@elliotsystems/eai 0.1.5 → 0.1.9

package/bin/eai

@@ -25,12 +25,15 @@ const {
   resolveOpencodeBin,
 } = require("../lib/resolve.js")
 const { injectToken } = require("../lib/token-env.js")
-const { stageOverlay } = require("../lib/stage.js")
+const { stageOverlay, readGatewayAlias } = require("../lib/stage.js")
 const { runSetup, parseArgs } = require("../lib/setup.js")
 const { runStatus } = require("../lib/status.js")
 const { runLogout } = require("../lib/logout.js")
 const { runConnect } = require("../lib/connect.js")
 const { runUpdate, maybeNotify } = require("../lib/update.js")
+const { runLogin } = require("../lib/login.js")
+const { runTeamsList, runTeamsUse, runTeamsCurrent, runTeamsClear } = require("../lib/teams.js")
+const { startupSummary } = require("../lib/context.js")
 const gdrive = require("../lib/gdrive.js")
 
 /**
@@ -119,6 +122,37 @@ if (process.argv[2] === "setup") {
   return
 }
 
+// `eai login` and `eai teams` are intercepted here for the same reason as
+// `setup`/`status`/`logout`: they configure this machine's Elliot session
+// and must work when nothing is configured yet (or before the runtime can
+// even be located). Neither is an OpenCode command, so nothing is shadowed.
+//
+// `login` reuses the paste-token provisioning path (`lib/login.js`), and
+// `teams` the same session service (`lib/auth.js`) + the exact setup
+// rematerialisation path (`lib/setup.js::runSetup`) — one auth implementation
+// for every entry point.
+if (process.argv[2] === "login") {
+  const argv = process.argv.slice(3)
+  const backendIdx = argv.indexOf("--backend-url")
+  const backendUrl = backendIdx >= 0 && argv[backendIdx + 1] ? argv[backendIdx + 1] : undefined
+  finishWith(runLogin({ backendUrl }), "login")
+  return
+}
+
+if (process.argv[2] === "teams") {
+  const verb = process.argv[3]
+  const run =
+    verb === "use"
+      ? () => runTeamsUse({ team: process.argv[4] })
+      : verb === "current"
+        ? runTeamsCurrent
+        : verb === "clear"
+          ? runTeamsClear
+          : runTeamsList
+  finishWith(run(), "teams")
+  return
+}
+
 // `--version` answers for BOTH layers, because a bug report that says only
 // "1.18.30" names the runtime and not the product — and the two move
 // independently: one is this package, the other is its `opencode-ai`
@@ -230,6 +264,20 @@ if (process.env.ELLIOT_LAUNCHER_DEBUG) {
 // the child inherits process.env, so setting it here is enough.
 injectToken(process.env)
 
+// A concise startup context summary (TTY only, read-only, network-free — see
+// lib/context.js). The fail-closed gate for an invalid context lives at the
+// CREDENTIAL level (empty ELLIOT_TOKEN => LiteLLM rejects, no master-key
+// fallback), so this never blocks or fails startup; it just tells the user
+// what context the session resolves to.
+if (process.stdout.isTTY) {
+  try {
+    for (const line of startupSummary()) process.stdout.write(`${line}\n`)
+    process.stdout.write("\n")
+  } catch {
+    // A context summary may never be the reason a session fails to start.
+  }
+}
+
 // Elliot's identity travels WITH this package, not with the directory the user
 // happens to be standing in. Before this, branding came from a `tui.json` in the
 // Elliot repository root, so an installed `eai` outside that repo rendered as
@@ -241,7 +289,11 @@ if (!env.OPENCODE_CONFIG_DIR) {
   // node_modules does not load (its tsconfig, and so its jsxImportSource, is
   // not applied there), and the TUI comes up as plain OpenCode with nothing
   // logged. See lib/stage.js.
-  const staged = stageOverlay({ packageRoot: PACKAGE_ROOT, version: PACKAGE_VERSION })
+  const staged = stageOverlay({
+    packageRoot: PACKAGE_ROOT,
+    version: PACKAGE_VERSION,
+    gatewayAlias: readGatewayAlias(),
+  })
   if (staged) env.OPENCODE_CONFIG_DIR = staged
 }
 

