@elliotsystems/eai 0.1.4 → 0.1.7

package/lib/stage.js

@@ -24,10 +24,40 @@
  * upstream's own chrome.
  */
 
+const crypto = require("crypto")
 const fs = require("fs")
 const os = require("os")
 const path = require("path")
 
+/**
+ * The LiteLLM MCP gateway's alias, from `~/.elliot/config.json`'s
+ * `gateway_alias` field -- `eai setup` writes it there straight out of
+ * `/onboarding/config/{tenant_id}`'s own `gateway_alias`, which is
+ * `litellm_mcp_server_alias` (default `"elliot"`) read server-side.
+ *
+ * REQUIRED by the plugin's own options schema
+ * (`opencode-plugin/src/policy.ts`), with no default there on purpose: it
+ * used to be a hardcoded literal in the plugin itself, a fourth copy of a
+ * value that already lived in the backend settings, the backend's own
+ * namespace module and the LiteLLM YAML -- and it went stale exactly once,
+ * silently. This file must not reintroduce that by guessing `"elliot"` when
+ * the config is missing it; `undefined` here means "do not configure the
+ * plugin with a value nobody actually set", not "assume the default".
+ *
+ * Best-effort, like `token-env.js::injectToken` right next to it in the same
+ * launch path: a missing, unreadable or pre-this-field config must not block
+ * startup over branding.
+ */
+function readGatewayAlias() {
+  try {
+    const configPath = path.join(os.homedir(), ".elliot", "config.json")
+    const config = JSON.parse(fs.readFileSync(configPath, "utf8"))
+    return typeof config.gateway_alias === "string" && config.gateway_alias ? config.gateway_alias : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Where the staged overlay lives.
  *
@@ -43,6 +73,43 @@ function stageRoot(version, env = process.env) {
   return path.join(base, version)
 }
 
+/**
+ * A cheap content fingerprint of the overlay source.
+ *
+ * Staging used to be considered done whenever `.staged` held the current
+ * version, on the assumption that a version identifies its contents. That is
+ * false twice over: a package can be reinstalled with different contents under
+ * the same version (a pre-release build of 0.1.4 overwritten by the published
+ * 0.1.4), and a developer editing the plugin in place never changes the version
+ * at all. Both leave a stale tree staged, and the runtime then loads an OLD
+ * plugin out of a directory named after the NEW version -- with nothing logged,
+ * because from the runtime's point of view the plugin loaded fine. That is how
+ * a shipped fix (the agent calling itself Elliot rather than opencode) reached
+ * an installed machine and still did not take effect.
+ *
+ * Path + size + mtime, not file contents: this runs on every launch, and
+ * reading every file would put the cost back into startup that the marker
+ * exists to avoid. Anything npm or a build writes changes at least one mtime.
+ */
+function fingerprint(dir) {
+  const hash = crypto.createHash("sha256")
+  const walk = (current, prefix) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+      if (entry.name === "node_modules") continue
+      const abs = path.join(current, entry.name)
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name
+      if (entry.isDirectory()) {
+        walk(abs, rel)
+        continue
+      }
+      const stat = fs.statSync(abs)
+      hash.update(`${rel}\0${stat.size}\0${Math.trunc(stat.mtimeMs)}\n`)
+    }
+  }
+  walk(dir, "")
+  return hash.digest("hex").slice(0, 16)
+}
+
 function copyDir(from, to) {
   fs.mkdirSync(to, { recursive: true })
   for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
@@ -66,6 +133,12 @@ function stageOverlay(opts) {
   const packageRoot = opts.packageRoot
   const version = opts.version
   const env = opts.env || process.env
+  // Resolved by the CALLER's choice of source (bin/eai reads it from
+  // ~/.elliot/config.json; tests pass one directly) rather than read again in
+  // here, so there is exactly one place that decides where this value comes
+  // from. See readGatewayAlias's own docstring for why `undefined` must not
+  // become a guessed `"elliot"`.
+  const gatewayAlias = opts.gatewayAlias
 
   const pluginSource = path.join(packageRoot, "plugin", "opencode-plugin")
   const themeSource = path.join(packageRoot, "config", "themes")
@@ -76,15 +149,36 @@ function stageOverlay(opts) {
   const pluginDir = path.join(root, "plugin", "opencode-plugin")
 
