@elliotsystems/eai 0.1.3 → 0.1.5

package/plugin/opencode-plugin/src/elliot-auth.ts

@@ -1,27 +1,70 @@
 /**
- * Elliot token read + refresh — the credential half of the proxy provider.
+ * Reads `~/.elliot/config.json` — written by `eai setup`/`elliot-ai setup`.
  *
- * Ported (trimmed, not imported) from `elliot-cli/src/auth/refresh.ts` and
- * `elliot-cli/src/config.ts`: same `~/.elliot/config.json` shape, same
- * refresh endpoint contract (`POST {backend_url}/auth/refresh` ->
- * `{access_token, expires_in_seconds}`), same "never throw" discipline. This
- * file exists inside `opencode-plugin` rather than importing the CLI package
- * because the plugin ships and is loaded independently of `elliot-cli` — see
- * `docs/superpowers/plans/2026-09-03-eai-proxy-auth.md`.
+ * Used two ways: `readElliotConfig() !== null` is "is the user logged in at
+ * all" (the proxy-provider config hook is a no-op otherwise); and its
+ * `litellm_base_url`/`litellm_master_key` fields are the LLM provider's
+ * connection info directly.
  *
- * `freshToken` is the only export the proxy provider's `auth.loader`/`fetch`
- * needs: it never throws, so a stale/missing/corrupt config degrades to "no
- * token" (the proxy 401s) rather than crashing OpenCode's model call.
+ * Formerly also home to `freshToken`/`isExpired` — a self-refreshing JWT
+ * mechanism for the per-instance credential `/llm-proxy` used to validate.
+ * Removed along with `/llm-proxy`: the LiteLLM gateway this now points at
+ * authenticates with ONE static, shared `litellm_master_key` (LiteLLM is
+ * deliberately DB-less — no per-tenant/per-instance credential is possible
+ * without one), which never expires and so never needs refreshing.
  */
 import * as fs from "node:fs"
 import * as os from "node:os"
 import * as path from "node:path"
 
+/**
+ * One LiteLLM credential this person can use from OpenCode — their own
+ * personal key, or a team's shared key (Phase 4, docs/LITELLM_GATEWAY.md
+ * §14 / PRD PO-4/4.3/4.4). `provider_id` is the OpenCode provider id
+ * `configHook` registers it under directly (e.g. `elliot` for the personal
+ * default, `elliot-team-<slug>` per team) — computed backend-side
+ * (`onboarding.py`), not derived here, so naming stays in one place.
+ */
+export interface ElliotCredential {
+  provider_id: string
+  /** Shown in OpenCode's own model picker, e.g. "Elliot (Personal)" or
+   *  "Elliot — Team Platform". */
+  label: string
+  api_key: string
+  /** Present for a team credential, absent for the personal one. */
+  team_id?: string
+  /**
+   * This credential's own team's Phase 4 model restriction
+   * (docs/LITELLM_GATEWAY.md §14), or absent/null for unrestricted — always
+   * absent on the personal credential, which has no team and so no
+   * restriction concept. LiteLLM gateway audit finding #5: each provider
+   * `configHook` registers must be filtered by ITS OWN credential's
+   * restriction, not a shared list — a user on both a restricted and an
+   * unrestricted team must not have one leak into the other.
+   */
+  allowed_models?: string[] | null
+}
+
 export interface ElliotConfig {
   jwt_token?: string
-  refresh_token?: string
   backend_url?: string
-  access_token_expires_at?: string
+  litellm_base_url?: string
+  litellm_master_key?: string
+  /**
+   * Every credential this person can use, personal key first (Phase 4).
+   * Absent on a config written by an older `eai setup` (or a backend that
+   * predates this field) — `configHook` falls back to the single
+   * `litellm_master_key` provider in that case, so an old config keeps
+   * working unchanged rather than losing LLM access outright.
+   */
+  credentials?: ElliotCredential[]
+  /**
+   * The single scoped team's own Phase 4 model restriction, when
+   * `credentials` is absent and the legacy `litellm_master_key` fallback
+   * provider is registered instead — same field, same meaning as
+   * `ElliotCredential.allowed_models`, just for the one-provider path.
+   */
+  allowed_models?: string[] | null
   [k: string]: unknown
 }
 
