@fungi.computer/truffle 0.0.0-stage → 0.1.1

package/dist/auth-cli.js

@@ -0,0 +1,351 @@
+#!/usr/bin/env node
+import { Readable, Writable } from "node:stream";
+import { Cli } from "@fungi.computer/lantern";
+import { linearAuthInteraction } from "./linear-auth.js";
+export { linearAuthInteraction } from "./linear-auth.js";
+import { parseArgs } from "node:util";
+import { localLoginProviders } from "./local-login.js";
+import { createPrivateModels } from "./local-models.js";
+import { createPrivateCredentialStore } from "./private-file-credential-store.js";
+export { maximumCredentialStringLength as localAuthInputLimit } from "./private-file-credential-store.js";
+function usage() {
+    return "Usage: fungi-local-auth <login|status|logout> [--provider <id>] [--auth-type oauth|api_key] [--method <id>]";
+}
+function parseAuthType(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "oauth" || value === "api_key")
+        return value;
+    throw new Error("--auth-type must be oauth or api_key");
+}
+function writeMessage(output, interaction, message) {
+    if (interaction !== undefined)
+        interaction.notify({ type: "info", message });
+    else
+        output.write(`${message}\n`);
+}
+function providerLabel(provider) {
+    return provider.name === provider.id
+        ? provider.name
+        : `${provider.name} (${provider.id})`;
+}
+/**
+ * Interactive login methods for one provider, from the same registry the
+ * Whistle/TUI picker uses (`localLoginProviders`), so Pi's labels and which
+ * methods count as interactive are decided in exactly one place.
+ */
+function authMethodOptions(provider) {
+    const [entry] = localLoginProviders([provider]);
+    if (entry === undefined)
+        return [];
+    return entry.methods.map((method) => ({
+        id: method.kind === "subscription"
+            ? "oauth"
+            : "api_key",
+        label: method.label,
+    }));
+}
+/** Whether `provider` declares `requested` at all, interactive or not. */
+function declaresAuthType(provider, requested) {
+    return requested === "oauth"
+        ? provider.auth.oauth !== undefined
+        : provider.auth.apiKey !== undefined;
+}
+function terminalInteraction(input, output) {
+    const cli = new Cli({
+        brand: "fungi-local-auth",
+        input: input instanceof Readable ? input : Readable.from(input),
+        output: output instanceof Writable
+            ? output
+            : new Writable({
+                write(chunk, _encoding, callback) {
+                    output.write(chunk);
+                    callback();
+                },
+            }),
+    });
+    return linearAuthInteraction(cli.interactive, cli);
+}
+function interactionFor(signal, input, output, supplied, method, 
+// Known once `login()` resolves the provider, before Pi's own login()
+// runs; stamped onto a forwarded `auth_url` event so linear-auth.ts can
+// head it "Sign in to <provider>" instead of a bare "Sign in".
+providerLabel) {
+    let methodOverride = method;
+    return {
+        signal,
+        prompt: async (prompt) => {
+            if (prompt.type === "select" && methodOverride !== undefined) {
+                const selected = prompt.options.find((option) => option.id === methodOverride);
+                if (selected === undefined)
+                    throw new Error(`Pi auth did not offer method ${methodOverride}`);
+                methodOverride = undefined;
+                return selected.id;
+            }
+            signal.throwIfAborted();
+            const promptSignal = prompt.signal === undefined
+                ? signal
+                : AbortSignal.any([signal, prompt.signal]);
+            return (supplied ?? terminalInteraction(input, output)).prompt({
+                ...prompt,
+                signal: promptSignal,
+            });
+        },
+        notify: (event) => {
+            const augmented = providerLabel === undefined || event.type !== "auth_url"
+                ? event
+                : { ...event, providerLabel };
+            if (supplied === undefined)
+                terminalInteraction(input, output).notify(augmented);
+            else
+                supplied.notify(augmented);
+        },
+    };
+}
+async function chooseProvider(providers, requested, signal, input, output, supplied, message = "Choose a provider") {
+    if (requested !== undefined) {
+        const provider = providers.find((candidate) => candidate.id === requested);
+        if (provider === undefined)
+            throw new Error(`Unknown provider: ${requested}`);
+        return provider;
+    }
+    const id = await interactionFor(signal, input, output, supplied).prompt({
+        type: "select",
+        message,
+        options: providers.map((provider) => ({
+            id: provider.id,
+            label: providerLabel(provider),
+        })),
+    });
+    const provider = providers.find((candidate) => candidate.id === id);
+    if (provider === undefined)
+        throw new Error(`Unknown provider: ${id}`);
+    return provider;
+}
+async function chooseAuthType(provider, requested, signal, input, output, supplied) {
+    if (requested !== undefined) {
+        if (!declaresAuthType(provider, requested))
+            throw new Error(`${providerLabel(provider)} does not offer ${requested} login`);
+        return requested;
+    }
+    const options = authMethodOptions(provider);
+    if (options.length === 0) {
+        // No interactive method (e.g. an ambient-only API key): fall through to
+        // api_key so login() can explain why, the same as an explicit request.
