@geraldmaron/construct 1.1.1 → 1.2.1

package/lib/providers/copilot-auth.mjs

@@ -0,0 +1,297 @@
+/**
+ * lib/providers/copilot-auth.mjs — GitHub Copilot OAuth device flow + token exchange.
+ *
+ * Copilot is authenticated the way the editor plugins and community CLIs do it:
+ * an OAuth device flow against the public Copilot GitHub App
+ * (client Iv1.b507a08c87ecfe98), which mints a user-to-server access token
+ * (ghu_) plus a long-lived refresh token (ghr_). The access token is exchanged
+ * at copilot_internal/v2/token for a short-lived Copilot session token used as
+ * the bearer against api.githubcopilot.com. This deliberately replaces the
+ * `gh auth token` path: the GitHub CLI's OAuth app is not Copilot-entitled and
+ * its token is rejected by the exchange endpoint.
+ *
+ * Credentials persist to two places: Construct's own store
+ * (~/.construct/auth/github-copilot.json) and the de-facto standard
+ * ~/.config/github-copilot/apps.json that other tools read and write, so a login
+ * here is reusable elsewhere and an existing login is reused here. The access
+ * token is refreshed from the refresh token when it expires; the session token
+ * is cached in-process until shortly before its own expiry. Network and clock
+ * are injectable so the flow is exercised end to end without a live account.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const CLIENT_ID = 'Iv1.b507a08c87ecfe98';
+const DEVICE_CODE_URL = 'https://github.com/login/device/code';
+const ACCESS_TOKEN_URL = 'https://github.com/login/oauth/access_token';
+const COPILOT_TOKEN_URL = 'https://api.github.com/copilot_internal/v2/token';
+
+export const COPILOT_API_BASE = 'https://api.githubcopilot.com';
+const SESSION_REFRESH_BUFFER_S = 300;
+
+const EDITOR_HEADERS = {
+  'Editor-Version': 'vscode/1.90.0',
+  'Editor-Plugin-Version': 'copilot-chat/0.26.7',
+  'Copilot-Integration-Id': 'vscode-chat',
+  'User-Agent': 'GitHubCopilotChat/0.26.7',
+};
+
+let sessionCache = null;
+
+// Copilot tokens must be a single line — stray newlines from dotenv, JSON, or the
+// exchange response trigger "invalid whitespace" from api.githubcopilot.com.
+
+function normalizeToken(value) {
+  if (!value || typeof value !== 'string') return '';
+  return value.trim().replace(/\s+/g, '');
+}
+
+function homeDir() {
+  return process.env.HOME || process.env.USERPROFILE || os.homedir();
+}
+
+function constructStorePath() {
+  return path.join(homeDir(), '.construct', 'auth', 'github-copilot.json');
+}
+
+function appsStorePath() {
+  return path.join(homeDir(), '.config', 'github-copilot', 'apps.json');
+}
+
+function hostsStorePath() {
+  return path.join(homeDir(), '.config', 'github-copilot', 'hosts.json');
+}
+
+function readJson(file) {
+  try {
+    if (!fs.existsSync(file)) return null;
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeJson(file, data, mode) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, JSON.stringify(data, null, 2), { mode });
+}
+
+// Read a stored OAuth credential from Construct's store first, then the shared
+// github-copilot store (apps.json/hosts.json) that editor plugins maintain. The
+// oauth_token field carries the ghu_ access token in the shared format.
+
+export function loadStoredOAuth() {
+  const own = readJson(constructStorePath());
+  if (own && own.oauth_token) {
+    return {
+      oauthToken: normalizeToken(own.oauth_token),
+      refreshToken: normalizeToken(own.refresh_token) || null,
+      oauthExpiresAt: own.oauth_expires_at || null,
+      user: own.user || null,
+    };
+  }
+  for (const file of [appsStorePath(), hostsStorePath()]) {
+    const data = readJson(file);
+    if (!data) continue;
+    for (const entry of Object.values(data)) {
+      const token = normalizeToken(entry?.oauth_token || entry?.token);
+      if (token) return { oauthToken: token, refreshToken: null, oauthExpiresAt: null, user: entry?.user || null };
+    }
+  }
+  return null;
+}
+
+export function hasStoredCredential() {
+  return loadStoredOAuth() != null;
+}
+
+// Persist to both stores so a login made here is reusable by other tools and a
+// login made elsewhere is honored here. The shared store is keyed by host and
+// app id, matching the format opencode/Neovim copilot read.
