@elliotsystems/eai 0.1.4 → 0.1.5

package/lib/status.js

@@ -0,0 +1,133 @@
+"use strict"
+
+/**
+ * `eai status` — is this machine configured, can it reach the backend, and
+ * which connectors are live.
+ *
+ * Migrated from `elliot-ai status` as that CLI is retired. It is the one
+ * question `eai` could not answer about itself: the launcher knows where its
+ * config is, but a user staring at a failing session had no way to tell a
+ * missing token from an unreachable backend from a connector that was never
+ * authorised.
+ *
+ * Three facts, in the order they can fail:
+ *
+ *   1. config present      — nothing else is meaningful without it
+ *   2. backend reachable   — /health, so a network or DNS fault is named as one
+ *   3. connectors          — /connectors/<tenant>, the thing people actually ask
+ *
+ * Each step degrades rather than aborting: an unreachable backend still prints
+ * the workspace block, because "which workspace am I in" is answerable offline
+ * and is half of what the command is for.
+ */
+
+const fs = require("fs")
+
+const { elliotConfigPath } = require("./setup.js")
+
+/** Read ~/.elliot/config.json, or null when absent/unreadable. */
+function readElliotConfig() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(elliotConfigPath(), "utf8"))
+    return parsed && typeof parsed === "object" ? parsed : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * `/health`, with a timeout.
+ *
+ * Without one this hangs on a black-holed connection for the OS default, and a
+ * status command that hangs is worse than one that says "offline" — the user is
+ * running it precisely because something is already wrong.
+ */
+async function checkBackendHealth(backendUrl, timeoutMs = 5000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const res = await fetch(`${String(backendUrl).replace(/\/+$/, "")}/health`, {
+      signal: controller.signal,
+    })
+    return res.ok
+  } catch {
+    return false
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Connector rows for this tenant, or [] when they cannot be fetched. */
+async function fetchConnectors(config, timeoutMs = 8000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const base = String(config.backend_url || "").replace(/\/+$/, "")
+    const res = await fetch(`${base}/connectors/${config.tenant_id}`, {
+      headers: { Authorization: `Bearer ${config.jwt_token}` },
+      signal: controller.signal,
+    })
+    if (!res.ok) return []
+    const body = await res.json()
+    if (Array.isArray(body)) return body
+    return Array.isArray(body && body.connectors) ? body.connectors : []
+  } catch {
+    return []
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Title-case a provider id for display, without assuming it is non-empty. */
+function displayName(provider) {
+  const name = String(provider || "unknown")
+  return name.charAt(0).toUpperCase() + name.slice(1)
+}
+
+/**
+ * @param {{log?: (s: string) => void, config?: object|null}} [opts]
+ * @returns {Promise<number>} the process exit code
+ */
+async function runStatus(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const config = opts.config !== undefined ? opts.config : readElliotConfig()
+
+  if (!config) {
+    log("Not configured. Copy the setup command from the Elliot portal and run it.")
+    return 1
+  }
+
+  log("")
+  log("Elliot-AI status")
+  log("─────────────────────────────")
+  log(`Workspace:     ${config.org_name || "(unknown)"}`)
+  // The id, not just the name: it is the value the portal URLs and the setup
+  // command both carry, so it is what makes the CLI and the web app comparable
+  // at a glance.
+  log(`Workspace ID:  ${config.tenant_id || "(unknown)"}`)
+  if (config.stack) log(`Stack:         ${config.stack}`)
+  log(`Backend:       ${config.backend_url || "(unset)"}`)
+
+  const healthy = config.backend_url ? await checkBackendHealth(config.backend_url) : false
+  log(`Reachable:     ${healthy ? "yes" : "no"}`)
+
+  log("─────────────────────────────")
+  log("Connectors:")
+  const connectors = healthy ? await fetchConnectors(config) : []
+  if (!connectors.length) {
+    // Deliberately not "no connectors": an unreachable backend and an
+    // unconfigured workspace produce the same empty list, and saying which is
+    // which is the whole value of the line.
+    log(healthy ? "  (none reported)" : "  (backend unreachable — cannot tell)")
+  } else {
+    for (const c of connectors) {
+      const state = c.status === "connected" ? "connected" : c.status || "unknown"
+      log(`  ${displayName(c.provider).padEnd(12)} ${state}`)
+    }
+  }
+  log("")
+
+  return healthy ? 0 : 1
+}
+
+module.exports = { runStatus, readElliotConfig, checkBackendHealth, fetchConnectors, displayName }

package/lib/token-env.js

@@ -1,14 +1,22 @@
 "use strict"
 