+        if (provider.auth.apiKey !== undefined)
+            return "api_key";
+        throw new Error(`${providerLabel(provider)} has no login method`);
+    }
+    if (options.length === 1) {
+        const only = options[0];
+        if (only === undefined)
+            throw new Error("No login method is available");
+        return only.id;
+    }
+    const id = await interactionFor(signal, input, output, supplied).prompt({
+        type: "select",
+        message: `Choose login method for ${providerLabel(provider)}`,
+        options,
+    });
+    const selected = options.find((option) => option.id === id);
+    if (selected === undefined)
+        throw new Error(`Unknown login method: ${id}`);
+    return selected.id;
+}
+async function login(models, command, signal, input, output, getDeviceId, supplied) {
+    const provider = await chooseProvider(models.getProviders(), command.provider, signal, input, output, supplied);
+    const authType = await chooseAuthType(provider, command.authType, signal, input, output, supplied);
+    if (authType === "api_key" && provider.auth.apiKey?.login === undefined) {
+        const message = `${providerLabel(provider)} uses ambient credentials; configure its environment or provider settings. No credential was changed.`;
+        writeMessage(output, supplied, message);
+        throw new Error(message);
+    }
+    const signInLabel = authType === "oauth" && provider.id === "openai"
+        ? "ChatGPT for Shiitake"
+        : authType === "oauth" && provider.id === "anthropic"
+            ? "Claude for Shiitake"
+            : provider.name;
+    const interaction = interactionFor(signal, input, output, supplied, command.method, signInLabel);
+    // Sign in with ChatGPT needs a stable installation UUID in its authorize
+    // URL (`ext_agent_host_id`); pass it at this one call site, the way Pi's
+    // own coding-agent does, instead of patching Pi's `models.login`. Pi's
+    // option is synchronous, so resolve our (async, disk-backed) device ID
+    // first and hand it a closure over the resolved value.
+    if (provider.id === "openai" && authType === "oauth") {
+        signal.throwIfAborted();
+        const deviceId = await getDeviceId();
+        signal.throwIfAborted();
+        await models.login(provider.id, authType, interaction, {
+            getDeviceId: () => deviceId,
+        });
+    }
+    else {
+        await models.login(provider.id, authType, interaction);
+    }
+    writeMessage(output, supplied, `${signInLabel} login complete.`);
+}
+const credentialLabel = { oauth: "subscription", api_key: "API key" };
+/**
+ * Signed-in providers first, then one summary line; the full catalog only
+ * when one provider is asked for by name.