+
+export function persistOAuth({ accessToken, refreshToken, expiresAt, user }) {
+  const cleanAccess = normalizeToken(accessToken);
+  const cleanRefresh = normalizeToken(refreshToken) || null;
+  const own = readJson(constructStorePath()) || {};
+  writeJson(constructStorePath(), {
+    ...own,
+    type: 'oauth',
+    oauth_token: cleanAccess,
+    refresh_token: cleanRefresh || own.refresh_token || null,
+    oauth_expires_at: expiresAt || null,
+    user: user || own.user || null,
+    rotated_at: new Date().toISOString(),
+  }, 0o600);
+
+  const apps = readJson(appsStorePath()) || {};
+  apps[`github.com:${CLIENT_ID}`] = { user: user || apps[`github.com:${CLIENT_ID}`]?.user || 'unknown', oauth_token: cleanAccess, githubAppId: CLIENT_ID };
+  writeJson(appsStorePath(), apps, 0o600);
+}
+
+async function postJson(url, body, fetchImpl) {
+  const res = await fetchImpl(url, {
+    method: 'POST',
+    headers: { Accept: 'application/json', 'Content-Type': 'application/json', ...EDITOR_HEADERS },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  let json = null;
+  try { json = JSON.parse(text); } catch { /* non-JSON error body */ }
+  return { ok: res.ok, status: res.status, json, text };
+}
+
+// Step 1 of the device flow: request a device + user code the operator enters at
+// the verification URL.
+
+export async function requestDeviceCode({ fetchImpl = fetch } = {}) {
+  const { ok, json, status, text } = await postJson(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: 'read:user' }, fetchImpl);
+  if (!ok || !json?.device_code) {
+    throw new Error(`Copilot device-code request failed (HTTP ${status}): ${(text || '').slice(0, 160)}`);
+  }
+  return {
+    deviceCode: json.device_code,
+    userCode: json.user_code,
+    verificationUri: json.verification_uri,
+    interval: json.interval || 5,
+    expiresIn: json.expires_in || 900,
+  };
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Step 2: poll until the operator authorizes, then capture the access token, the
+// refresh token, and the access-token expiry (when the app enables expiration).
+
+export async function pollForAccessToken({ deviceCode, interval = 5, expiresIn = 900, fetchImpl = fetch, now = Date.now, onPending } = {}) {
+  const deadline = now() + expiresIn * 1000;
+  let waitMs = interval * 1000;
+  while (now() < deadline) {
+    const { json } = await postJson(ACCESS_TOKEN_URL, {
+      client_id: CLIENT_ID,
+      device_code: deviceCode,
+      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    }, fetchImpl);
+    if (json?.access_token) {
+      return {
+        accessToken: normalizeToken(json.access_token),
+        refreshToken: normalizeToken(json.refresh_token) || null,
+        expiresAt: json.expires_in ? Math.floor(now() / 1000) + json.expires_in : null,
+      };
+    }
+    if (json?.error === 'slow_down') waitMs += 5000;
+    else if (json?.error && json.error !== 'authorization_pending') {
+      throw new Error(`Copilot authorization failed: ${json.error_description || json.error}`);
+    }
+    if (typeof onPending === 'function') onPending();
+    await sleep(waitMs);
+  }
+  throw new Error('Copilot authorization timed out — the device code expired before approval.');
+}
+
+async function refreshAccessToken(refreshToken, { fetchImpl, now }) {
+  const { json } = await postJson(ACCESS_TOKEN_URL, {
+    client_id: CLIENT_ID,
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+  }, fetchImpl);
+  if (!json?.access_token) throw new Error('Copilot token refresh failed — re-run `construct creds login copilot`.');
+  return {
+    accessToken: normalizeToken(json.access_token),
+    refreshToken: normalizeToken(json.refresh_token) || refreshToken,
+    expiresAt: json.expires_in ? Math.floor(now() / 1000) + json.expires_in : null,
+  };
+}
+
+async function exchangeForSessionToken(accessToken, { fetchImpl }) {
+  const res = await fetchImpl(COPILOT_TOKEN_URL, {
+    headers: { Accept: 'application/json', Authorization: `Bearer ${accessToken}`, ...EDITOR_HEADERS },
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    const err = new Error(`Copilot token exchange failed (HTTP ${res.status}). Your GitHub account may lack an active Copilot subscription, or the login expired — re-run \`construct creds login copilot\`. ${(body || '').slice(0, 160)}`);
+    err.code = 'COPILOT_EXCHANGE_FAILED';
+    throw err;
+  }
+  return res.json();
+}
+
+// Return a valid short-lived Copilot session token, doing the minimum work:
+// reuse the in-process cache, else exchange the stored access token, first
+// refreshing that token from the refresh token when it has expired.