 /**
- * Inject the Elliot access token into the environment the OpenCode runtime
- * inherits, so its `elliot` provider (configured by `elliot-ai setup` to use
- * `apiKey: "{env:ELLIOT_TOKEN}"`) authenticates against the LightLLM proxy.
+ * Inject LiteLLM's shared master key into the environment the OpenCode
+ * runtime inherits, so its `elliot` provider (configured by `eai setup` to
+ * use `apiKey: "{env:ELLIOT_TOKEN}"`) authenticates against LiteLLM directly.
  *
- * ~/.elliot/config.json is the single source of truth for the token; the CLI
- * (`elliot-ai`) refreshes it there. We only READ it here and copy the current
- * `jwt_token` into ELLIOT_TOKEN — no network, no writes, so this adds no latency
- * and cannot corrupt the config.
+ * The env var name (ELLIOT_TOKEN) is unchanged, but what it holds is not: it
+ * used to be the user's own per-instance JWT (`jwt_token`), revocable and
+ * scoped to them; it is now `litellm_master_key`, ONE secret shared by the
+ * whole gateway (LiteLLM is deliberately DB-less — no per-tenant credential
+ * is possible without one). `eai setup` writes it into
+ * ~/.elliot/config.json's `litellm_master_key` field verbatim, since the
+ * backend's `/onboarding/config` response includes it directly for exactly
+ * this purpose.
+ *
+ * ~/.elliot/config.json is the single source of truth; `eai setup` refreshes
+ * it there. We only READ it here — no network, no writes, so this adds no
+ * latency and cannot corrupt the config.
  *
  * Entirely best-effort: a missing/unreadable/corrupt config, or an env that
  * already sets ELLIOT_TOKEN, leaves things exactly as they were. The launcher's
@@ -20,27 +28,55 @@ const os = require("os")
 const path = require("path")
 
 /**
+ * TWO CREDENTIALS, TWO HOPS. They are not interchangeable and the difference
+ * is the whole reason both exist:
+ *
+ *   ELLIOT_TOKEN      the LiteLLM key. Authenticates this machine TO the
+ *                     gateway, and is consumed there — LiteLLM strips it.
+ *                     Used by the model path and as the MCP entry's
+ *                     `Authorization`.
+ *   ELLIOT_MCP_TOKEN  the Elliot MCP credential. LiteLLM forwards it as
+ *                     Elliot's own `Authorization`, and it is what carries
+ *                     tenant, user and the CLI surface. Minted by
+ *                     `/onboarding/config` with the MCP audience.
+ *
+ * Putting the MCP credential in `Authorization` would authenticate it to
+ * LiteLLM as an unknown key; putting the LiteLLM key in `x-mcp-auth` would
+ * reach Elliot as a credential it cannot decode. Each is useless in the
+ * other's place, which is why they are separate variables rather than one.
+ *
  * @param {NodeJS.ProcessEnv} env the environment to mutate (defaults to process.env)
  * @returns {boolean} true iff ELLIOT_TOKEN was set from the config file
  */
 function injectToken(env) {
   const target = env || process.env
 
-  // An explicit ELLIOT_TOKEN in the environment wins — it lets a caller point
-  // `eai` at a specific token without touching the config file.
-  if (target.ELLIOT_TOKEN) return false
-
+  let config = null
   try {
     const configPath = path.join(os.homedir(), ".elliot", "config.json")
-    const raw = fs.readFileSync(configPath, "utf-8")
-    const config = JSON.parse(raw)
-    if (config && typeof config.jwt_token === "string" && config.jwt_token) {
-      target.ELLIOT_TOKEN = config.jwt_token
-      return true
-    }
+    config = JSON.parse(fs.readFileSync(configPath, "utf-8"))
   } catch {
     // No config yet (setup not run), unreadable, or malformed — the runtime
     // will simply have no elliot token, which is the pre-existing behaviour.
+    return false
+  }
+
+  // Set INDEPENDENTLY of ELLIOT_TOKEN below. An explicit gateway key in the
+  // environment is a deliberate override of the gateway hop and says nothing
+  // about Elliot identity, so it must not also suppress the MCP credential —
+  // doing so would leave MCP silently unauthenticated whenever someone pointed
+  // `eai` at a different LiteLLM key.
+  if (!target.ELLIOT_MCP_TOKEN && config && typeof config.mcp_token === "string" && config.mcp_token) {
+    target.ELLIOT_MCP_TOKEN = config.mcp_token
+  }
+
+  // An explicit ELLIOT_TOKEN in the environment wins — it lets a caller point
+  // `eai` at a specific token without touching the config file.
+  if (target.ELLIOT_TOKEN) return false
+
+  if (config && typeof config.litellm_master_key === "string" && config.litellm_master_key) {
+    target.ELLIOT_TOKEN = config.litellm_master_key
+    return true
   }
   return false
 }