+ */
+function statusLines(statuses, explicit) {
+    const label = (status) => status.providerName === status.providerId
+        ? status.providerName
+        : `${status.providerName} (${status.providerId})`;
+    const signedIn = statuses.flatMap((status) => status.state === "configured"
+        ? [`${label(status)}: signed in (${credentialLabel[status.type]})`]
+        : []);
+    if (explicit)
+        return [
+            ...signedIn,
+            ...statuses.flatMap((status) => status.state === "unconfigured"
+                ? [`${label(status)}: not signed in`]
+                : []),
+        ];
+    const others = statuses.length - signedIn.length;
+    return signedIn.length === 0
+        ? [
+            `Model providers: none signed in (${String(others)} available). Run fungi login.`,
+        ]
+        : [
+            ...signedIn,
+            `${String(others)} other providers not signed in. Run fungi login to add one.`,
+        ];
+}
+async function status(models, providerId, signal, output, interaction) {
+    const providers = models.getProviders();
+    const selected = providerId === undefined
+        ? providers
+        : providers.filter((provider) => provider.id === providerId);
+    if (selected.length === 0)
+        throw new Error(`Unknown provider: ${providerId ?? "(all providers)"}`);
+    const statuses = [];
+    for (const provider of selected) {
+        const checked = await models.checkAuth(provider.id, { signal });
+        statuses.push(checked === undefined
+            ? {
+                providerId: provider.id,
+                providerName: provider.name,
+                state: "unconfigured",
+            }
+            : {
+                providerId: provider.id,
+                providerName: provider.name,
+                state: "configured",
+                type: checked.type,
+            });
+    }
+    for (const line of statusLines(statuses, providerId !== undefined))
+        writeMessage(output, interaction, line);
+    return {
+        kind: "status",
+        providers: Object.freeze(statuses.map((providerStatus) => Object.freeze(providerStatus))),
+    };
+}
+async function signedInProviders(models, providers, signal) {
+    const signedIn = [];
+    for (const provider of providers)
+        if ((await models.checkAuth(provider.id, { signal })) !== undefined)
+            signedIn.push(provider);
+    return signedIn;
+}
+async function runCommand(command, models, signal, input, output, getDeviceId, interaction) {
+    if (command.type === "status")
+        return status(models, command.provider, signal, output, interaction);
+    if (command.type === "login") {
+        await login(models, command, signal, input, output, getDeviceId, interaction);
+        return { kind: "completed" };
+    }
+    const providers = models.getProviders();
+    const candidates = command.provider === undefined
+        ? await signedInProviders(models, providers, signal)
+        : providers;
+    if (candidates.length === 0) {
+        writeMessage(output, interaction, "You're not signed in to any model provider. Nothing to log out of.");
+        return { kind: "completed" };
+    }
+    const provider = await chooseProvider(candidates, command.provider, signal, input, output, interaction, "Log out of which provider?");
+    await models.logout(provider.id, { signal });
+    writeMessage(output, interaction, `${providerLabel(provider)} logout complete.`);
+    return { kind: "completed" };
+}
+function parseCommand(argv) {
+    const parsed = parseArgs({
+        args: [...argv],
+        allowPositionals: true,
+        strict: true,
+        options: {
+            help: { type: "boolean", short: "h" },
+            provider: { type: "string" },
+            "auth-type": { type: "string" },
+            method: { type: "string" },
+        },
+    });
+    const command = parsed.positionals[0] ?? "help";
+    if (parsed.values.help === true || command === "help")
+        return { type: "help" };
+    if (parsed.positionals.length !== 1)
+        throw new Error(usage());
+    const provider = parsed.values.provider;
+    const method = parsed.values.method;
+    const authType = parseAuthType(parsed.values["auth-type"]);
+    if (command === "login") {
+        const result = { type: "login" };