+
+export async function getCopilotToken({ fetchImpl = fetch, now = Date.now } = {}) {
+  const nowS = Math.floor(now() / 1000);
+  if (sessionCache && sessionCache.expiresAt > nowS + SESSION_REFRESH_BUFFER_S) {
+    return sessionCache.token;
+  }
+
+  const stored = loadStoredOAuth();
+  if (!stored?.oauthToken) {
+    const err = new Error('GitHub Copilot is not authenticated — run `construct creds login copilot`.');
+    err.code = 'COPILOT_NOT_AUTHENTICATED';
+    throw err;
+  }
+
+  let accessToken = stored.oauthToken;
+  if (stored.oauthExpiresAt && stored.oauthExpiresAt <= nowS && stored.refreshToken) {
+    const refreshed = await refreshAccessToken(stored.refreshToken, { fetchImpl, now });
+    accessToken = refreshed.accessToken;
+    persistOAuth({ accessToken: refreshed.accessToken, refreshToken: refreshed.refreshToken, expiresAt: refreshed.expiresAt, user: stored.user });
+  }
+
+  const session = await exchangeForSessionToken(accessToken, { fetchImpl });
+  if (!session?.token) {
+    const err = new Error('Copilot token exchange returned no token.');
+    err.code = 'COPILOT_EXCHANGE_EMPTY';
+    throw err;
+  }
+  const sessionToken = normalizeToken(session.token);
+  if (!sessionToken) {
+    const err = new Error('Copilot token exchange returned an empty token.');
+    err.code = 'COPILOT_EXCHANGE_EMPTY';
+    throw err;
+  }
+  sessionCache = { token: sessionToken, expiresAt: session.expires_at || (nowS + 1500) };
+  return sessionCache.token;
+}
+
+// Headers every api.githubcopilot.com call must carry. The integration id and
+// editor version are what the endpoint checks to accept a session-scoped token.
+
+export function copilotApiHeaders() {
+  return { ...EDITOR_HEADERS, 'X-Github-Api-Version': '2023-07-07' };
+}
+
+// The model ids the account can actually use. Lets callers validate a configured
+// id (for example github-copilot/gpt-5.4) instead of assuming a name is valid.
+
+export async function listCopilotModels({ fetchImpl = fetch } = {}) {
+  const token = await getCopilotToken({ fetchImpl });
+  const res = await fetchImpl(`${COPILOT_API_BASE}/models`, {
+    headers: { Accept: 'application/json', Authorization: `Bearer ${token}`, ...copilotApiHeaders() },
+  });
+  if (!res.ok) throw new Error(`Copilot models request failed (HTTP ${res.status}).`);
+  const data = await res.json();
+  const items = Array.isArray(data?.data) ? data.data : (Array.isArray(data) ? data : []);
+  return items.map((m) => m?.id || m?.model).filter(Boolean);
+}
+
+export function __resetCopilotCache() {
+  sessionCache = null;
+}
+
+// Exchange probe used at chat launch — a configured Copilot pin is not enough if
+// the session token cannot be minted (stale oauth, whitespace-corrupt store).
+
+export async function preflightCopilotSession({ fetchImpl = fetch } = {}) {
+  __resetCopilotCache();
+  try {
+    await getCopilotToken({ fetchImpl });
+    return { ok: true };
+  } catch (err) {
+    __resetCopilotCache();
+    return { ok: false, message: err.message || String(err) };
+  }
+}

package/lib/providers/credential-bootstrap.mjs

@@ -0,0 +1,178 @@
+/**
+ * lib/providers/credential-bootstrap.mjs — lazy credential linking for Construct.
+ *
+ * Before any LLM surface runs, missing API keys can be satisfied from existing
+ * stores or a one-time 1Password link into ~/.construct/config.env. Runs at
+ * the construct CLI entrypoint in presence-check mode; op item list runs only
+ * when autoLink:true (scripts/setup-credentials.mjs).