package/lib/update-check.js

@@ -0,0 +1,27 @@
+"use strict"
+
+/**
+ * The detached half of the update notification.
+ *
+ * Spawned by `maybeNotify`, at most once a day, with stdio ignored and the
+ * handle unref'd — so it cannot print anything, cannot hold the parent open,
+ * and cannot fail in a way the user sees. Its only job is to leave the answer
+ * in the cache for the NEXT run to report.
+ *
+ * It is a separate file rather than an inline `-e` script so that the code is
+ * readable, testable and visible in a stack trace, and so a future change does
+ * not have to be escaped through a command line.
+ */
+
+const { latestPublished, readState, writeState, notificationsDisabled } = require("./update.js")
+
+if (notificationsDisabled(process.env)) process.exit(0)
+
+latestPublished()
+  .then((latest) => {
+    if (latest) writeState({ ...readState(), latest, checkedAt: Date.now() })
+  })
+  .catch(() => {
+    // Silence is the contract. The parent already stamped checkedAt, so a
+    // failure here just means the answer is refreshed tomorrow instead.
+  })

package/lib/update.js

@@ -0,0 +1,303 @@
+"use strict"
+
+/**
+ * `eai update` — move this machine onto the current published CLI.
+ *
+ * ## Why this exists rather than "just run npm i -g"
+ *
+ * Because the user does not necessarily know how `eai` got onto their machine,
+ * and the right command differs: a global npm install, a pnpm or bun global, or
+ * a `node_modules` inside a project are four different updates, and running the
+ * wrong one either fails confusingly or installs a SECOND copy that shadows the
+ * first. Onboarding is one `npm i -g @elliotsystems/eai`, so the common case is
+ * easy; the point of this command is that the uncommon cases say what to do
+ * instead of failing.
+ *
+ * ## It updates the CLI, which brings the runtime with it
+ *
+ * `opencode-ai` is a dependency of this package, pinned to an exact version.
+ * So the OpenCode runtime a user has is decided by the EAI version they have,
+ * and npm fetches the matching runtime as part of the install. There is
+ * deliberately no separate "update OpenCode" path: the two moving
+ * independently on a user's machine is the drift this whole mechanism exists
+ * to prevent, and `check_opencode_versions.mjs` enforces the same pairing in
+ * CI.
+ *
+ * ## Nothing here hardcodes a version
+ *
+ * The published version is asked of the registry, and the installed one is read
+ * from the package. A literal in this file would be a third source of truth
+ * that goes stale on the next release and keeps looking authoritative.
+ */
+
+const childProcess = require("child_process")
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+const PACKAGE_NAME = "@elliotsystems/eai"
+
+/** The npm registry's own metadata endpoint for the published version. */
+const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`
+
+/**
+ * Run a package-manager command, portably and without a deprecation warning.
+ *
+ * Windows needs a shell: npm, pnpm and bun are all `.cmd` shims there, and
+ * execFile cannot run a `.cmd` directly — it throws ENOENT, which silently
+ * made every Windows user's global install look like "not a global install".
+ *
+ * But `shell: true` TOGETHER WITH an args array triggers Node 24's DEP0190
+ * ("arguments are not escaped, only concatenated"), which printed a security
+ * warning on every `eai update` run. Passing one pre-joined command string
+ * instead does the same work without the warning, because the concatenation
+ * is then explicitly ours rather than something Node did behind our back.
+ *
+ * That is only safe because every command and argument here is a literal from
+ * the table in detectInstall. Nothing user-supplied is ever interpolated, and
+ * nothing in this file should start doing so.
+ */
+function runTool(bin, args, options) {
+  if (process.platform === "win32") {
+    return childProcess.execSync([bin, ...args].join(" "), { ...options, shell: undefined })
+  }
+  return childProcess.execFileSync(bin, args, options)
+}
+
+/**
+ * How was this copy installed?
+ *
+ * Decided from the path the package actually sits at, not from a guess: an
+ * `npm root -g` that matches means a global install, and anything else is
+ * reported rather than acted on. Updating the wrong tree is how a user ends up
+ * with two `eai` binaries and no idea which one runs.
+ */
+function detectInstall(packageRoot) {
+  const managers = [
+    { name: "npm", probe: ["npm", ["root", "-g"]], update: "npm install -g " + PACKAGE_NAME + "@latest" },