package/lib/auth.js

@@ -0,0 +1,173 @@
+"use strict"
+
+/**
+ * Shared authentication/session service for the EAI CLI.
+ *
+ * `eai login`, `eai teams`, `eai status` and the startup path all resolve the
+ * same facts from the same file and the same backend endpoints, so this
+ * module is where those facts live once:
+ *
+ *   ~/.elliot/config.json   the secure session store (0600, written by
+ *                           `eai login`/`eai setup`, single source of truth)
+ *   POST /auth/cli-token    exchange a portal token for a CLI access/refresh
+ *                           pair (backend/app/auth/router.py:238)
+ *   POST /auth/refresh      refresh a session (backend/app/auth/router.py:175)
+ *   GET  /usage/me          verify the session and read the user (usage.py:86)
+ *
+ * Security rules from docs/architecture/EAI_ONBOARDING_BILLING_AUDIT.md §5/§7:
+ *   - the backend is the only authority for identity and membership;
+ *   - a missing/expired/revoked session fails closed with an actionable
+ *     message — never a silent fallback to a privileged credential;
+ *   - credentials are never printed or written to project files.
+ */
+
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+
+const { elliotConfigPath, writeElliotConfig } = require("./setup.js")
+
+// The default backend a pasted login token targets. The token itself carries
+// no backend URL (it is minted by whichever portal produced it), so an
+// existing config's `backend_url` wins, `--backend-url` overrides, and this
+// production default is the fallback — see runLogin.
+const DEFAULT_BACKEND_URL = "https://backend.elliotsystemsonline.com"
+
+/** Read ~/.elliot/config.json, or null when absent/unreadable. */
+function readConfig() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(elliotConfigPath(), "utf8"))
+    return parsed && typeof parsed === "object" ? parsed : null
+  } catch {
+    return null
+  }
+}
+
+/** The backend URL to use, from config or the default. */
+function backendUrl(config) {
+  return String((config && config.backend_url) || "").replace(/\/+$/, "") || DEFAULT_BACKEND_URL
+}
+
+/**
+ * Resolve a fresh access token, refreshing from `~/.elliot/config.json` when
+ * the stored one is expired or the backend rejects it. Returns the token, or
+ * null when no session is usable (and explains why).
+ *
+ * `POST /auth/refresh` takes the refresh token in the body (auth/router.py:
+ * 175-235); it is the credential there, and is refused for audience-bound
+ * tokens. Non-rotating: the same refresh token keeps working until revoked.
+ *
+ * @param {{log?: (s: string) => void}} [opts]
+ * @returns {Promise<{token: string, config: object} | null>}
+ */
+async function ensureFreshAccessToken(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const config = readConfig()
+  if (!config) {
+    log("Not logged in. Run `eai login` first.")
+    return null
+  }
+  if (!config.jwt_token) {
+    log("Your login is incomplete (no session token). Run `eai login` again.")
+    return null
+  }
+
+  // Refresh proactively when we know the access token has expired. Parsed
+  // leniently: a missing/odd `expires_at` simply means "don't refresh early".
+  const expiresAt = Date.parse(String(config.access_token_expires_at || ""))
+  const needsRefresh = Number.isFinite(expiresAt) && expiresAt <= Date.now()
+
+  if (needsRefresh && config.refresh_token) {
+    const fresh = await refresh(config)
+    if (fresh) return { token: fresh.token, config: fresh.config }
+    log(
+      "Your session has expired and could not be refreshed. Run `eai login` again.",
+    )
+    return null
+  }
+
+  return { token: config.jwt_token, config }
+}
+
+/**
+ * Call `POST /auth/refresh` and persist the new access token. Returns
+ * `{token, config}` on success, null on any failure (never throws).
+ */
+async function refresh(config) {
+  try {
+    const base = backendUrl(config)
+    const res = await fetch(`${base}/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: config.refresh_token }),
+    })
+    if (!res.ok) return null
+    const body = await res.json()
+    if (!body || typeof body.access_token !== "string") return null
+    const next = {
+      ...config,
+      jwt_token: body.access_token,
+      ...(typeof body.access_token_expires_at === "string"
+        ? { access_token_expires_at: body.access_token_expires_at }
+        : {}),
+    }
+    writeElliotConfig(next)
+    return { token: next.jwt_token, config: next }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Authenticated GET. Uses `ensureFreshAccessToken` for a fresh bearer, and
+ * retries once after a refresh when the backend answers 401 (a token that
+ * was still unexpired locally but revoked server-side).
+ *
+ * @returns {Promise<{ok: boolean, status: number, body: any} | null>}
+ *   null when no usable session exists.
+ */
+async function authorizedGet(url, opts = {}) {
+  const session = await ensureFreshAccessToken(opts)
+  if (!session) return null
+  const { token, config } = session
+  const base = backendUrl(config)
+
+  let res
+  try {
+    res = await fetch(`${base}${url}`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: opts.signal,
+    })
+  } catch (error) {
+    opts.log && opts.log(`Could not reach the backend at ${base}: ${error.message}`)
+    return { ok: false, status: 0, body: null }
+  }
+
+  if (res.status === 401 && config.refresh_token) {
+    const fresh = await refresh(config)
+    if (fresh) {
+      res = await fetch(`${base}${url}`, {
+        headers: { Authorization: `Bearer ${fresh.token}` },
+        signal: opts.signal,
+      })
+    }
+  }
+
+  let body = null
+  try {
+    body = await res.json()
+  } catch {
+    // Non-JSON body; callers fall back to the status.
+  }
+  return { ok: res.ok, status: res.status, body }
+}
+
+module.exports = {
+  DEFAULT_BACKEND_URL,
+  readConfig,
+  backendUrl,
+  ensureFreshAccessToken,
+  refresh,
+  authorizedGet,
+  elliotConfigPath,
+}