   try {
-    // `.staged` records the version this tree was built from. Re-staging on
-    // every launch would add hundreds of file copies to startup.
-    const done = fs.existsSync(marker) && fs.readFileSync(marker, "utf8").trim() === version
+    // `.staged` records the version, a content fingerprint of the source this
+    // tree was built from, AND the gateway alias baked into the written
+    // config -- re-staging on every launch would add hundreds of file copies
+    // to startup, but skipping it on an alias change would leave a machine
+    // running `eai setup` against a renamed gateway alias (or configuring it
+    // for the first time) stuck on the stale tui.json/opencode.json until
+    // something else invalidated the stamp.
+    const stamp = `${version} ${fingerprint(pluginSource)} ${gatewayAlias || ""}`.trim()
+    const done = fs.existsSync(marker) && fs.readFileSync(marker, "utf8").trim() === stamp
     if (!done) {
       fs.rmSync(root, { recursive: true, force: true })
       copyDir(pluginSource, pluginDir)
       if (fs.existsSync(themeSource)) copyDir(themeSource, path.join(root, "themes"))
 
-      const plugin = [pluginDir]
+      // The plugin's own OptionsSchema makes `gatewayAlias` REQUIRED with no
+      // default (`opencode-plugin/src/policy.ts`) -- a plugin spec with no
+      // options tuple here, the bare-path form `[pluginDir]`, fails that
+      // validation on every launch. That was this file's actual behaviour
+      // until the incident this comment documents: every bit of TUI branding
+      // the plugin provides (the "Elliot AI" footer, the knowledge panel)
+      // silently never rendered, logged but never surfaced.
+      //
+      // With no alias available (a config from before this field existed, or
+      // `eai setup` never run against an updated backend), the plugin is left
+      // OUT of the array entirely rather than included in a form guaranteed
+      // to fail — "plain OpenCode chrome" is the same visible outcome either
+      // way, but without logging a load error on every single launch.
+      const plugin = gatewayAlias
+        ? [[pluginDir, { serverNames: ["elliot"], gatewayAlias }]]
+        : []
       fs.writeFileSync(
         path.join(root, "tui.json"),
         JSON.stringify(
@@ -103,7 +197,7 @@ function stageOverlay(opts) {
         path.join(root, "opencode.json"),
         JSON.stringify({ $schema: "https://opencode.ai/config.json", plugin }, null, 2),
       )
-      fs.writeFileSync(marker, version)
+      fs.writeFileSync(marker, stamp)
     }
     return root
   } catch {
@@ -113,4 +207,4 @@ function stageOverlay(opts) {
   }
 }
 
-module.exports = { stageOverlay, stageRoot }
+module.exports = { stageOverlay, stageRoot, readGatewayAlias }