+        if (provider !== undefined)
+            result.provider = provider;
+        if (authType !== undefined)
+            result.authType = authType;
+        if (method !== undefined)
+            result.method = method === "device-code" ? "device_code" : method;
+        return result;
+    }
+    if (method !== undefined || authType !== undefined)
+        throw new Error("--auth-type and --method apply only to login");
+    if (command === "status" || command === "logout") {
+        const result = {
+            type: command,
+        };
+        if (provider !== undefined)
+            result.provider = provider;
+        return result;
+    }
+    throw new Error(usage());
+}
+export async function runLocalAuthCli(argv, options = {}) {
+    const output = options.output ?? process.stdout;
+    const command = parseCommand(argv);
+    if (command.type === "help") {
+        output.write(`${usage()}\n`);
+        return { kind: "completed" };
+    }
+    const controller = new AbortController();
+    const signals = options.signals ?? process;
+    const abort = () => {
+        controller.abort();
+    };
+    signals.once("SIGINT", abort);
+    signals.once("SIGTERM", abort);
+    const getDeviceId = options.getDeviceId ?? (() => createPrivateCredentialStore().getDeviceId());
+    try {
+        return await runCommand(command, options.models ?? createPrivateModels(), options.interaction?.signal === undefined
+            ? controller.signal
+            : AbortSignal.any([controller.signal, options.interaction.signal]), options.input ?? process.stdin, output, getDeviceId, options.interaction);
+    }
+    finally {
+        signals.removeListener("SIGINT", abort);
+        signals.removeListener("SIGTERM", abort);
+    }
+}
+if (import.meta.main) {
+    const cli = new Cli({ brand: "fungi-local-auth" });
+    if (cli.interactive)
+        cli.welcome("Provider login for your local agents.");
+    runLocalAuthCli(process.argv.slice(2), {
+        interaction: linearAuthInteraction(cli.interactive, cli),
+    }).catch((cause) => {
+        // Provider messages can contain credentials; keep the diagnostic bounded.
+        process.stderr.write(`Local authentication command failed (${cause instanceof Error ? cause.name : "NonError"}).\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/fungi-account-command.d.ts

@@ -0,0 +1,18 @@
+import type { FetchLike } from "@modelcontextprotocol/client";
+export type FungiAccountCommand = Readonly<{
+    action: "status" | "teams" | "balance";
+}> | Readonly<{
+    action: "use-team";
+    teamId: string;
+}>;
+export type FungiAccountCommandOptions = Readonly<{
+    json: boolean;
+    stdout: Readonly<{
+        write: (text: string) => void;
+    }>;
+    credentialPath?: string | undefined;
+    fetch?: FetchLike | undefined;
+}>;
+export declare const fungiAccountCommandHelp = "Usage: fungi account [--json]\n       fungi account teams [--json]\n       fungi account use-team <team-id>\n       fungi account balance [--json]\n\nRead the signed-in Fungi account without exposing its credentials. The plain\ncommand shows the Hub and the Team that pays for models; teams lists your\ncurrent memberships; use-team selects one of them (the prior Team is kept when\nyou are not a current member); balance reads that Team's credit when you may\nsee its billing.\n";
+/** `fungi account`: non-secret reads over Local's one Fungi account owner. */
+export declare function runFungiAccountCommand(command: FungiAccountCommand, options: FungiAccountCommandOptions): Promise<void>;

package/dist/fungi-account-command.js

@@ -0,0 +1,92 @@
+import { readFungiAccountStatus, readFungiAccountTeams, readFungiTeamBalance, switchFungiAccountTeam, } from "./private-fungi-account.js";
+export const fungiAccountCommandHelp = `Usage: fungi account [--json]
+       fungi account teams [--json]
+       fungi account use-team <team-id>
+       fungi account balance [--json]
+
+Read the signed-in Fungi account without exposing its credentials. The plain
+command shows the Hub and the Team that pays for models; teams lists your
+current memberships; use-team selects one of them (the prior Team is kept when
+you are not a current member); balance reads that Team's credit when you may
+see its billing.
