@elliotsystems/eai 0.1.7 → 0.1.9

package/lib/status.js

@@ -24,6 +24,7 @@
 const fs = require("fs")
 
 const { elliotConfigPath } = require("./setup.js")
+const { billingContext } = require("./context.js")
 
 /** Read ~/.elliot/config.json, or null when absent/unreadable. */
 function readElliotConfig() {
@@ -107,6 +108,7 @@ async function runStatus(opts = {}) {
   log(`Workspace ID:  ${config.tenant_id || "(unknown)"}`)
   if (config.stack) log(`Stack:         ${config.stack}`)
   log(`Backend:       ${config.backend_url || "(unset)"}`)
+  log(`Billing:       ${billingContext(config).label}`)
 
   const healthy = config.backend_url ? await checkBackendHealth(config.backend_url) : false
   log(`Reachable:     ${healthy ? "yes" : "no"}`)

package/lib/teams.js

@@ -0,0 +1,233 @@
+"use strict"
+
+/**
+ * `eai teams` — list, select, verify and clear the team billing context.
+ *
+ * Approved model (docs/architecture/EAI_ONBOARDING_BILLING_AUDIT.md §4/§6):
+ * the BACKEND is the only authority for membership and for the budgeted
+ * credential. These commands never trust a client-supplied team id as proof
+ * of membership — `GET /teams` returns only the caller's authorized teams,
+ * and `teams use`/`teams clear` re-fetch `/onboarding/config` through the
+ * exact provisioning path `eai setup` uses, so the materialised `opencode.json`
+ * carries the correct team (or personal) budgeted LiteLLM key. Fail-closed:
+ * a revoked membership, unknown/ambiguous team, or missing budgeted
+ * credential aborts with an actionable message and no config change.
+ *
+ * Switching teams rematerialises configuration and requires a FRESH `eai`
+ * session — OpenCode cannot swap the embedded key mid-session, so in-flight
+ * requests keep their original billing context (audit §3, decision 3).
+ */
+
+const { ensureFreshAccessToken, authorizedGet } = require("./auth.js")
+const { runSetup } = require("./setup.js")
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+/** Unwrap a /teams response whether the backend returns a bare array or an
+ *  object with a `teams` key. */
+function teamsFromBody(body) {
+  if (Array.isArray(body)) return body
+  if (body && Array.isArray(body.teams)) return body.teams
+  return []
+}
+
+/** Fetch the caller's authorized teams (empty on failure). */
+async function fetchTeams(opts = {}) {
+  const session = await ensureFreshAccessToken(opts)
+  if (!session) return null
+  const { config } = session
+  if (!config.tenant_id) {
+    opts.log && opts.log("Your login has no tenant. Run `eai login` again.")
+    return null
+  }
+  const result = await authorizedGet(
+    `/teams?tenant_id=${encodeURIComponent(config.tenant_id)}`,
+    opts,
+  )
+  if (!result || !result.ok) return []
+  return teamsFromBody(result.body)
+}
+
+async function runTeamsList(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const teams = await fetchTeams(opts)
+  if (teams === null) return 1
+  if (!teams.length) {
+    log("No teams are available to you yet.")
+    log("Ask an administrator to add you to a team, or run `eai` to use individual billing.")
+    return 0
+  }
+  log("Your teams:")
+  for (const team of teams) {
+    const name = team.name || "(unnamed)"
+    const budget =
+      typeof team.max_budget_usd === "number" && team.max_budget_usd > 0
+        ? ` — budget $${team.max_budget_usd}/day`
+        : ""
+    log(`  ${name}${budget}  (${team.id})`)
+  }
+  log("")
+  log('Select one with:  eai teams use "<team name>"')
+  log("Show the active context with:  eai teams current")
+  return 0
+}
+
+/** Resolve a `teams use` argument to a single team id, or null (with a
+ *  message) when it is unknown or ambiguous. */
+function resolveTeamId(teams, arg) {
+  if (UUID_RE.test(arg)) {
+    const match = teams.find((t) => String(t.id) === arg)
+    if (match) return { id: String(match.id), name: match.name }
+    return null
+  }
+  const matches = teams.filter((t) => String(t.name) === arg)
+  if (matches.length === 1) {
+    return { id: String(matches[0].id), name: matches[0].name }
+  }
+  if (matches.length > 1) {
+    const list = matches.map((t) => `  ${t.name}  (${t.id})`).join("\n")
+    return {
+      ambiguous: true,
+      message:
+        `Multiple teams are named "${arg}". Use the id instead:\n${list}\n` +
+        '  eai teams use "<id>"',
+    }
+  }
+  return null
+}
+
+async function runTeamsUse(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const arg = String(opts.team || "").trim()
+  if (!arg) {
+    log('Usage: eai teams use "<team name or id>"')
+    return 1
+  }
+  const session = await ensureFreshAccessToken(opts)