@@ -40,94 +83,3 @@ export function readElliotConfig(): ElliotConfig | null {
     return null
   }
 }
-
-/**
- * Persist the config, owner-only (0600) — this file holds a live bearer
- * token. Creates `~/.elliot` (0700) if it doesn't exist yet.
- */
-export function writeElliotConfig(cfg: ElliotConfig): void {
-  const configPath = elliotConfigPath()
-  const configDir = path.dirname(configPath)
-  if (!fs.existsSync(configDir)) {
-    fs.mkdirSync(configDir, { recursive: true, mode: 0o700 })
-  }
-  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2), { mode: 0o600 })
-  fs.chmodSync(configPath, 0o600)
-}
-
-/** `exp` (seconds since epoch) from a JWT's middle segment, or null. */
-function decodeJwtExp(token: string): number | null {
-  try {
-    const parts = token.split(".")
-    if (parts.length < 2) return null
-    const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"))
-    return typeof payload?.exp === "number" ? payload.exp : null
-  } catch {
-    return null
-  }
-}
-
-const REFRESH_SKEW_MS = 60_000
-
-/**
- * True if the access token is expired or within `REFRESH_SKEW_MS` of
- * expiring. Prefers the stored `access_token_expires_at`; falls back to
- * decoding `jwt_token`'s `exp` claim; true (treat as expired -> refresh) when
- * neither is decodable.
- */
-export function isExpired(cfg: ElliotConfig, nowMs = Date.now()): boolean {
-  if (cfg.access_token_expires_at) {
-    const expiresAtMs = new Date(cfg.access_token_expires_at).getTime()
-    if (Number.isFinite(expiresAtMs)) {
-      return expiresAtMs - REFRESH_SKEW_MS <= nowMs
-    }
-  }
-  const exp = cfg.jwt_token ? decodeJwtExp(cfg.jwt_token) : null
-  if (exp === null) return true
-  return exp * 1000 - REFRESH_SKEW_MS <= nowMs
-}
-
-interface RefreshResponse {
-  access_token: string
-  expires_in_seconds: number
-}
-
-interface FreshTokenDeps {
-  fetchImpl?: typeof fetch
-  write?: (cfg: ElliotConfig) => void
-}
-
-/**
- * A valid access token, refreshing + persisting when expired and a
- * `refresh_token`/`backend_url` are present. NEVER throws: any failure
- * (network, non-2xx, malformed response) falls back to the existing
- * `jwt_token` — the proxy 401s on a stale token rather than this crashing the
- * model call.
- */
-export async function freshToken(
-  cfg: ElliotConfig,
-  deps?: FreshTokenDeps,
-): Promise<string | null> {
-  try {
-    if (cfg.jwt_token && !isExpired(cfg)) return cfg.jwt_token
-    if (!cfg.refresh_token || !cfg.backend_url) return cfg.jwt_token ?? null
-
-    const fetchImpl = deps?.fetchImpl ?? fetch
-    const write = deps?.write ?? writeElliotConfig
-
-    const response = await fetchImpl(`${cfg.backend_url}/auth/refresh`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refresh_token: cfg.refresh_token }),
-    })
-    if (!response.ok) return cfg.jwt_token ?? null
-
-    const data = (await response.json()) as RefreshResponse
-    cfg.jwt_token = data.access_token
-    cfg.access_token_expires_at = new Date(Date.now() + data.expires_in_seconds * 1000).toISOString()
-    write(cfg)
-    return data.access_token
-  } catch {
-    return cfg.jwt_token ?? null
-  }
-}

