@gentbajko/slopify 1.3.1 → 1.4.1

package/README.md

@@ -30,13 +30,19 @@ slopify
 
 Both commands launch the same local app.
 
-For Docker on Linux, use `slopify --docker` or
+For Docker on Linux with systemd, use `slopify --docker` or
 `npx @gentbajko/slopify@latest --docker`. The launcher detects installed Codex,
-Claude Code, and Gemini CLIs and mounts them read-only. It runs in the background,
-restarts with Docker, and keeps your data in `slopify-data`. Run it again after
-upgrading a CLI to refresh its mounts. Add `--port 7070` to change the default port.
-CLI credentials stay separate; sign in once inside the container. See the
-[Docker setup guide](https://github.com/GentBajko/slopify#docker) for login commands.
+Claude Code and Gemini CLIs. It asks once before installing a private host helper
+and enabling automatic startup, including user lingering. The CLIs run on your
+host with their existing logins; credentials never move into Docker.
+
+Slopify runs in the background, restarts with Docker and keeps your data in
+`slopify-data`. Add `--port 7070` to change the default port. Rerun the launcher
+after changing host CLI installations or search paths. Native installs need no helper.
+Plain `docker run` is API-only without a configured helper. Use `--host-cli=off`
+for API-only launcher setup, or `--accept-host-cli` to approve non-interactive setup.
+See the [Docker setup guide](https://github.com/GentBajko/slopify#docker) for
+updates and the dedicated helper's status/disable commands.
 
 ## How to use it
 

package/dist/adapter-registry.js

@@ -14,6 +14,7 @@ import { cartesiaTts } from "./adapters/tts/cartesia.js";
 import { elevenLabsTts } from "./adapters/tts/elevenlabs.js";
 import { inworldTts } from "./adapters/tts/inworld.js";
 import { openAiTts } from "./adapters/tts/openai.js";
+import { hostLlmIds } from "./kernel/ports/host-cli.js";
 import { cliBinary } from "./slices/settings/cli-paths.js";
 import { keyForAttempt } from "./slices/settings/keys.js";
 import { providerStatuses } from "./slices/settings/readiness.js";
@@ -74,13 +75,22 @@ export function buildRegistry(deps) {
         ["google-image", googleImage({ fetch: deps.fetch, key: keyOf("google-image") })],
         ["codex-image", codexImage({ run: cliFor("codex") })],
     ]);
+    if (deps.hostCli) {
+        for (const id of hostLlmIds)
+            llms.set(id, deps.hostCli.llm(id));
+        images.set("codex-image", deps.hostCli.image);
+    }
     return {
         llm: (id) => resolve(llms, "llm", id),
         tts: (id) => resolve(ttses, "tts", id),
         image: (id) => resolve(images, "image", id),
         // Every supported provider, keyed or not, found or not, so Play
         // can grey one out with a reason instead of hiding it.
-        list: async () => (await providerStatuses({ db: deps.db, probe: deps.probe })).map((status) => ({
+        list: async () => (await providerStatuses({
+            db: deps.db,
+            probe: deps.probe,
+            hostCliStatus: deps.hostCli?.status,
+        })).map((status) => ({
             family: status.family,
             id: status.id,
             name: status.displayName,