+  if (!session) return 1
+  const { token, config } = session
+  const backendUrl = String(opts.backendUrl || config.backend_url || "").replace(/\/+$/, "")
+  if (!backendUrl) {
+    log("No backend configured. Run `eai login` first.")
+    return 1
+  }
+
+  const teams = await fetchTeams(opts)
+  if (teams === null) return 1
+  const resolved = resolveTeamId(teams, arg)
+  if (!resolved) {
+    log(`You are not a member of a team named or id'd "${arg}".`)
+    log("Run `eai teams` to see the teams available to you.")
+    return 1
+  }
+  if (resolved.ambiguous) {
+    log(resolved.message)
+    return 1
+  }
+
+  // Rematerialise through the exact setup path: the backend validates
+  // membership, resolves the TEAM's budgeted LiteLLM key (fail-closed if
+  // none resolves), and writes the config + opencode.json. A failure here
+  // leaves the previous config untouched.
+  log(`Selecting team "${resolved.name}"...`)
+  try {
+    await runSetup({ token, backendUrl, teamId: resolved.id, log })
+  } catch (error) {
+    log(String(error && error.message ? error.message : error))
+    log("Team selection did not change. Your previous billing context is unchanged.")
+    return 1
+  }
+  log("")
+  log(`Billing team set to "${resolved.name}".`)
+  log("Restart EAI (`eai`) to apply the new context. In-flight work is unaffected.")
+  return 0
+}
+
+async function runTeamsCurrent(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const session = await ensureFreshAccessToken(opts)
+  if (!session) return 1
+  const { config } = session
+
+  const displayUser = config.email || config.user_id || "(unknown)"
+  const teamId = config.team_id
+  const isTeam = Boolean(teamId)
+
+  // Verify server-side, not from local config alone: resolve the team from
+  // the authorized list (revoked membership => 404/absent => unverified).
+  let teamName = null
+  let verified = false
+  const teams = await fetchTeams(opts)
+  if (teams) {
+    if (isTeam) {
+      const team = teams.find((t) => String(t.id) === String(teamId))
+      if (team) {
+        teamName = team.name
+        verified = true
+      }
+    } else {
+      // Individual billing: verified as long as we can fetch the authorized
+      // list (i.e. the session is live and the caller is an identified user).
+      verified = true
+    }
+  }
+
+  log("Elliot AI context")
+  log("─────────────────────────────")
+  log(`Signed in: ${displayUser}`)
+  if (isTeam && teamName) {
+    log(`Billing:   Team — ${teamName}`)
+  } else if (isTeam && !teamName) {
+    log("Billing:   Team (name unavailable)")
+  } else {
+    log("Billing:   Individual")
+  }
+  log(`Status:    ${verified ? "Verified" : "Unverified — cannot confirm with the backend"}`)
+  if (isTeam) {
+    log("Action:    Restart EAI to apply the current context")
+  } else {
+    log("Action:    none — requests are charged to your individual budget")
+  }
+  log("")
+  return verified ? 0 : 1
+}
+
+async function runTeamsClear(opts = {}) {
+  const log = opts.log || ((s) => process.stdout.write(s + "\n"))
+  const session = await ensureFreshAccessToken(opts)
+  if (!session) return 1
+  const { token, config } = session
+  const backendUrl = String(opts.backendUrl || config.backend_url || "").replace(/\/+$/, "")
+  if (!backendUrl) {
+    log("No backend configured. Run `eai login` first.")
+    return 1
+  }
+
+  log("Clearing team selection — reverting to individual billing...")
+  try {
+    // No team_id => /onboarding/config resolves the caller's PERSONAL key
+    // (fail-closed if none resolves — never the shared master key).
+    await runSetup({ token, backendUrl, log })
+  } catch (error) {
+    log(String(error && error.message ? error.message : error))
+    log(
+      "Individual billing could not be established. Model execution stays " +
+        "blocked until a personal budgeted credential is available. Contact " +
+        "your administrator.",
+    )
+    return 1
+  }
+  log("")
+  log("Team selection cleared — billing is now Individual.")
+  log("Restart EAI (`eai`) to apply the new context.")
+  return 0
+}
+
+module.exports = {
+  fetchTeams,
+  resolveTeamId,
+  runTeamsList,
+  runTeamsUse,
+  runTeamsCurrent,
+  runTeamsClear,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elliotsystems/eai",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Elliot AI CLI entry point (eai) - launches the Elliot runtime with arguments forwarded verbatim.",
   "bin": {
     "eai": "./bin/eai"
@@ -27,6 +27,6 @@
     "access": "public"
   },
   "dependencies": {
-    "opencode-ai": "1.19.0"
+    "opencode-ai": "1.19.4"
   }
 }

