    return parsed && typeof parsed === "object" ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The `provider.elliot` block.
+ *
+ * `baseURL` ends in `/v1` on purpose: @ai-sdk/anthropic appends `/messages`,
+ * and the route is `/llm-proxy/v1/messages`. Dropping the `/v1` yields a 404.
+ *
+ * `apiKey` is the literal string `{env:ELLIOT_TOKEN}`, not the token. OpenCode
+ * substitutes it at config-load time and the launcher sets ELLIOT_TOKEN from
+ * ~/.elliot/config.json on every run, which keeps that file the single source
+ * of truth for an hourly-expiring credential — a refresh there is picked up
+ * without rewriting this one.
+ */
+function elliotProvider(backendUrl) {
+  const base = String(backendUrl).replace(/\/+$/, "")
+  return {
+    npm: "@ai-sdk/anthropic",
+    name: "Elliot (LightLLM proxy)",
+    options: { baseURL: `${base}/llm-proxy/v1`, apiKey: "{env:ELLIOT_TOKEN}" },
+    models: { [MODEL_ID]: { name: "Elliot Governed" } },
+  }
+}
+
+/**
+ * Merge the provider into the user's opencode.json, preserving every other key.
+ *
+ * `enabled_providers` pins OpenCode to this one provider: `eai` is
+ * governed-only, so there must be no direct-to-vendor path. `model` is only set
+ * when absent, so a user who picked a model keeps it.
+ */
+function writeOpencodeConfig(backendUrl, env = process.env) {
+  const dir = opencodeConfigDir(env)
+  const file = path.join(dir, "opencode.json")
+  let existing = {}
+  try {
+    existing = JSON.parse(fs.readFileSync(file, "utf8")) || {}
+  } catch {
+    // Absent or unparseable. Overwriting unparseable JSON is the lesser evil:
+    // OpenCode would refuse to start on it anyway.
+  }
+  const next = {
+    ...existing,
+    $schema: existing.$schema || "https://opencode.ai/config.json",
+    provider: { ...(existing.provider || {}), [PROVIDER_ID]: elliotProvider(backendUrl) },
+    enabled_providers: [PROVIDER_ID],
+    model: existing.model || `${PROVIDER_ID}/${MODEL_ID}`,
+  }
+  fs.mkdirSync(dir, { recursive: true })
+  fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n")
+  return file
+}
+
+/** Owner-only: this file holds a bearer token and a refresh token. */
+function writeElliotConfig(config) {
+  const file = elliotConfigPath()
+  const dir = path.dirname(file)
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  fs.writeFileSync(file, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 })
+  try {
+    fs.chmodSync(dir, 0o700)
+  } catch {
+    // Windows and some mounts do not honour POSIX modes; not worth failing over.
+  }
+  return file
+}
+
+async function exchangeForCliToken(backendUrl, token) {
+  try {
+    const res = await fetch(`${backendUrl}/auth/cli-token`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    })
+    if (!res.ok) return undefined
+    const body = await res.json()
+    if (!body || typeof body.access_token !== "string") return undefined
+    return {
+      access_token: body.access_token,
+      refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : undefined,
+      expires_at: typeof body.access_token_expires_at === "string" ? body.access_token_expires_at : undefined,
+    }
+  } catch {
+    // Offline, or a backend that predates the endpoint.
+    return undefined
+  }
+}
+
+async function fetchOnboardingConfig(backendUrl, tenantId, token) {
+  const res = await fetch(`${backendUrl}/onboarding/config/${tenantId}`, {