package/plugin/opencode-plugin/src/identity.ts

@@ -0,0 +1,69 @@
+/**
+ * Make the agent call itself Elliot-AI.
+ *
+ * The visual layer was branded long before this: wordmark, palette, terminal
+ * title. But the agent's own sense of identity lives in the system prompt, and
+ * on a stock runtime that prompt opens with "You are OpenCode, ...". So asking
+ * the CLI "who are you?" got "I'm opencode" — every surface said Elliot except
+ * the one the user actually talks to.
+ *
+ * Fixed here rather than in the prompt files, because those are compiled into
+ * the stock upstream binary and patching them would put Elliot back inside
+ * OpenCode. `experimental.chat.system.transform` is upstream's own hook for
+ * exactly this (`packages/plugin/src/index.ts`), fired from both
+ * `agent/agent.ts` and `session/llm/request.ts`, so the fix stays in the
+ * overlay and survives an upstream upgrade.
+ */
+
+/** The product name the assistant should use for itself. */
+export const PRODUCT_NAME = "Elliot-AI"
+
+/**
+ * Matches ONLY the identity clause that opens a system prompt.
+ *
+ * Anchored to the start and requiring the following comma, because the prompts
+ * also contain `https://opencode.ai/docs` and
+ * `https://github.com/anomalyco/opencode`. Those are real upstream links: a
+ * blanket rename would silently turn working URLs into 404s, and would also
+ * corrupt references to `opencode.json` and `.opencode/` that the tool guidance
+ * depends on. Eight identity variants exist across the prompt files (`You are
+ * OpenCode,` / `You are opencode,`), and all of them share this shape.
+ */
+const IDENTITY = /^You are opencode,/i
+
+/**
+ * Prepended so the model can answer "what is your name" and "who made you"
+ * without inferring it from a rewritten sentence halfway down a long prompt.
+ *
+ * It states only what is true. The underlying model is deliberately not named:
+ * that is a provider detail that changes, and guessing it is how an assistant
+ * ends up confidently telling a customer something wrong.
+ */
+const IDENTITY_PREAMBLE = [
+  `You are ${PRODUCT_NAME}, the coding agent made by Elliot Systems.`,
+  `When asked who or what you are, say you are ${PRODUCT_NAME} by Elliot Systems.`,
+  `Never refer to yourself as OpenCode.`,
+  `OpenCode is the open-source harness you run on, not your identity. If a user`,
+  `asks directly what you are built on, you may say you are built on OpenCode.`,
+].join(" ")
+
+/**
+ * Rewrite the system prompt in place.
+ *
+ * Idempotent: re-running leaves the result unchanged, which matters because the
+ * hook fires per request and on a long session would otherwise stack the
+ * preamble dozens of times and eat the context window.
+ */
+export function applyElliotIdentity(system: string[]): string[] {
+  if (system.some((entry) => entry.startsWith(IDENTITY_PREAMBLE))) return system
+
+  for (let i = 0; i < system.length; i++) {
+    const entry = system[i]
+    if (typeof entry === "string" && IDENTITY.test(entry)) {
+      system[i] = entry.replace(IDENTITY, `You are ${PRODUCT_NAME},`)
+    }
+  }
+
+  system.unshift(IDENTITY_PREAMBLE)
+  return system
+}

package/plugin/opencode-plugin/src/index.ts

@@ -20,9 +20,9 @@
  * `.opencode/plugin/` file re-export.
  */
 import { isElliotKnowledgeTool, parseOptions, shellVerdict } from "./policy.js"
-import { ELLIOT_PROVIDER_ID, configHook, makeAuthHook } from "./proxy-provider.js"
-import { readElliotConfig } from "./elliot-auth.js"
+import { configHook } from "./proxy-provider.js"
 import { formatScope, scopeForWorktree } from "./scope.js"
+import { applyElliotIdentity } from "./identity.js"
 