+`;
+function teamFields({ teamId, handle, name }) {
+    return { teamId, handle, name };
+}
+/** `fungi account`: non-secret reads over Local's one Fungi account owner. */
+export async function runFungiAccountCommand(command, options) {
+    const owner = {};
+    if (options.credentialPath !== undefined)
+        owner.credentialPath = options.credentialPath;
+    if (options.fetch !== undefined)
+        owner.fetch = options.fetch;
+    const emit = (reply, text) => {
+        options.stdout.write(options.json
+            ? `${JSON.stringify({ schemaVersion: 1, ...reply })}\n`
+            : `${text}\n`);
+    };
+    if (command.action === "use-team") {
+        await switchFungiAccountTeam(command.teamId, owner);
+        const team = (await readFungiAccountStatus(owner))?.team;
+        emit({ team: team === undefined ? undefined : teamFields(team) }, `Fungi models now bill ${team?.name ?? command.teamId}.`);
+        return;
+    }
+    const status = await readFungiAccountStatus(owner);
+    if (status === undefined) {
+        emit({ signedIn: false }, "Not signed in to Fungi. Run fungi login --provider fungi.");
+        return;
+    }
+    if (command.action === "teams") {
+        const { teams, selectedTeamId } = await readFungiAccountTeams(owner);
+        emit({
+            teams: teams.map((team) => ({
+                ...teamFields(team),
+                selected: team.teamId === selectedTeamId,
+            })),
+        }, teams
+            .map((team) => `${team.teamId === selectedTeamId ? "*" : " "} ${team.name} (${team.handle}) ${team.teamId}`)
+            .join("\n") || "You are not a member of any Team.");
+        return;
+    }
+    if (command.action === "balance") {
+        const balance = await readFungiTeamBalance(owner);
+        emit(balanceReply(balance), balanceText(balance));
+        return;
+    }
+    const reply = {
+        signedIn: true,
+        hub: status.issuer,
+        accessExpiresAt: status.accessExpiresAt.toISOString(),
+    };
+    if (status.team !== undefined)
+        reply.team = teamFields(status.team);
+    if (status.teamCount !== undefined)
+        reply.teamCount = status.teamCount;
+    emit(reply, `Signed in to ${status.issuer}. ${status.team === undefined ? "No Team selected for Fungi models." : `Fungi models bill ${status.team.name} (${status.team.handle}).`}`);
+}
+function balanceReply(balance) {
+    if (balance.kind === "not-available")
+        return {
+            kind: balance.kind,
+            reason: balance.reason,
+        };
+    const { teamId, ...credit } = balance.credit;
+    return { kind: balance.kind, teamId, credit };
+}
+function dollars(money) {
+    const cents = BigInt(money.amount) / 10n ** BigInt(money.scale - 2);
+    const whole = cents / 100n;
+    const rest = (cents % 100n).toString().padStart(2, "0");
+    return `$${whole.toString()}.${rest}`;
+}
+function balanceText(balance) {
+    if (balance.kind === "balance")
+        return `Available ${dollars(balance.credit.available)} (purchased ${dollars(balance.credit.balance)}, reserved ${dollars(balance.credit.reserved)}${balance.credit.included === null ? "" : `, included ${dollars(balance.credit.included.remaining)} left`}).`;
+    if (balance.reason === "no-team")
+        return "No Team selected. Run fungi account use-team <team-id>.";
+    if (balance.reason === "not-a-member")
+        return "You are not a current member of the selected Team. Run fungi account teams.";
+    if (balance.reason === "sign-in-again")
+        return "This sign-in lacks billing permission. Run fungi login --provider fungi again.";
+    return "This Fungi Hub does not admit Local sign-ins for Team balance.";
+}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export { createPrivateCredentialStore, resolveDefaultCredentialPath, } from "./private-file-credential-store.js";
+export type { PrivateCredentialStore } from "./private-file-credential-store.js";
+export { createPrivateModels, registerPrivateBundledModelOAuthFlows, listPrivateModels, type PrivateLocalModelChoice, } from "./local-models.js";
+export { defaultLocalModel } from "./private-local-default-model.js";
+export { createPrivateInvocationFilesPort } from "./private-invocation-files.js";