+    { name: "pnpm", probe: ["pnpm", ["root", "-g"]], update: "pnpm add -g " + PACKAGE_NAME + "@latest" },
+    { name: "bun", probe: ["bun", ["pm", "bin", "-g"]], update: "bun add -g " + PACKAGE_NAME + "@latest" },
+  ]
+  const resolved = (() => {
+    try {
+      return fs.realpathSync(packageRoot)
+    } catch {
+      return packageRoot
+    }
+  })()
+
+  for (const m of managers) {
+    let root
+    try {
+      root = runTool(m.probe[0], m.probe[1], {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 15000,
+          // REQUIRED on Windows, and its absence is not a degraded probe — it is
+          // a total one. `npm`, `pnpm` and `bun` are all `.cmd` shims there, and
+          // execFileSync cannot execute a `.cmd` without a shell: it throws
+          // ENOENT, the catch below skips the manager, every manager is skipped,
+          // and `eai update` tells every Windows user their global install is
+          // "not a global install" and refuses. Windows is the platform
+          // publish-eai.yml validates on.
+          //
+        }).trim()
+    } catch {
+      continue // manager not installed; not an error, just not this one
+    }
+    if (!root) continue
+    let realRoot
+    try {
+      realRoot = fs.realpathSync(root)
+    } catch {
+      realRoot = root
+    }
+    if (resolved.startsWith(realRoot + path.sep) || resolved.startsWith(root + path.sep)) {
+      return { kind: "global", manager: m.name, command: m.update }
+    }
+  }
+  return { kind: "unknown", manager: null, command: null }
+}
+
+/**
+ * The published version, or null.
+ *
+ * Deliberately quiet on failure. An offline machine, a proxy or a registry
+ * blip must not turn `eai update` into an error — and must REALLY not turn a
+ * background check (see maybeNotify) into one.
+ */
+async function latestPublished(timeoutMs = 5000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const response = await fetch(REGISTRY_URL, {
+      signal: controller.signal,
+      // `application/vnd.npm.install-v1+json` returns an abbreviated document.
+      // Smaller and, more to the point, it is the contract npm itself uses, so
+      // it is the least likely shape to change under us.
+      headers: { accept: "application/vnd.npm.install-v1+json, application/json" },
+    })
+    if (!response.ok) return null
+    const body = await response.json()
+    return typeof body?.version === "string" ? body.version : null
+  } catch {
+    return null
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+function compareSemver(a, b) {
+  const parse = (v) => String(v).split("-")[0].split(".").map((n) => Number(n) || 0)
+  const [x, y] = [parse(a), parse(b)]
+  return x[0] - y[0] || x[1] - y[1] || x[2] - y[2]
+}
+
+/** `eai update`. */
+async function runUpdate({ packageRoot, version, argv = [] } = {}) {
+  const check = argv.includes("--check")
+  const latest = await latestPublished()
+
+  if (!latest) {
+    process.stderr.write(
+      "eai update: could not reach the npm registry.\n" +
+        "Nothing was changed. Check your connection or proxy and try again.\n",
+    )
+    return 1
+  }
+
+  process.stdout.write(`installed: ${version}\npublished: ${latest}\n`)
+
+  if (compareSemver(latest, version) <= 0) {
+    process.stdout.write("\nAlready up to date.\n")
+    return 0
+  }
+
+  const install = detectInstall(packageRoot)
+  if (check) {
+    process.stdout.write(`\nUpdate available. Run: ${install.command || "eai update"}\n`)
+    return 0
+  }
+
+  if (install.kind !== "global") {
+    // Not a failure — a refusal to guess. Installing globally over a local
+    // checkout or a project dependency would leave two copies and no signal
+    // about which one the shell resolves.
+    process.stderr.write(
+      `\neai update: this copy of ${PACKAGE_NAME} is not a global install.\n` +
+        `It is at: ${packageRoot}\n` +
+        "Update it the way it was installed — or install globally with:\n" +
+        `  npm install -g ${PACKAGE_NAME}@latest\n`,
+    )
+    return 1
+  }
+
+  process.stdout.write(`\nUpdating via ${install.manager}: ${install.command}\n\n`)
+  // One command string, not (bin, args) — see runTool above for why the args
+  // form prints a DEP0190 security warning on every Windows run.
+  const result = process.platform === "win32"
+    ? childProcess.spawnSync(install.command, { stdio: "inherit", shell: true })
+    : childProcess.spawnSync(install.command.split(" ")[0], install.command.split(" ").slice(1), { stdio: "inherit" })
+  if (result.status !== 0) {