 // Structural mirrors of the host types (packages/plugin/src/index.ts @
 // v1.18.19). Declared locally so this package type-checks and unit-tests
@@ -66,6 +66,10 @@ export interface Hooks {
     input: PermissionInput,
     output: { status: "ask" | "deny" | "allow" },
   ) => Promise<void>
+  "experimental.chat.system.transform"?: (
+    input: { sessionID?: string; model: unknown },
+    output: { system: string[] },
+  ) => Promise<void>
   config?: (input: any) => Promise<void>
   auth?: AuthHook
   dispose?: () => Promise<void>
@@ -82,25 +86,6 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
   // the one source the model cannot influence.
   const worktree = input.worktree || input.directory
 
-  // Seed a placeholder auth entry for the `elliot` provider so the host's
-  // auth loader fires at all (`provider.ts:1584` skips the loader entirely
-  // when nothing is stored for its provider id — see Task-1 findings). The
-  // value itself is never the credential that reaches the wire; the auth
-  // loader's `fetch` attaches the live bearer token per request. Guarded so
-  // a client-RPC failure never breaks plugin init, and skipped outright when
-  // the user isn't logged into Elliot.
-  if (readElliotConfig()) {
-    try {
-      await input.client?.auth?.set({
-        path: { id: ELLIOT_PROVIDER_ID },
-        body: { type: "api", key: "elliot-managed" },
-      })
-    } catch {
-      // Never break plugin init on a seeding failure — the auth loader
-      // simply won't fire this session, same as the no-login path.
-    }
-  }
-
   return {
     /**
      * One handler, two jobs — a JS object literal may carry only one
@@ -165,6 +150,13 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
      * thrown tool error — so this is the forward-compatible home. It can only ever
      * tighten.
      */
+    // The agent introduces itself as OpenCode on a stock runtime, because that
+    // is what the compiled system prompt says. Rewritten here so the fix lives
+    // in the overlay instead of in the harness. See ./identity.ts.
+    "experimental.chat.system.transform": async (_hookInput, output) => {
+      applyElliotIdentity(output.system)
+    },
+
     "permission.ask": async (permInput, output) => {
       if (permInput.type !== "bash") return
       const command = permInput.metadata?.["command"]
@@ -183,13 +175,6 @@ export const ElliotPlugin: Plugin = async (input, rawOptions) => {
     config: async (c) => {
       configHook(c)
     },
-
-    /**
-     * Self-refreshing auth loader for the `elliot` provider — see
-     * `proxy-provider.ts`. Only fires once the seeding above has stored an
-     * auth entry for `ELLIOT_PROVIDER_ID`.
-     */
-    auth: makeAuthHook(),
   }
 }
 

package/plugin/opencode-plugin/src/mcp-keys.ts

@@ -24,7 +24,134 @@ export function sanitizeKey(value: string): string {
 /** The backend tool behind every Elliot knowledge lookup. */
 export const KNOWLEDGE_TOOL = "knowledge_search"
 