package/lib/status.js

@@ -0,0 +1,133 @@
+"use strict"
+
+/**
+ * `eai status` — is this machine configured, can it reach the backend, and
+ * which connectors are live.
+ *
+ * Migrated from `elliot-ai status` as that CLI is retired. It is the one
+ * question `eai` could not answer about itself: the launcher knows where its
+ * config is, but a user staring at a failing session had no way to tell a
+ * missing token from an unreachable backend from a connector that was never
+ * authorised.
+ *
+ * Three facts, in the order they can fail:
+ *
+ *   1. config present      — nothing else is meaningful without it
+ *   2. backend reachable   — /health, so a network or DNS fault is named as one
+ *   3. connectors          — /connectors/<tenant>, the thing people actually ask
+ *
+ * Each step degrades rather than aborting: an unreachable backend still prints
+ * the workspace block, because "which workspace am I in" is answerable offline
+ * and is half of what the command is for.
+ */
+
+const fs = require("fs")
+
+const { elliotConfigPath } = require("./setup.js")
+
+/** Read ~/.elliot/config.json, or null when absent/unreadable. */
+function readElliotConfig() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(elliotConfigPath(), "utf8"))
+    return parsed && typeof parsed === "object" ? parsed : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * `/health`, with a timeout.
+ *
+ * Without one this hangs on a black-holed connection for the OS default, and a
+ * status command that hangs is worse than one that says "offline" — the user is
+ * running it precisely because something is already wrong.
+ */
+async function checkBackendHealth(backendUrl, timeoutMs = 5000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const res = await fetch(`${String(backendUrl).replace(/\/+$/, "")}/health`, {
+      signal: controller.signal,
+    })
+    return res.ok
+  } catch {
+    return false
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Connector rows for this tenant, or [] when they cannot be fetched. */
+async function fetchConnectors(config, timeoutMs = 8000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    const base = String(config.backend_url || "").replace(/\/+$/, "")
+    const res = await fetch(`${base}/connectors/${config.tenant_id}`, {
+      headers: { Authorization: `Bearer ${config.jwt_token}` },
+      signal: controller.signal,
+    })
+    if (!res.ok) return []
+    const body = await res.json()
+    if (Array.isArray(body)) return body
+    return Array.isArray(body && body.connectors) ? body.connectors : []
+  } catch {
+    return []
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Title-case a provider id for display, without assuming it is non-empty. */
+function displayName(provider) {
+  const name = String(provider || "unknown")
+  return name.charAt(0).toUpperCase() + name.slice(1)
+}
+
+/**
+ * @param {{log?: (s: string) => void, config?: object|null}} [opts]
+ * @returns {Promise<number>} the process exit code
+ */
+async function runStatus(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const config = opts.config !== undefined ? opts.config : readElliotConfig()
+
+  if (!config) {
+    log("Not configured. Copy the setup command from the Elliot portal and run it.")
+    return 1
+  }
+
+  log("")
+  log("Elliot-AI status")
+  log("─────────────────────────────")
+  log(`Workspace:     ${config.org_name || "(unknown)"}`)
+  // The id, not just the name: it is the value the portal URLs and the setup
+  // command both carry, so it is what makes the CLI and the web app comparable
+  // at a glance.
+  log(`Workspace ID:  ${config.tenant_id || "(unknown)"}`)
+  if (config.stack) log(`Stack:         ${config.stack}`)
+  log(`Backend:       ${config.backend_url || "(unset)"}`)
+
+  const healthy = config.backend_url ? await checkBackendHealth(config.backend_url) : false
+  log(`Reachable:     ${healthy ? "yes" : "no"}`)
+
+  log("─────────────────────────────")
+  log("Connectors:")
+  const connectors = healthy ? await fetchConnectors(config) : []
+  if (!connectors.length) {
+    // Deliberately not "no connectors": an unreachable backend and an
+    // unconfigured workspace produce the same empty list, and saying which is
+    // which is the whole value of the line.
+    log(healthy ? "  (none reported)" : "  (backend unreachable — cannot tell)")
+  } else {
+    for (const c of connectors) {
+      const state = c.status === "connected" ? "connected" : c.status || "unknown"
+      log(`  ${displayName(c.provider).padEnd(12)} ${state}`)
+    }
+  }
+  log("")
+
+  return healthy ? 0 : 1
+}
+
+module.exports = { runStatus, readElliotConfig, checkBackendHealth, fetchConnectors, displayName }

package/lib/token-env.js

@@ -1,14 +1,22 @@
 "use strict"
 
 /**
- * Inject the Elliot access token into the environment the OpenCode runtime
- * inherits, so its `elliot` provider (configured by `elliot-ai setup` to use
- * `apiKey: "{env:ELLIOT_TOKEN}"`) authenticates against the LightLLM proxy.
+ * Inject LiteLLM's shared master key into the environment the OpenCode
+ * runtime inherits, so its `elliot` provider (configured by `eai setup` to
+ * use `apiKey: "{env:ELLIOT_TOKEN}"`) authenticates against LiteLLM directly.
  *
- * ~/.elliot/config.json is the single source of truth for the token; the CLI
- * (`elliot-ai`) refreshes it there. We only READ it here and copy the current
- * `jwt_token` into ELLIOT_TOKEN — no network, no writes, so this adds no latency
- * and cannot corrupt the config.
+ * The env var name (ELLIOT_TOKEN) is unchanged, but what it holds is not: it
+ * used to be the user's own per-instance JWT (`jwt_token`), revocable and
+ * scoped to them; it is now `litellm_master_key`, ONE secret shared by the
+ * whole gateway (LiteLLM is deliberately DB-less — no per-tenant credential
+ * is possible without one). `eai setup` writes it into
+ * ~/.elliot/config.json's `litellm_master_key` field verbatim, since the
+ * backend's `/onboarding/config` response includes it directly for exactly
+ * this purpose.
+ *
+ * ~/.elliot/config.json is the single source of truth; `eai setup` refreshes
+ * it there. We only READ it here — no network, no writes, so this adds no
+ * latency and cannot corrupt the config.
  *
  * Entirely best-effort: a missing/unreadable/corrupt config, or an env that
  * already sets ELLIOT_TOKEN, leaves things exactly as they were. The launcher's
@@ -20,27 +28,55 @@ const os = require("os")
 const path = require("path")
 