+    headers: { Authorization: `Bearer ${token}` },
+  })
+  if (!res.ok) {
+    throw new Error(`backend returned ${res.status} fetching the organisation config`)
+  }
+  return (await res.json()) || {}
+}
+
+/**
+ * @param {{token: string, backendUrl: string, tenantId?: string, log?: (s: string) => void}} opts
+ */
+async function runSetup(opts) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const backendUrl = String(opts.backendUrl || "").replace(/\/+$/, "")
+  if (!opts.token) throw new Error("a --token is required; copy the command from the Elliot portal")
+  if (!backendUrl) throw new Error("a --backend-url is required")
+
+  const claims = decodeJwtPayload(opts.token) || {}
+  const tenantId = opts.tenantId || claims.tenant_id
+  if (!tenantId) {
+    throw new Error("no tenant_id in the token; pass --tenant-id, or copy a fresh command from the portal")
+  }
+
+  const exchanged = await exchangeForCliToken(backendUrl, opts.token)
+  if (!exchanged) {
+    log("Note: could not exchange for a CLI token — continuing with the pasted token (silent refresh unavailable).")
+  }
+  const bearer = exchanged ? exchanged.access_token : opts.token
+
+  log("Fetching configuration from backend...")
+  const orgConfig = await fetchOnboardingConfig(backendUrl, tenantId, bearer)
+
+  const elliotConfig = {
+    ...orgConfig,
+    backend_url: orgConfig.backend_url || backendUrl,
+    tenant_id: tenantId,
+    jwt_token: bearer,
+    ...(exchanged && exchanged.refresh_token ? { refresh_token: exchanged.refresh_token } : {}),
+    ...(exchanged && exchanged.expires_at ? { access_token_expires_at: exchanged.expires_at } : {}),
+    configured_at: new Date().toISOString(),
+  }
+
+  const elliotFile = writeElliotConfig(elliotConfig)
+  const opencodeFile = writeOpencodeConfig(elliotConfig.backend_url)
+
+  log(`Wrote ${elliotFile}`)
+  log(`Wrote ${opencodeFile}`)
+  log("")
+  log("Setup complete. Run `eai` from any directory.")
+  return { elliotFile, opencodeFile, tenantId, exchanged: Boolean(exchanged) }
+}
+
+/** Minimal `--flag value` parsing; the launcher has no dependencies by design. */
+function parseArgs(argv) {
+  const out = {}
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === "--token") out.token = argv[++i]
+    else if (arg === "--backend-url") out.backendUrl = argv[++i]
+    else if (arg === "--tenant-id") out.tenantId = argv[++i]
+  }
+  return out
+}
+
+module.exports = {
+  runSetup,
+  parseArgs,
+  decodeJwtPayload,
+  elliotProvider,
+  writeOpencodeConfig,
+  writeElliotConfig,
+  opencodeConfigDir,
+  elliotConfigPath,
+  PROVIDER_ID,
+  MODEL_ID,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elliotsystems/eai",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Elliot AI CLI entry point (eai) - launches the Elliot runtime with arguments forwarded verbatim.",
   "bin": {
     "eai": "./bin/eai"
@@ -14,10 +14,7 @@
   ],
   "scripts": {
     "test": "node --test test/*.test.js",
-    "vendor": "node scripts/vendor.js",
-    "assemble": "node scripts/assemble.js",
     "publish:npm": "node scripts/publish.js",
-    "build:runtime": "bun run --cwd ../opencode/packages/opencode script/build.ts --skip-embed-web-ui",
     "bundle": "node scripts/bundle.js",
     "prepack": "node scripts/bundle.js",
     "verify": "node scripts/verify-package.js"