-/** The agent-visible key for `KNOWLEDGE_TOOL` on a given MCP server. */
+/** The agent-visible key for `KNOWLEDGE_TOOL` on a given MCP server.
+ *
+ * Still the PRE-GATEWAY spelling, and still correct for a runtime wired
+ * straight to Elliot. It is no longer the only spelling that arrives — see
+ * `toCanonicalTool`.
+ */
 export function knowledgeToolKey(serverName: string): string {
   return `${sanitizeKey(serverName)}_${KNOWLEDGE_TOOL}`
 }
+
+/**
+ * LiteLLM joins its server alias to the tool name with a HYPHEN; OpenCode
+ * joins its own server key with an UNDERSCORE. Both appear in one wire name
+ * and they are not interchangeable.
+ *
+ * The SEPARATOR is LiteLLM's composition rule and is fixed. The ALIAS is
+ * configuration — it is the `mcp_servers` key in `deploy/litellm/config.yaml`
+ * — and this module no longer owns a copy of it. It used to:
+ *
+ *     export const GATEWAY_SERVER_ALIAS = "elliot"
+ *
+ * restated from the backend and "kept in step by a test". That is four copies
+ * of one literal across two languages, and the failure when they diverge is
+ * silent: an unrecognised tool name is one whose repo scope is never injected,
+ * so the agent answers tenant-wide and says nothing about it.
+ *
+ * The alias now arrives as a plugin option, served by the backend from
+ * `litellm_mcp_server_alias` (`routers/well_known.py`).
+ */
+const GATEWAY_SEPARATOR = "-"
+
+/**
+ * The canonical Elliot tool name behind an agent-visible key.
+ *
+ * Runtime traffic now reaches Elliot through LiteLLM's MCP gateway, and each
+ * hop adds its own namespace. All four spellings below are real, depending on
+ * whether the runtime is behind the gateway and how the host composed the key:
+ *
+ *     elliot_elliot-knowledge_search   OpenCode prefix + gateway prefix
+ *     elliot-knowledge_search          gateway prefix only
+ *     elliot_knowledge_search          OpenCode prefix only (pre-gateway)
+ *     knowledge_search                 bare/canonical
+ *
+ * Stripping is DETERMINISTIC and bounded: at most one server prefix, then at
+ * most one gateway prefix, each only from the front. Never a suffix or
+ * substring match — that is what stops a server called `not-elliot` from
+ * collecting scope hints meant for ours, and it is why the configured server
+ * names are required rather than inferred.
+ *
+ * Idempotent: feeding a canonical name back in returns it unchanged.
+ */
+/**
+ * The canonical tool name when the gateway alias is NOT knowable.
+ *
+ * For the TUI only. The TUI plugin entry (`tui: TuiPlugin = async (api)`)
+ * receives no options — the host hands it a UI api and nothing else — so it
+ * cannot be told the configured alias, and inventing a config channel for a
+ * sidebar would be a worse answer than this one.
+ *
+ * So it matches on STRUCTURE rather than on a specific alias: strip one
+ * configured server prefix, then allow ONE unknown `<something>-` layer.
+ *
+ * THIS IS NOT A FALLBACK TO A GUESSED ALIAS, and it does not weaken the
+ * anti-substring property that `toCanonicalTool` exists to hold. That property
+ * comes from the SERVER prefix, which the TUI does know (`api.state.mcp()`
+ * supplies it) and which is still required here. By the time an unknown
+ * gateway layer is considered, the key has already been proven to belong to a
+ * configured Elliot server — `not-elliot_knowledge_search` never reaches that
+ * line.
+ *
+ * Confined to display. Nothing authorizes on this: the sidebar decides which
+ * transcript rows to render, and the cost of a wrong answer is a missing or
+ * extra row, not a wrong scope. Authorization uses `toCanonicalTool` with the
+ * configured alias, on the backend, where the alias is known.
+ */
+export function toCanonicalToolUnderAnyGateway(
+  toolKey: string,
+  serverNames: readonly string[],
+): string {
+  if (!toolKey) return toolKey
+  let rest = toolKey
+  for (const server of serverNames) {
+    const prefix = `${sanitizeKey(server)}_`
+    if (rest.startsWith(prefix)) {
+      rest = rest.slice(prefix.length)
+      break
+    }
+  }
+  // One unknown gateway layer, and only one: `<alias>-<tool>`. The alias may
+  // not itself contain the separator, which is what keeps this bounded.
+  const layer = rest.indexOf(GATEWAY_SEPARATOR)
+  if (layer > 0) {
+    const remainder = rest.slice(layer + GATEWAY_SEPARATOR.length)
+    if (remainder) return remainder
+  }
+  return rest
+}
+
+export function toCanonicalTool(
+  toolKey: string,
+  serverNames: readonly string[],
+  gatewayAlias: string,
+): string {
+  if (!toolKey) return toolKey
+  if (!gatewayAlias) {
+    // No silent `|| "elliot"`. A missing alias means the caller is
+    // misconfigured, and guessing one would restore the duplicated literal
+    // this parameter exists to remove — while hiding the misconfiguration
+    // behind behaviour that happens to be right in one deployment.
+    throw new Error("toCanonicalTool requires the configured gateway alias")
+  }
+  const gatewayPrefix = `${gatewayAlias}${GATEWAY_SEPARATOR}`
+  let rest = toolKey
+
+  // One OpenCode `<server>_` prefix, and only for a server we are configured
+  // for. An unconfigured server's tools are not ours to recognise.
+  for (const server of serverNames) {
+    const prefix = `${sanitizeKey(server)}_`
+    if (rest.startsWith(prefix)) {
+      rest = rest.slice(prefix.length)
+      break
+    }
+  }
+
+  // Then one LiteLLM `<alias>-` prefix.
+  if (rest.startsWith(gatewayPrefix)) {
+    rest = rest.slice(gatewayPrefix.length)
+  }
+
+  return rest
+}