package/lib/context.js

@@ -0,0 +1,52 @@
+"use strict"
+
+/**
+ * The EAI CLI's effective billing context, resolved from the local session.
+ *
+ * The BACKEND remains the authority for identity, membership and the
+ * budgeted credential — this module only renders what a session already
+ * resolved (see `docs/architecture/EAI_ONBOARDING_BILLING_AUDIT.md` §6/§7).
+ * It is read-only and network-free, so it can run on the startup path and in
+ * `eai status` without adding latency or a hard dependency on the backend.
+ *
+ * The fail-closed gate for an invalid/unresolved context is at the CREDENTIAL
+ * level, not here: if `~/.elliot/config.json` carries no budgeted LiteLLM key
+ * (`litellm_master_key`), `lib/token-env.js` injects no `ELLIOT_TOKEN`, and
+ * the runtime's model calls are rejected by LiteLLM — no unbudgeted spend, no
+ * shared-master-key fallback.
+ */
+
+const { readConfig } = require("./auth.js")
+
+/** `{type: "team"|"individual", label, teamId}` from the local session. */
+function billingContext(config) {
+  if (!config) return { type: "none", label: "Not signed in", teamId: null }
+  if (config.team_id) {
+    return {
+      type: "team",
+      label: `Team — ${config.team_name || config.team_id}`,
+      teamId: String(config.team_id),
+    }
+  }
+  return { type: "individual", label: "Individual", teamId: null }
+}
+
+/**
+ * The lines printed when starting `eai` (TTY only) and in `eai status`.
+ * Never prints credentials; identifiers are shown only where they are the
+ * user-facing value (e.g. the team id when no name is known).
+ */
+function startupSummary(config = readConfig()) {
+  const billing = billingContext(config)
+  const signedIn = config && (config.email || config.user_id) ? config.email || config.user_id : "(none)"
+  const gateway = config && config.litellm_base_url ? "LiteLLM" : "(unconfigured)"
+  return [
+    "Elliot AI",
+    `Signed in: ${signedIn}`,
+    `Billing:   ${billing.label}`,
+    `Gateway:   ${gateway}`,
+    "Project:   (none)",
+  ]
+}
+
+module.exports = { billingContext, startupSummary }