package/dist/adapters/host-cli/index.js

@@ -0,0 +1,192 @@
+import { redact } from "../../kernel/log.js";
+import { bridgeLimits, hostFaultSchema, hostFrameSchema, hostHealthSchema, hostImageSchema, hostLlmSchema, hostModelsSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
+import { isProviderError, providerError } from "../../kernel/ports/model.js";
+import { sniffImage } from "../image/bytes.js";
+import { hostRequest, hostUnavailable, readHostBytes, } from "./transport.js";
+export function createHostCliClient(options) {
+    async function request(input) {
+        if (!options.directory)
+            throw hostUnavailable();
+        const response = await hostRequest({ ...input, directory: options.directory });
+        if (response.statusCode !== 200) {
+            try {
+                const parsed = hostFaultSchema.safeParse(JSON.parse((await readHostBytes(response, bridgeLimits.status)).toString("utf8")));
+                if (parsed.success)
+                    throw providerError({ kind: parsed.data.kind, message: redact(parsed.data.message) });
+            }
+            catch (error) {
+                if (isProviderError(error))
+                    throw error;
+            }
+            throw hostUnavailable(input.method === "POST");
+        }
+        return response;
+    }
+    async function metadata(path, schema, signal = AbortSignal.timeout(35_000)) {
+        const response = await request({ path, method: "GET", kind: "metadata", signal });
+        try {
+            if (response.headers["content-type"]?.split(";")[0] !== "application/json")
+                throw hostUnavailable();
+            const bytes = await readHostBytes(response, path.includes("/models/") ? bridgeLimits.models : bridgeLimits.status);
+            return schema.parse(JSON.parse(bytes.toString("utf8")));
+        }
+        catch {
+            throw hostUnavailable();
+        }
+        finally {
+            response.destroy();
+        }
+    }
+    async function ready(signal) {
+        const health = await metadata("/v1/health", hostHealthSchema, signal);
+        if (!health.accepting)
+            throw hostUnavailable();
+    }
+    const models = async (id) => (await metadata(`/v1/models/${id}`, hostModelsSchema)).models.map((model) => ({
+        id: model.id,
+        name: model.name,
+        ...(model.group === undefined ? {} : { group: model.group }),
+        ...(model.thinkingModes === undefined ? {} : { thinkingModes: model.thinkingModes }),
+    }));
+    return {
+        status: async (id) => {
+            try {
+                const status = await metadata(`/v1/status/${id}`, hostStatusSchema);
+                if (status.id !== id)
+                    throw hostUnavailable();
+                return {
+                    id: status.id,
+                    command: status.command,
+                    installed: status.installed,
+                    login: status.login,
+                    ...(status.version === undefined ? {} : { version: status.version }),
+                    ...(status.issueKind === undefined ? {} : { issueKind: status.issueKind }),
+                    ...(status.issue === undefined ? {} : { issue: status.issue }),
+                };
+            }
+            catch {
+                return {
+                    id,
+                    command: id === "claude-code" ? "claude" : id === "codex-image" ? "codex" : id,
+                    installed: false,
+                    login: "unknown",
+                    issueKind: "bridge",
+                    issue: hostUnavailable().message,
+                };
+            }
+        },
+        llm: (id) => ({
+            id,
+            capabilities: { streams: true, reportsUsage: true, webSearch: true },
+            models: () => models(id),
+            complete: async function* (req) {
+                const parsed = hostLlmSchema.safeParse({
+                    model: req.model,
+                    messages: req.messages,
+                    ...(req.thinking === undefined ? {} : { thinking: req.thinking }),
+                    ...(req.webSearch === undefined ? {} : { webSearch: req.webSearch }),
+                });
+                if (!parsed.success)
+                    throw providerError({ kind: "unsupported", message: "Invalid host LLM request." });
+                await ready(req.signal);
+                const response = await request({
+                    path: `/v1/llm/${id}`,
+                    method: "POST",
+                    kind: "llm",
+                    body: Buffer.from(JSON.stringify(parsed.data)),
+                    signal: req.signal,
+                });
+                try {
+                    if (response.headers["content-type"]?.split(";")[0] !== "application/x-ndjson")
+                        throw hostUnavailable(true);
+                    yield* readEvents(response);
+                }
+                catch (error) {
+                    if (isProviderError(error))
+                        throw error;
+                    throw hostUnavailable(true);
+                }
+                finally {
+                    response.destroy();
+                }
+            },
+        }),
+        image: {
+            id: "codex-image",
+            models: () => models("codex-image"),
+            generate: async (req) => {
+                const parsed = hostImageSchema.safeParse({
+                    model: req.model,
+                    prompt: req.prompt,
+                    aspect: req.aspect,
+                });
+                if (!parsed.success)
+                    throw providerError({ kind: "unsupported", message: "Invalid host image request." });
+                await ready(req.signal);
+                const response = await request({
+                    path: "/v1/image",
+                    method: "POST",
+                    kind: "image",
+                    body: Buffer.from(JSON.stringify(parsed.data)),
+                    signal: req.signal,
+                });
+                try {
+                    const mime = response.headers["content-type"];
+                    if (mime !== "image/png" && mime !== "image/jpeg")
+                        throw hostUnavailable(true);
+                    const bytes = await readHostBytes(response, bridgeLimits.image);
+                    if (sniffImage(bytes) !== mime)
+                        throw hostUnavailable(true);
+                    return { bytes, mime };
+                }
+                catch (error) {
+                    if (isProviderError(error))
+                        throw error;
+                    throw hostUnavailable(true);
+                }
+                finally {
+                    response.destroy();
+                }
+            },
+        },
+    };
+}
+async function* readEvents(response) {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    let pending = "";
+    let total = 0;
+    let terminal;
+    for await (const bytes of response) {
+        if (!Buffer.isBuffer(bytes))
+            throw hostUnavailable(true);
+        total += bytes.byteLength;
+        if (total > bridgeLimits.stream)
+            throw hostUnavailable(true);
+        pending += decoder.decode(bytes, { stream: true });
+        let newline = pending.indexOf("\n");
+        while (newline !== -1) {
+            const line = pending.slice(0, newline);
+            pending = pending.slice(newline + 1);
+            if (Buffer.byteLength(line) + 1 > bridgeLimits.frame)
+                throw hostUnavailable(true);
+            if (line.trim() !== "") {
+                if (terminal)
+                    throw hostUnavailable(true);
+                const event = hostFrameSchema.parse(JSON.parse(line));
+                if (event.type === "error")
+                    throw providerError({ kind: event.kind, message: redact(event.message) });
+                if (event.type === "done")
+                    terminal = event;
+                else
+                    yield event;
+            }
+            newline = pending.indexOf("\n");
+        }
+        if (Buffer.byteLength(pending) >= bridgeLimits.frame)
+            throw hostUnavailable(true);
+    }
+    pending += decoder.decode();
+    if (!response.complete || pending.trim() !== "" || !terminal)
+        throw hostUnavailable(true);
+    yield terminal;
+}