+export { createPrivateInvocationComputer } from "./private-invocation-computer.js";
+export { ensurePrivateLocalGitExclude } from "./private-local-git-exclude.js";
+export { createPrivateWorkerdSandbox } from "./private-workerd-sandbox.js";
+export { signInFungiAccount, launchPlatformBrowser, signOutFungiAccount, readFungiAccountStatus, switchFungiAccountTeam, freshFungiAccess, createFungiAccountOAuth, createFungiAccountCredentialStore, type FungiAccountTeam, type PrivateFungiAccountLoginOptions, type PrivateFungiAccountLogoutResult, } from "./private-fungi-account.js";
+export { fungiAccountCommandHelp, runFungiAccountCommand, type FungiAccountCommand, } from "./fungi-account-command.js";
+export type { PrivateFungiMcpConnectionOptions } from "./private-fungi-mcp-connection.js";
+export { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
+export { attachPrivateLocalComputer, detachPrivateLocalComputer, listPrivateLocalComputers, runPrivateLocalComputer, type PrivateLocalComputerAttachResult, type PrivateLocalComputerDetachResult, } from "./private-local-computer-attach.js";
+export { openPrivateLocalRuntimeHost, type PrivateLocalRuntimeHost, type PrivateLocalRuntimeHostOptions, } from "./private-local-runtime-host.js";
+export { openPrivateLocalShiitakeHost, openPrivateLocalShiitakeWorkerBatch, type PrivateLocalShiitakeHost, type PrivateLocalShiitakeHostOpener, type PrivateLocalShiitakeServer, type PrivateLocalShiitakeServerOpener, type PrivateLocalShiitakeWorkerBatch, type PrivateLocalShiitakeWorkerInput, type PrivateLocalShiitakeWorkerRoute, } from "./private-local-shiitake-host.js";
+export { createPrivateLocalServiceManager, LocalSessionPathConflict, runPrivateLocalWorkerServer, type PrivateLocalServiceConnection, type PrivateLocalServiceManager, type PrivateLocalServiceRequestOptions, type PrivateLocalServiceSelection, type PrivateLocalServiceStatus, type PrivateLocalSessionChoice, type PrivateLocalSessionDiscovery, type PrivateLocalSessionInspection, type PrivateLocalSessionProblem, type PrivateLocalWorkerServerIo, } from "./private-local-service.js";
+export { createPrivateLocalAcpAgent, runPrivateLocalAcpStdio, type LocalAcpStdioOptions, } from "./private-local-acp-stdio.js";
+export { listPrivateTeamComputers, startPrivateTeamComputer, } from "./private-team-computers.js";
+export { runTrackerGitCredential } from "./tracker-git-credential.js";

package/dist/index.js

@@ -0,0 +1,17 @@
+export { createPrivateCredentialStore, resolveDefaultCredentialPath, } from "./private-file-credential-store.js";
+export { createPrivateModels, registerPrivateBundledModelOAuthFlows, listPrivateModels, } from "./local-models.js";
+export { defaultLocalModel } from "./private-local-default-model.js";
+export { createPrivateInvocationFilesPort } from "./private-invocation-files.js";
+export { createPrivateInvocationComputer } from "./private-invocation-computer.js";
+export { ensurePrivateLocalGitExclude } from "./private-local-git-exclude.js";
+export { createPrivateWorkerdSandbox } from "./private-workerd-sandbox.js";
+export { signInFungiAccount, launchPlatformBrowser, signOutFungiAccount, readFungiAccountStatus, switchFungiAccountTeam, freshFungiAccess, createFungiAccountOAuth, createFungiAccountCredentialStore, } from "./private-fungi-account.js";
+export { fungiAccountCommandHelp, runFungiAccountCommand, } from "./fungi-account-command.js";
+export { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
+export { attachPrivateLocalComputer, detachPrivateLocalComputer, listPrivateLocalComputers, runPrivateLocalComputer, } from "./private-local-computer-attach.js";
+export { openPrivateLocalRuntimeHost, } from "./private-local-runtime-host.js";
+export { openPrivateLocalShiitakeHost, openPrivateLocalShiitakeWorkerBatch, } from "./private-local-shiitake-host.js";
+export { createPrivateLocalServiceManager, LocalSessionPathConflict, runPrivateLocalWorkerServer, } from "./private-local-service.js";
+export { createPrivateLocalAcpAgent, runPrivateLocalAcpStdio, } from "./private-local-acp-stdio.js";
+export { listPrivateTeamComputers, startPrivateTeamComputer, } from "./private-team-computers.js";
+export { runTrackerGitCredential } from "./tracker-git-credential.js";