package/lib/login.js

@@ -0,0 +1,114 @@
+"use strict"
+
+/**
+ * `eai login` — establish an authenticated CLI session with a pasted token.
+ *
+ * Approved flow (docs/architecture/EAI_ONBOARDING_BILLING_AUDIT.md §5/§15):
+ * reuse the existing paste-token mechanism. The token is obtained from the
+ * portal (or the existing `eai setup` handoff), prompted for SECURELY (never
+ * via argv, so it cannot leak into shell history or `ps`), exchanged for a
+ * CLI access/refresh pair at `POST /auth/cli-token`, then provisioned through
+ * the exact same path `eai setup` uses (`lib/setup.js::runSetup`), so there
+ * is ONE authentication implementation, not two.
+ *
+ * Fail-closed: an unreadable/invalid token, an expired/revoked session or a
+ * backend that cannot resolve a budgeted credential all abort with an
+ * actionable message. No credential is ever printed.
+ */
+
+const readline = require("readline")
+
+const auth = require("./auth.js")
+const { decodeJwtPayload, runSetup } = require("./setup.js")
+
+/**
+ * Prompt for a token without echoing it to the terminal (no shell history, no
+ * process-argument exposure). On a non-TTY stdin (piped/CI), reads a plain
+ * line — callers can also pass `opts.token` to skip the prompt entirely.
+ */
+function promptHidden(question) {
+  return new Promise((resolve) => {
+    if (!process.stdin.isTTY) {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+      rl.question(`${question} `, (answer) => {
+        rl.close()
+        resolve(String(answer || "").trim())
+      })
+      return
+    }
+    process.stdout.write(question + " ")
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true })
+    rl._writeToOutput = (str) => {
+      // Mask the echoed token as asterisks; keep newlines/control output.
+      if (/[\r\n]/.test(str)) rl.output.write(str)
+      else rl.output.write("*".repeat(str.length))
+    }
+    rl.question("", (answer) => {
+      process.stdout.write("\n")
+      rl.close()
+      resolve(String(answer || "").trim())
+    })
+  })
+}
+
+/**
+ * @param {{token?: string, backendUrl?: string, log?: (s: string) => void}} opts
+ * @returns {Promise<number>} exit code
+ */
+async function runLogin(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const existing = auth.readConfig()
+  const backendUrl = String(
+    opts.backendUrl || auth.backendUrl(existing) || auth.DEFAULT_BACKEND_URL,
+  ).replace(/\/+$/, "")
+
+  log("Elliot AI login")
+  log("─────────────────────────────")
+  log(
+    "Get a login token from the Elliot portal (or from `eai setup`'s own " +
+      "handoff), then paste it below. It is not echoed and never appears in " +
+      "your shell history.",
+  )
+  if (!existing) {
+    log(`Backend: ${backendUrl} (use --backend-url to target another environment)`)
+  }
+  log("")
+
+  const token = opts.token || (await promptHidden("Paste your login token:"))
+  if (!token) {
+    log("Login cancelled — no token entered.")
+    return 1
+  }
+
+  // Validate before any network call: the token must look like an Elliot
+  // access token carrying a tenant claim.
+  const claims = decodeJwtPayload(token) || {}
+  if (!claims.tenant_id) {
+    log(
+      "That does not look like a valid Elliot login token (no tenant). " +
+        "Copy the full token from the portal and try again.",
+    )
+    return 1
+  }
+
+  log("")
+  try {
+    // The exact provisioning path `eai setup` uses: cli-token exchange,
+    // /onboarding/config fetch, secure config writes, opencode.json
+    // materialisation, agent files. One implementation, both entry points.
+    const result = await runSetup({ token, backendUrl, log })
+    log("")
+    log("Logged in.")
+    log("Next: run `eai teams` to view your teams, `eai teams use \"<name>\"`")
+    log("      to pick a billing team, or `eai` to start with individual billing.")
+    return result ? 0 : 1
+  } catch (error) {
+    // Includes the fail-closed 503 from /onboarding/config when no budgeted
+    // credential resolves — the message from the backend is actionable and
+    // confirms no model request was configured.
+    log(String(error && error.message ? error.message : error))
+    return 1
+  }
+}
+
+module.exports = { runLogin, promptHidden }