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+import { hasAnySecret } from './secret-resolver.mjs';
+import { API_KEY_CREDENTIALS, primaryEnvVar } from './credential-catalog.mjs';
+import {
+  discoverAlternateRawForCredential,
+  discoverAlternateRawForVar,
+  readRawFromOpenCodeProvider,
+  readRawFromCredsStore,
+  openCodeConfigPath,
+} from './credential-sources.mjs';
+import { writeEnvValues, getUserEnvPath, ensureUserConfigDir } from '../env-config.mjs';
+
+export {
+  discoverAlternateRawForVar,
+  readRawFromOpenCodeProvider,
+  readRawFromCredsStore,
+  openCodeConfigPath,
+} from './credential-sources.mjs';
+
+export function commandExists(command) {
+  const r = spawnSync(process.platform === 'win32' ? 'where' : 'sh', process.platform === 'win32'
+    ? [command]
+    : ['-lc', `command -v ${command}`], { encoding: 'utf8', timeout: 3000 });
+  return r.status === 0;
+}
+
+function defaultOpRun(args) {
+  return spawnSync('op', args, { encoding: 'utf8', timeout: 12_000 });
+}
+
+export function listOpItems({ opRun = defaultOpRun } = {}) {
+  const result = opRun(['item', 'list', '--format', 'json']);
+  if (result.status !== 0 || !result.stdout) return [];
+  try {
+    const parsed = JSON.parse(result.stdout);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+function titleMatches(item, titles = []) {
+  const title = String(item?.title || '').trim().toLowerCase();
+  return titles.some((candidate) => title === candidate || title.includes(candidate));
+}
+
+export function pickOpItem(items = [], { titles = [] } = {}) {
+  const normalized = items.filter((item) => item?.id && item?.vault?.name);
+  const exact = normalized.filter((item) => {
+    const title = String(item.title || '').trim().toLowerCase();
+    return titles.some((candidate) => title === candidate);
+  });
+  const pool = exact.length
+    ? exact
+    : normalized.filter((item) => titleMatches(item, titles));
+  if (!pool.length) return null;
+  const dev = pool.find((item) => String(item.vault.name).toLowerCase().includes('development'));
+  return dev || pool[0];
+}
+
+export function opRefFromItem(item, field = 'credential') {
+  if (!item?.id || !item?.vault?.name) return null;
+  const resolvedField = item.fields?.find((f) => f.label === field || f.purpose === 'API_KEY')?.label || field;
+  return `op://${item.vault.name}/${item.id}/${resolvedField}`;
+}
+
+function credentialPresent(entry, { env, cwd, home }) {
+  if (hasAnySecret(entry.envVars, { env, cwd })) return true;
+  return Boolean(discoverAlternateRawForCredential(entry, { home }));
+}
+
+function linkCredentialFromOnePassword(entry, { home, persist, opItems }) {
+  const item = pickOpItem(opItems, { titles: entry.opTitles });
+  const ref = item ? opRefFromItem(item, entry.opField) : null;
+  if (!ref) return null;
+  if (persist) {
+    ensureUserConfigDir(home);
+    const file = getUserEnvPath(home);
+    writeEnvValues(file, { [primaryEnvVar(entry)]: ref });
+    try { fs.chmodSync(file, 0o600); } catch { /* best-effort */ }
+  }
+  return { id: entry.id, envVar: primaryEnvVar(entry), ref };
+}
+
+let lastBootstrapResult = null;
+
+function bootstrapSkipped(env) {
+  if (env.NODE_ENV === 'test' || env.CI === 'true') return true;
+  return false;
+}
+
+function missingCredentials({ env, cwd, home }) {
+  return API_KEY_CREDENTIALS.filter((entry) => !credentialPresent(entry, { env, cwd, home }));
+}
+
+export function ensureConstructCredentials({
+  env = process.env,
+  cwd = process.cwd(),
+  home = os.homedir(),
+  persist = true,
+  opRun = defaultOpRun,
+  force = false,
+  autoLink = false,
+} = {}) {
+  if (lastBootstrapResult && !force) return lastBootstrapResult;
+
+  if (bootstrapSkipped(env)) {
+    lastBootstrapResult = { linked: [], opAvailable: false, skipped: 'hermetic' };
+    return lastBootstrapResult;
+  }
+
+  const missing = missingCredentials({ env, cwd, home });
+  if (missing.length === 0) {
+    lastBootstrapResult = { linked: [], opAvailable: commandExists('op') };
+    return lastBootstrapResult;
+  }
+
+  if (!autoLink) {
+    lastBootstrapResult = { linked: [], opAvailable: commandExists('op'), pending: missing.map((e) => e.id) };
+    return lastBootstrapResult;
+  }
+
+  const linked = [];