package/plugin/opencode-plugin/src/blocked-turns.ts

@@ -0,0 +1,145 @@
+/**
+ * Strips a Jev-blocked exchange out of what the MODEL sees, before every
+ * chat completion request.
+ *
+ * ## The bug this fixes
+ *
+ * Jev blocking a prompt stops it from ever reaching the model — but the
+ * user's raw text and the resulting error still live on in THIS session's
+ * own message history (needed for the UI: the "Request blocked" card's
+ * "Try again"/"Edit message" actions, and the transcript itself). OpenCode
+ * sends that FULL history with every later turn in the same session, so the
+ * very next (benign) prompt's completion request still carried the earlier,
+ * never-actually-sent "Help me steal someone's password" as an unanswered
+ * prior user turn.
+ *
+ * The model, seeing an unanswered request sitting in its own context,
+ * reasonably tries to be complete and addresses BOTH: the benign question
+ * asked just now, and the flagged one it was never actually asked to answer
+ * but can still see. Reported directly: asking for a C++ Hello World after
+ * an earlier blocked prompt produced a response that opened with a refusal
+ * about password theft before getting to the actual Hello World code —
+ * confusing, and a response to something that was never really asked of it
+ * in the first place (the guardrail is what stopped that request, not the
+ * model declining it; the model never got the chance to).
+ *
+ * ## The fix
+ *
+ * `experimental.chat.messages.transform` (opencode/packages/plugin/src/
+ * index.ts) runs right before the message history is converted to the
+ * provider's wire format (session/prompt.ts, immediately before
+ * `MessageV2.toModelMessagesEffect`). Removing a blocked exchange here means
+ * the model's context for the NEXT turn looks exactly as if the blocked
+ * prompt had never been sent at all — the benign follow-up is answered on
+ * its own, because that is the only thing the model is shown having been
+ * asked.
+ *
+ * This changes ONLY what the model is shown for a NEW completion request.
+ * It does not touch the stored session history (OpenCode's own message
+ * store, read by `GET .../messages`) at all, so the UI's own transcript —
+ * the blocked turn's card, Try again, Edit message — is completely
+ * unaffected; the user still sees exactly what happened. Only the model's
+ * own view of "what has this conversation actually asked of me" changes.
+ *
+ * ## Why in this plugin, not the backend
+ *
+ * The backend's own per-prompt isolation (jev_decisions_logic.py's
+ * `latest_turn_window`) already solves the ANALOGOUS problem for JEV
+ * ITSELF — a later prompt is judged on its own, not against an earlier
+ * flagged one. That fix has no effect here: it narrows what JEV sees when
+ * deciding whether to block, which is a completely different question from
+ * what the MODEL sees for an already-ALLOWED prompt. Once Jev allows a
+ * request through, this plugin — which sits on the client building that
+ * exact request — is the only thing positioned to also narrow what the
+ * model is shown.
+ */
+
+/**
+ * Every wording `jev_policy_guardrail.py`'s `BLOCKED_MESSAGE` has had.
+ * Mirrors `terminal/src/opencode/guardrail.ts`'s own `KNOWN_BLOCKED_
+ * MESSAGES` deliberately rather than importing it (different package,
+ * different runtime — this one ships inside the OpenCode plugin host, that
+ * one inside the Web Chat bundle). Matched by substring for the same reason
+ * that file matches by substring: a message blocked under an older backend
+ * wording still carries that exact text in session history forever, and
+ * this must keep recognizing it as blocked rather than start leaking old
+ * blocked prompts into model context the moment the backend's wording next
+ * changes. Keep all three lists (here, guardrail.ts, and
+ * jev_policy_guardrail.py's own BLOCKED_MESSAGE) in sync.
+ */
+const KNOWN_BLOCKED_MESSAGES = [
+  "Guardrail raised an exception, Guardrail: jev-policy, Message: Blocked by policy:",
+  "Request blocked by EAI's security policy. Please revise your request and try again.",
+  "This message couldn't be sent because it may violate our usage policy. Try rephrasing it, or ask something else.",