package/plugin/opencode-plugin/src/policy.ts

@@ -19,7 +19,7 @@ import {
   killsAgentRuntime,
   looksLikeCredentialExfiltration,
 } from "./classifier.js"
-import { KNOWLEDGE_TOOL, knowledgeToolKey, sanitizeKey } from "./mcp-keys.js"
+import { KNOWLEDGE_TOOL, sanitizeKey, toCanonicalTool } from "./mcp-keys.js"
 
 const OptionsSchema = z
   .object({
@@ -30,6 +30,27 @@ const OptionsSchema = z
      * what let the hooks recognise Elliot tools.
      */
     serverNames: z.array(z.string().min(1)).min(1).default(["elliot"]),
+    /**
+     * The LiteLLM MCP gateway's alias for Elliot — the `mcp_servers` key in
+     * `deploy/litellm/config.yaml`, which LiteLLM also uses as the prefix on
+     * every tool it proxies (`<alias>-<tool>`).
+     *
+     * REQUIRED, and deliberately without a default. This value used to be a
+     * constant in `mcp-keys.ts`, a fourth copy of a literal that also lives in
+     * the backend settings, the backend namespace module and the LiteLLM YAML.
+     * A default here would be that copy again: a plugin configured without the
+     * option would keep working against a guess, and would break silently on
+     * the day someone renamed the YAML key — recognising no gateway-prefixed
+     * tool, injecting no repo scope, and reporting nothing.
+     *
+     * The backend serves it with the plugin spec (`routers/well_known.py`),
+     * from `litellm_mcp_server_alias`.
+     *
+     * Distinct from `serverNames`, which is OpenCode's own server key and
+     * joins with an UNDERSCORE. Both read "elliot" in the default deployment
+     * and they are not the same value.
+     */
+    gatewayAlias: z.string().min(1),
   })
   .strict()
 
@@ -53,11 +74,22 @@ export { KNOWLEDGE_TOOL, sanitizeKey }
 
 /**
  * Is this agent-visible tool key Elliot's knowledge tool on one of our
- * configured servers? Exact composed-key match only — a suffix match would let
- * an unrelated MCP server named e.g. "not-elliot" receive our scope hints.
+ * configured servers?
+ *
+ * NORMALISED FIRST, then matched exactly. It used to compare against one
+ * composed spelling, which stopped matching the moment runtime traffic moved
+ * behind the LiteLLM MCP gateway and the key gained a second namespace
+ * (`elliot_elliot-knowledge_search`). A knowledge call that is not recognised
+ * here is one that silently loses its repository scope — the agent still
+ * answers, just tenant-wide instead of repo-focused, and nothing in the reply
+ * says so.
+ *
+ * The anti-substring property is unchanged: `toCanonicalTool` strips only a
+ * prefix belonging to a CONFIGURED server, so `not-elliot_knowledge_search`
+ * still does not match.
  */
 export function isElliotKnowledgeTool(toolKey: string, options: ElliotPluginOptions): boolean {
-  return options.serverNames.some((server) => toolKey === knowledgeToolKey(server))
+  return toCanonicalTool(toolKey, options.serverNames, options.gatewayAlias) === KNOWLEDGE_TOOL
 }
 
 // -- Shell policy verdicts ---------------------------------------------------