package/dist/adapters/host-cli/transport.js

@@ -0,0 +1,135 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { request } from "node:http";
+import { join } from "node:path";
+import { bridgeLimits } from "../../kernel/ports/host-cli.js";
+import { providerError } from "../../kernel/ports/model.js";
+export function hostUnavailable(submitted = false) {
+    return providerError({
+        kind: "unavailable",
+        message: submitted
+            ? "The host CLI connection ended without a reliable result; the result may be uncertain. Review the affected rebuild before retrying."
+            : "Host helper unavailable. Run npx @gentbajko/slopify@latest --docker on the host to set it up or check its service.",
+    });
+}
+async function tokenAt(directory) {
+    const file = await open(join(directory, "token"), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size !== 64 || (stat.mode & 0o022) !== 0)
+            throw hostUnavailable();
+        const bytes = Buffer.alloc(65);
+        const { bytesRead } = await file.read(bytes, 0, 65, 0);
+        const value = bytes.subarray(0, bytesRead).toString("utf8");
+        if (!/^[a-f0-9]{64}$/.test(value))
+            throw hostUnavailable();
+        return value;
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function hostRequest(options) {
+    if (options.body && options.body.byteLength > bridgeLimits.request)
+        throw providerError({
+            kind: "unsupported",
+            message: "The host provider request exceeds 16 MiB.",
+        });
+    let token;
+    try {
+        options.signal.throwIfAborted();
+        token = await tokenAt(options.directory);
+    }
+    catch {
+        throw hostUnavailable();
+    }
+    return new Promise((resolve, reject) => {
+        let response;
+        let submitted = false;
+        const req = request({
+            socketPath: join(options.directory, "cli.sock"),
+            path: options.path,
+            method: options.method,
+            agent: false,
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json",
+                ...(options.body ? { "content-length": options.body.byteLength } : {}),
+            },
+        }, (incoming) => {
+            response = incoming;
+            const maximum = options.kind === "image"
+                ? bridgeLimits.image
+                : options.kind === "llm"
+                    ? bridgeLimits.stream
+                    : options.path.includes("/models/")
+                        ? bridgeLimits.models
+                        : bridgeLimits.status;
+            const advertised = Number(incoming.headers["content-length"] ?? 0);
+            if (!Number.isFinite(advertised) || advertised > maximum) {
+                fail();
+                return;
+            }
+            incoming.once("error", () => { });
+            incoming.once("close", cleanup);
+            resolve(incoming);
+        });
+        const fail = () => {
+            const error = hostUnavailable(submitted);
+            response?.destroy(error);
+            req.destroy(error);
+            reject(error);
+        };
+        const connectTimer = setTimeout(fail, 5000);
+        const deadline = setTimeout(fail, options.kind === "image" ? 300_000 : options.kind === "metadata" ? 35_000 : 120_000);
+        const cleanup = () => {
+            clearTimeout(connectTimer);
+            clearTimeout(deadline);
+            options.signal.removeEventListener("abort", fail);
+        };
+        req.once("socket", (socket) => {
+            socket.once("connect", () => {
+                clearTimeout(connectTimer);
+                submitted = options.method === "POST";
+            });
+        });
+        req.on("error", () => {
+            cleanup();
+            const error = hostUnavailable(submitted);
+            response?.destroy(error);
+            reject(error);
+        });
+        if (options.kind === "llm") {
+            req.on("response", () => clearTimeout(deadline));
+            req.setTimeout(120_000, fail);
+        }
+        options.signal.addEventListener("abort", fail, { once: true });
+        if (options.signal.aborted)
+            fail();
+        else
+            req.end(options.body);
+    });
+}
+export async function readHostBytes(response, maximum) {
+    const chunks = [];
+    let length = 0;
+    try {
+        for await (const value of response) {
+            if (!Buffer.isBuffer(value))
+                throw hostUnavailable();
+            length += value.byteLength;
+            if (length > maximum)
+                throw providerError({
+                    kind: "unavailable",
+                    message: "Host response exceeded its size limit.",
+                });
+            chunks.push(value);
+        }
+        if (!response.complete)
+            throw hostUnavailable();
+        return Buffer.concat(chunks, length);
+    }
+    finally {
+        response.destroy();
+    }
+}