+  // The four stage/outcome-distinguishing wordings (Jev audit, 2026-10) --
+  // this file only ever needs flat yes/no detection (strip from model
+  // context, or don't), never which specific kind, so all four are listed
+  // here without the `BlockKind` tagging `terminal/src/opencode/
+  // guardrail.ts`'s own copy carries for its UI. Mirrors
+  // `jev_policy_logic.py`'s four `MESSAGE_*` constants exactly --
+  // `opencode-plugin/test/jev-blocked-message-parity.test.ts` pins it.
+  "This message was blocked by EAI's usage policy. Please rephrase your request and try again.",
+  "EAI couldn't verify this message against its usage policy in time. Please try sending it again.",
+  "EAI's usage policy blocked this response before it reached you. Try rephrasing your request, or ask something else.",
+  "EAI generated a response but couldn't verify it against its usage policy in time. Please try again.",
+]
+
+interface MessageError {
+  name?: unknown
+  data?: { message?: unknown }
+}
+
+interface HistoryEntry {
+  info?: { role?: unknown; error?: unknown; [k: string]: unknown }
+  parts?: unknown[]
+}
+
+function isKnownBlockedText(message: unknown): boolean {
+  return typeof message === "string" && KNOWN_BLOCKED_MESSAGES.some((known) => message.includes(known))
+}
+
+/** `true` for an assistant turn whose `info.error` is a confirmed Jev
+ *  guardrail block — never for an ordinary provider error (rate limit,
+ *  context overflow, a dead connection), which the model legitimately
+ *  needs to see to make sense of its own earlier failed attempt. */
+export function isBlockedAssistantTurn(info: HistoryEntry["info"]): boolean {
+  const error = info?.error as MessageError | undefined
+  if (!error || error.name !== "APIError") return false
+  return isKnownBlockedText(error.data?.message)
+}
+
+/**
+ * Removes every blocked exchange (the blocked assistant turn AND the user
+ * turn immediately before it) from a session's message history. Returns the
+ * SAME array instance when nothing needed removing — the common case, so a
+ * normal, never-blocked session incurs no extra allocation on every turn.
+ *
+ * Walks backward from each blocked assistant turn to find its own user
+ * turn, skipping only turns already claimed by a LATER blocked exchange
+ * (so consecutive blocked turns in the same session each still find their
+ * own user message rather than double-claiming one). Stops looking the
+ * moment it hits another assistant turn first — an unexpected shape (two
+ * assistant turns with no user turn between them) is left alone rather
+ * than guessed at, since removing the wrong turn would be worse than
+ * removing none.
+ */
+export function stripBlockedTurns<T extends HistoryEntry>(messages: T[]): T[] {
+  const drop = new Set<number>()
+
+  for (let i = 0; i < messages.length; i++) {
+    if (messages[i]?.info?.role !== "assistant" || !isBlockedAssistantTurn(messages[i].info)) continue
+    drop.add(i)
+    for (let j = i - 1; j >= 0; j--) {
+      if (drop.has(j)) continue
+      const role = messages[j]?.info?.role
+      if (role === "user") {
+        drop.add(j)
+        break
+      }
+      if (role === "assistant") break
+    }
+  }
+
+  if (drop.size === 0) return messages
+  return messages.filter((_, index) => !drop.has(index))
+}

package/plugin/opencode-plugin/src/elliot-auth.ts

@@ -50,6 +50,16 @@ export interface ElliotConfig {
   backend_url?: string
   litellm_base_url?: string
   litellm_master_key?: string
+  /** The organization this config was written for — present since `eai
+   *  setup` has always spread the onboarding response (which always
+   *  includes it) into this file. Typed here (was previously only reachable
+   *  through the index signature) because guardrail-sync.ts needs it to
+   *  call `GET /teams/{team_id}` with the right tenant context. */
+  tenant_id?: string
+  /** The single team this config was scoped to at `eai setup` time — absent
+   *  for a tenant-wide (owner/admin) setup, which has no one team to check
+   *  a guardrail for. See guardrail-sync.ts. */
+  team_id?: string
   /**
    * Every credential this person can use, personal key first (Phase 4).
    * Absent on a config written by an older `eai setup` (or a backend that