 /**
+ * TWO CREDENTIALS, TWO HOPS. They are not interchangeable and the difference
+ * is the whole reason both exist:
+ *
+ *   ELLIOT_TOKEN      the LiteLLM key. Authenticates this machine TO the
+ *                     gateway, and is consumed there — LiteLLM strips it.
+ *                     Used by the model path and as the MCP entry's
+ *                     `Authorization`.
+ *   ELLIOT_MCP_TOKEN  the Elliot MCP credential. LiteLLM forwards it as
+ *                     Elliot's own `Authorization`, and it is what carries
+ *                     tenant, user and the CLI surface. Minted by
+ *                     `/onboarding/config` with the MCP audience.
+ *
+ * Putting the MCP credential in `Authorization` would authenticate it to
+ * LiteLLM as an unknown key; putting the LiteLLM key in `x-mcp-auth` would
+ * reach Elliot as a credential it cannot decode. Each is useless in the
+ * other's place, which is why they are separate variables rather than one.
+ *
  * @param {NodeJS.ProcessEnv} env the environment to mutate (defaults to process.env)
  * @returns {boolean} true iff ELLIOT_TOKEN was set from the config file
  */
 function injectToken(env) {
   const target = env || process.env
 
-  // An explicit ELLIOT_TOKEN in the environment wins — it lets a caller point
-  // `eai` at a specific token without touching the config file.
-  if (target.ELLIOT_TOKEN) return false
-
+  let config = null
   try {
     const configPath = path.join(os.homedir(), ".elliot", "config.json")
-    const raw = fs.readFileSync(configPath, "utf-8")
-    const config = JSON.parse(raw)
-    if (config && typeof config.jwt_token === "string" && config.jwt_token) {
-      target.ELLIOT_TOKEN = config.jwt_token
-      return true
-    }
+    config = JSON.parse(fs.readFileSync(configPath, "utf-8"))
   } catch {
     // No config yet (setup not run), unreadable, or malformed — the runtime
     // will simply have no elliot token, which is the pre-existing behaviour.
+    return false
+  }
+
+  // Set INDEPENDENTLY of ELLIOT_TOKEN below. An explicit gateway key in the
+  // environment is a deliberate override of the gateway hop and says nothing
+  // about Elliot identity, so it must not also suppress the MCP credential —
+  // doing so would leave MCP silently unauthenticated whenever someone pointed
+  // `eai` at a different LiteLLM key.
+  if (!target.ELLIOT_MCP_TOKEN && config && typeof config.mcp_token === "string" && config.mcp_token) {
+    target.ELLIOT_MCP_TOKEN = config.mcp_token
+  }
+
+  // An explicit ELLIOT_TOKEN in the environment wins — it lets a caller point
+  // `eai` at a specific token without touching the config file.
+  if (target.ELLIOT_TOKEN) return false
+
+  if (config && typeof config.litellm_master_key === "string" && config.litellm_master_key) {
+    target.ELLIOT_TOKEN = config.litellm_master_key
+    return true
   }
   return false
 }

package/lib/update-check.js

@@ -0,0 +1,27 @@
+"use strict"
+
+/**
+ * The detached half of the update notification.
+ *
+ * Spawned by `maybeNotify`, at most once a day, with stdio ignored and the
+ * handle unref'd — so it cannot print anything, cannot hold the parent open,
+ * and cannot fail in a way the user sees. Its only job is to leave the answer
+ * in the cache for the NEXT run to report.
+ *
+ * It is a separate file rather than an inline `-e` script so that the code is
+ * readable, testable and visible in a stack trace, and so a future change does
+ * not have to be escaped through a command line.
+ */
+
+const { latestPublished, readState, writeState, notificationsDisabled } = require("./update.js")
+
+if (notificationsDisabled(process.env)) process.exit(0)
+
+latestPublished()
+  .then((latest) => {
+    if (latest) writeState({ ...readState(), latest, checkedAt: Date.now() })
+  })
+  .catch(() => {
+    // Silence is the contract. The parent already stamped checkedAt, so a
+    // failure here just means the answer is refreshed tomorrow instead.
+  })