package/dist/adapters/image/codex.js

@@ -2,7 +2,9 @@ import { closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync, read
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
+import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
+import { cliLoginError } from "../llm/cli-login-error.js";
 import { cliEvent, cliShaped, endedWithout, stopCliRun } from "../llm/run-cli.js";
 import { lines } from "../llm/sse-lines.js";
 import { sniffImage } from "./bytes.js";
@@ -111,18 +113,24 @@ export function codexImage(deps) {
                         completed = true;
                     else if (event.type === "turn.failed") {
                         const message = cliShaped(binary, failure, event.value).error.message;
+                        const login = cliLoginError("codex", message);
+                        if (login)
+                            throw login;
                         throw providerError({
                             kind: /refus|content.policy|safety/i.test(message) ? "refusal" : "other",
-                            message: "Codex image generation did not complete.",
+                            message: redact(message),
                         });
                     }
                     else if (event.type === "error") {
                         const message = cliShaped(binary, errorEvent, event.value).message;
+                        const login = cliLoginError("codex", message);
+                        if (login)
+                            throw login;
                         throw providerError({
                             kind: /image.generation|image tool|feature.*unavailable/i.test(message)
                                 ? "unsupported"
                                 : "other",
-                            message: "Codex image generation is unavailable.",
+                            message: redact(message),
                         });
                     }
                     else if (event.type === "item.completed") {
@@ -138,10 +146,11 @@ export function codexImage(deps) {
                 if (ended.error !== null)
                     throw providerError({ kind: "unsupported", message: "Could not start the Codex CLI." });
                 if (ended.code !== 0 || !completed)
-                    throw providerError({
-                        kind: unavailable ? "unsupported" : "other",
-                        message: endedWithout(binary, ended, run.stderr()),
-                    });
+                    throw (cliLoginError("codex", run.stderr()) ??
+                        providerError({
+                            kind: unavailable ? "unsupported" : "other",
+                            message: endedWithout(binary, ended, run.stderr()),
+                        }));
                 if (unavailable)
                     throw providerError({
                         kind: "unsupported",

package/dist/adapters/llm/claude-code-models.js

@@ -51,6 +51,7 @@ function discoveryEnv() {
         "XDG_CONFIG_HOME",
         "XDG_DATA_HOME",
         "XDG_CACHE_HOME",
+        "CLAUDE_CONFIG_DIR",
         "PATH",
         "PATHEXT",
         "LANG",

package/dist/adapters/llm/claude-code.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
 import { nodeClaudeCodeModels } from "./claude-code-models.js";
+import { cliLoginError } from "./cli-login-error.js";
 import { cliEvent, cliShaped, endedWithout, promptOf, stopCliRun } from "./run-cli.js";
 import { lines } from "./sse-lines.js";
 // The local-agent adapter for Claude Code: spawned non-interactively, authenticated by the
@@ -95,6 +96,9 @@ export function claudeCodeLlm(deps) {
                 }
                 const result = cliShaped(binary, resultEvent, event.value);
                 if (result.is_error === true || result.subtype !== "success") {
+                    const login = cliLoginError("claude-code", result.result ?? result.subtype);
+                    if (login)
+                        throw login;
                     throw providerError({
                         kind: kindOf(result.api_error_status ?? null),
                         message: redact(result.result ?? result.subtype),
@@ -124,6 +128,9 @@ export function claudeCodeLlm(deps) {
         // be reported as the provider failing.
         req.signal.throwIfAborted();
         // The stream ended with no result event at all.
+        const login = cliLoginError("claude-code", run.stderr());
+        if (login)
+            throw login;
         throw providerError({
             kind: "other",
             message: ended === undefined