package/plugin/opencode-plugin/src/identity.ts

@@ -0,0 +1,69 @@
+/**
+ * Make the agent call itself Elliot-AI.
+ *
+ * The visual layer was branded long before this: wordmark, palette, terminal
+ * title. But the agent's own sense of identity lives in the system prompt, and
+ * on a stock runtime that prompt opens with "You are OpenCode, ...". So asking
+ * the CLI "who are you?" got "I'm opencode" — every surface said Elliot except
+ * the one the user actually talks to.
+ *
+ * Fixed here rather than in the prompt files, because those are compiled into
+ * the stock upstream binary and patching them would put Elliot back inside
+ * OpenCode. `experimental.chat.system.transform` is upstream's own hook for
+ * exactly this (`packages/plugin/src/index.ts`), fired from both
+ * `agent/agent.ts` and `session/llm/request.ts`, so the fix stays in the
+ * overlay and survives an upstream upgrade.
+ */
+
+/** The product name the assistant should use for itself. */
+export const PRODUCT_NAME = "Elliot-AI"
+
+/**
+ * Matches ONLY the identity clause that opens a system prompt.
+ *
+ * Anchored to the start and requiring the following comma, because the prompts
+ * also contain `https://opencode.ai/docs` and
+ * `https://github.com/anomalyco/opencode`. Those are real upstream links: a
+ * blanket rename would silently turn working URLs into 404s, and would also
+ * corrupt references to `opencode.json` and `.opencode/` that the tool guidance
+ * depends on. Eight identity variants exist across the prompt files (`You are
+ * OpenCode,` / `You are opencode,`), and all of them share this shape.
+ */
+const IDENTITY = /^You are opencode,/i
+
+/**
+ * Prepended so the model can answer "what is your name" and "who made you"
+ * without inferring it from a rewritten sentence halfway down a long prompt.
+ *
+ * It states only what is true. The underlying model is deliberately not named:
+ * that is a provider detail that changes, and guessing it is how an assistant
+ * ends up confidently telling a customer something wrong.
+ */
+const IDENTITY_PREAMBLE = [
+  `You are ${PRODUCT_NAME}, the coding agent made by Elliot Systems.`,
+  `When asked who or what you are, say you are ${PRODUCT_NAME} by Elliot Systems.`,
+  `Never refer to yourself as OpenCode.`,
+  `OpenCode is the open-source harness you run on, not your identity. If a user`,
+  `asks directly what you are built on, you may say you are built on OpenCode.`,
+].join(" ")
+
+/**
+ * Rewrite the system prompt in place.
+ *
+ * Idempotent: re-running leaves the result unchanged, which matters because the
+ * hook fires per request and on a long session would otherwise stack the
+ * preamble dozens of times and eat the context window.
+ */
+export function applyElliotIdentity(system: string[]): string[] {
+  if (system.some((entry) => entry.startsWith(IDENTITY_PREAMBLE))) return system
+
+  for (let i = 0; i < system.length; i++) {
+    const entry = system[i]
+    if (typeof entry === "string" && IDENTITY.test(entry)) {
+      system[i] = entry.replace(IDENTITY, `You are ${PRODUCT_NAME},`)
+    }
+  }
+
+  system.unshift(IDENTITY_PREAMBLE)
+  return system
+}

package/plugin/opencode-plugin/src/index.ts

@@ -23,6 +23,7 @@ import { isElliotKnowledgeTool, parseOptions, shellVerdict } from "./policy.js"
 import { ELLIOT_PROVIDER_ID, configHook, makeAuthHook } from "./proxy-provider.js"
 import { readElliotConfig } from "./elliot-auth.js"
 import { formatScope, scopeForWorktree } from "./scope.js"
+import { applyElliotIdentity } from "./identity.js"
 
 // Structural mirrors of the host types (packages/plugin/src/index.ts @
 // v1.18.19). Declared locally so this package type-checks and unit-tests
@@ -66,6 +67,10 @@ export interface Hooks {
     input: PermissionInput,
     output: { status: "ask" | "deny" | "allow" },
   ) => Promise<void>
+  "experimental.chat.system.transform"?: (
+    input: { sessionID?: string; model: unknown },
+    output: { system: string[] },
+  ) => Promise<void>
   config?: (input: any) => Promise<void>
   auth?: AuthHook
   dispose?: () => Promise<void>
@@ -165,6 +170,13 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
      * thrown tool error — so this is the forward-compatible home. It can only ever
      * tighten.
      */
+    // The agent introduces itself as OpenCode on a stock runtime, because that
+    // is what the compiled system prompt says. Rewritten here so the fix lives
+    // in the overlay instead of in the harness. See ./identity.ts.
+    "experimental.chat.system.transform": async (_hookInput, output) => {
+      applyElliotIdentity(output.system)
+    },
+
     "permission.ask": async (permInput, output) => {
       if (permInput.type !== "bash") return
       const command = permInput.metadata?.["command"]