+    process.stderr.write(
+      `\neai update: ${install.manager} exited ${result.status}.\n` +
+        "On a permissions error, either re-run with the privileges that install needs,\n" +
+        "or point npm at a user-writable prefix (`npm config set prefix`).\n",
+    )
+    return result.status || 1
+  }
+  process.stdout.write(`\nUpdated to ${latest}. Run \`eai --version\` to confirm.\n`)
+  return 0
+}
+
+// ── update notification ────────────────────────────────────────────────────
+//
+// A CLI that silently goes stale is a CLI whose users report bugs that were
+// fixed months ago. But a version check on the hot path is worse than the
+// problem: it adds latency to every launch, it fails on an offline machine,
+// and a nag on every single run gets ignored and then resented.
+//
+// So the notice is: throttled to once a day, written to STDERR so it can never
+// corrupt piped output, never blocking (the check runs against a cached answer
+// from a PREVIOUS run, never a live request on this one), and switchable off.
+
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
+
+function stateFile() {
+  return path.join(os.homedir(), ".elliot", "update-check.json")
+}
+
+function readState() {
+  try {
+    return JSON.parse(fs.readFileSync(stateFile(), "utf8")) || {}
+  } catch {
+    return {}
+  }
+}
+
+function writeState(state) {
+  try {
+    fs.mkdirSync(path.dirname(stateFile()), { recursive: true })
+    fs.writeFileSync(stateFile(), JSON.stringify(state))
+  } catch {
+    // A read-only or full home directory must not break the CLI over a
+    // convenience feature. Losing the throttle means re-checking tomorrow.
+  }
+}
+
+function notificationsDisabled(env) {
+  // Two switches on purpose. ELLIOT_NO_UPDATE_CHECK is ours and explicit;
+  // CI is honoured because a version nag in build logs is pure noise and
+  // nobody sets a flag they do not know exists.
+  return Boolean(env.ELLIOT_NO_UPDATE_CHECK || env.CI || env.NO_UPDATE_NOTIFIER)
+}
+
+/**
+ * Print a notice if a newer version was seen EARLIER, then refresh the cache in
+ * the background.
+ *
+ * The ordering is the whole design. This run reports what the last run already
+ * learned, so the common path does no network I/O at all and costs a file read.
+ * The refresh is detached and unref'd, so the process exits without waiting on
+ * it, and a hung registry delays nothing.
+ */
+function maybeNotify({ version, env = process.env, now = Date.now() } = {}) {
+  if (notificationsDisabled(env)) return
+  const state = readState()
+
+  if (state.latest && compareSemver(state.latest, version) > 0) {
+    process.stderr.write(
+      `\nA newer Elliot CLI is available: ${version} → ${state.latest}\n` +
+        "Run `eai update` to upgrade. (`ELLIOT_NO_UPDATE_CHECK=1` silences this.)\n\n",
+    )
+  }
+
+  if (now - (state.checkedAt || 0) < CHECK_INTERVAL_MS) return
+  // Stamp BEFORE spawning. If the check fails or the machine is offline, the
+  // throttle still holds and we do not spawn a doomed probe on every run.
+  writeState({ ...state, checkedAt: now })
+  try {
+    const child = childProcess.spawn(
+      process.execPath,
+      [path.join(__dirname, "update-check.js")],
+      { detached: true, stdio: "ignore", env },
+    )
+    child.unref()
+  } catch {
+    // Best effort, always.
+  }
+}
+
+module.exports = {
+  PACKAGE_NAME,
+  runUpdate,
+  latestPublished,
+  compareSemver,
+  detectInstall,
+  maybeNotify,
+  notificationsDisabled,
+  stateFile,
+  readState,
+  writeState,
+  CHECK_INTERVAL_MS,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elliotsystems/eai",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Elliot AI CLI entry point (eai) - launches the Elliot runtime with arguments forwarded verbatim.",
   "bin": {
     "eai": "./bin/eai"
@@ -13,6 +13,7 @@
     "README.md"
   ],
   "scripts": {
+    "pretest": "node scripts/bundle.js",
     "test": "node --test test/*.test.js",
     "publish:npm": "node scripts/publish.js",
     "bundle": "node scripts/bundle.js",

package/plugin/opencode-plugin/src/classifier.ts

@@ -1,7 +1,8 @@
 /**
  * Shell-command classification — the policy intelligence glob patterns cannot express.
  *
- * Ported (adapted, not copied wholesale) from `elliot-cli/src/tools/bash-policy.ts`,
+ * Ported (adapted, not copied wholesale) from the retired elliot-ai CLI's
+ * `src/tools/bash-policy.ts`,
  * which is pure and dependency-free. Three things here are beyond what OpenCode's
  * native `permission.bash` globs can represent, which is exactly why this file exists:
  *