package/dist/adapters/llm/cli-login-error.js

@@ -0,0 +1,16 @@
+import { providerError } from "../../kernel/ports/model.js";
+export function cliLoginError(provider, text) {
+    if (/invalid api key/i.test(text))
+        return undefined;
+    if (!/not logged in|please (?:run|use)\s+\/login|run\s+codex\s+login|authentication required|(?:access|refresh) token.*(?:expired|could not be refreshed|already used)/i.test(text))
+        return undefined;
+    const command = provider === "claude-code"
+        ? "claude auth login"
+        : provider === "gemini"
+            ? "gemini"
+            : "codex login";
+    return providerError({
+        kind: "missing_key",
+        message: `${provider}: sign in on the machine running the CLI with ${command}, then review the affected rebuild.`,
+    });
+}

package/dist/adapters/llm/codex.js

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
+import { cliLoginError } from "./cli-login-error.js";
 import { nodeCodexModels } from "./codex-models.js";
 import { cliEvent, cliShaped, endedWithout, promptOf, stopCliRun } from "./run-cli.js";
 import { lines } from "./sse-lines.js";
@@ -137,12 +138,18 @@ export function codexLlm(deps) {
                     return;
                 }
                 if (event.type === "turn.failed") {
+                    const login = cliLoginError("codex", cliShaped(binary, turnFailed, event.value).error.message);
+                    if (login)
+                        throw login;
                     throw providerError({
                         kind: "other",
                         message: redact(cliShaped(binary, turnFailed, event.value).error.message),
                     });
                 }
                 if (event.type === "error") {
+                    const login = cliLoginError("codex", cliShaped(binary, errorEvent, event.value).message);
+                    if (login)
+                        throw login;
                     throw providerError({
                         kind: "other",
                         message: redact(cliShaped(binary, errorEvent, event.value).message),
@@ -168,6 +175,9 @@ export function codexLlm(deps) {
         // be reported as the provider failing.
         req.signal.throwIfAborted();
         // The stream ended with neither a completed turn nor a failure.
+        const login = cliLoginError("codex", run.stderr());
+        if (login)
+            throw login;
         throw providerError({
             kind: "other",
             message: ended === undefined

package/dist/edge/cli.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { configFrom } from "../kernel/config/index.js";
@@ -15,16 +18,49 @@ const { values } = parseArgs({
         "data-dir": { type: "string" },
         "no-open": { type: "boolean" },
         docker: { type: "boolean" },
+        "host-cli": { type: "string" },
+        "accept-host-cli": { type: "boolean" },
     },
 });
 try {
+    if ((values["host-cli"] !== undefined || values["accept-host-cli"] !== undefined) &&
+        !values.docker)
+        throw new Error("Host CLI options require --docker.");
+    if (values["host-cli"] !== undefined && values["host-cli"] !== "off")
+        throw new Error("The --host-cli override supports only off (API-only Docker).");
     if (values.docker) {
         if (values.host !== undefined || values["data-dir"] !== undefined)
             throw new Error("Docker stores data in the slopify-data volume and binds to localhost. Use --port to change its port.");
+        const { prepareDockerHostCli } = await import("./docker.js");
+        const { nodeHostSetupRunner } = await import("../host-cli/install.js");
+        const bridge = await prepareDockerHostCli({
+            root: join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local/share"), "slopify/host-cli"),
+            version: readVersion(),
+            image: process.env.SLOPIFY_DOCKER_IMAGE ?? "ghcr.io/gentbajko/slopify:latest",
+            disabled: values["host-cli"] === "off",
+            accepted: values["accept-host-cli"] === true,
+            interactive: process.stdin.isTTY === true,
+            env: process.env,
+            signal: AbortSignal.timeout(20 * 60_000),
+            runner: nodeHostSetupRunner,
+            prompt: async (message) => {
+                const terminal = createInterface({ input: process.stdin, output: process.stdout });
+                try {
+                    return /^(?:y|yes)$/i.test((await terminal.question(message)).trim());
+                }
+                finally {
+                    terminal.close();
+                }
+            },
+        });
+        console.log(bridge.directory
+            ? "Host CLI helper ready. Existing CLI logins stay on the host."
+            : "Starting API-only Docker. Rerun the launcher after installing host CLIs to enable them.");
         const result = spawnSync("bash", [fileURLToPath(new URL("../../scripts/docker-run.sh", import.meta.url))], {
             stdio: "inherit",
             env: {
                 ...process.env,
+                SLOPIFY_HOST_CLI_DIR: bridge.directory ?? "",
                 ...(values.port === undefined ? {} : { SLOPIFY_DOCKER_HOST_PORT: values.port }),
             },
         });