+  const opAvailable = opRun !== defaultOpRun || commandExists('op');
+  if (!opAvailable) {
+    lastBootstrapResult = { linked, opAvailable: false };
+    return lastBootstrapResult;
+  }
+
+  const opItems = listOpItems({ opRun });
+  for (const entry of missing) {
+    const link = linkCredentialFromOnePassword(entry, { home, persist, opItems });
+    if (link) linked.push(link);
+  }
+
+  lastBootstrapResult = { linked, opAvailable: true };
+  return lastBootstrapResult;
+}
+
+export function __resetCredentialBootstrapCache() {
+  lastBootstrapResult = null;
+}
+
+export function formatCredentialBootstrapNotice(result) {
+  if (!result?.linked?.length) return null;
+  const names = result.linked.map((entry) => entry.id).join(', ');
+  return `Credentials linked from 1Password: ${names}`;
+}
+
+export const readOpenRouterRawFromOpenCode = (configPath) => readRawFromOpenCodeProvider('openrouter', configPath);
+export const readOpenRouterRawFromCreds = () => readRawFromCredsStore('openrouter');
+export const discoverOpenRouterAlternateRaw = (opts) => discoverAlternateRawForCredential(
+  API_KEY_CREDENTIALS.find((e) => e.id === 'openrouter'),
+  opts,
+);
+export const pickOpenRouterOpItem = (items) => pickOpItem(items, { titles: ['openrouter', 'openrouter api key'] });
+export const openRouterOpRefFromItem = (item) => opRefFromItem(item, 'credential');
+
+export function ensureOpenRouterCredential(opts = {}) {
+  const result = ensureConstructCredentials(opts);
+  const link = result.linked.find((entry) => entry.id === 'openrouter') || null;
+  return { linked: Boolean(link), source: link ? '1password' : null, ref: link?.ref || null };
+}
+
+export function needsOpenRouterForModel(modelId) {
+  return typeof modelId === 'string' && /^openrouter\//.test(modelId);
+}

package/lib/providers/credential-catalog.mjs

@@ -0,0 +1,46 @@
+/**
+ * lib/providers/credential-catalog.mjs — LLM API-key provider credential metadata.
+ *
+ * Single catalog mapping env var names, Construct creds-store keys, and 1Password
+ * item matching for the secret resolver and credential bootstrap.
+ */
+
+export const API_KEY_CREDENTIALS = [
+  {
+    id: 'anthropic',
+    envVars: ['ANTHROPIC_API_KEY'],
+    credsKey: 'anthropic',
+    opTitles: ['anthropic', 'anthropic api key'],
+    opField: 'credential',
+  },
+  {
+    id: 'openai',
+    envVars: ['OPENAI_API_KEY'],
+    credsKey: 'openai',
+    opTitles: ['openai', 'openai api key'],
+    opField: 'credential',
+  },
+  {
+    id: 'openrouter',
+    envVars: ['OPENROUTER_API_KEY', 'OPEN_ROUTER_API_KEY'],
+    credsKey: 'openrouter',
+    opTitles: ['openrouter', 'openrouter api key'],
+    opField: 'credential',
+    openCodeProvider: 'openrouter',
+  },
+  {
+    id: 'github',
+    envVars: ['GITHUB_TOKEN', 'GH_TOKEN'],
+    credsKey: 'github',
+    opTitles: ['github', 'github token', 'github personal access token'],
+    opField: 'credential',
+  },
+];
+
+export function credentialForEnvVar(varName) {
+  return API_KEY_CREDENTIALS.find((entry) => entry.envVars.includes(varName)) || null;
+}
+
+export function primaryEnvVar(entry) {
+  return entry?.envVars?.[0] || null;
+}

package/lib/providers/credential-sources.mjs

@@ -0,0 +1,63 @@
+/**
+ * lib/providers/credential-sources.mjs — non-1Password credential source reads.
+ *
+ * Reads alternate API-key locations (Construct creds store, OpenCode provider
+ * settings) for the secret resolver and bootstrap without invoking op read.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { readCreds } from './creds.mjs';
+import { API_KEY_CREDENTIALS } from './credential-catalog.mjs';
+
+export function openCodeConfigPath(homeDir = os.homedir()) {
+  return path.join(homeDir, '.config', 'opencode', 'opencode.json');
+}
+
+function isPlaceholder(value) {
+  return !value || String(value).includes('__OPENROUTER_API_KEY__');
+}
+
+export function readRawFromOpenCodeProvider(providerName, configPath = openCodeConfigPath()) {
+  try {
+    if (!fs.existsSync(configPath)) return null;
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    const provider = config?.provider?.[providerName];
+    if (!provider) return null;
+    if (!isPlaceholder(provider.apiKey)) return String(provider.apiKey).trim();
+    const auth = provider.options?.headers?.Authorization;
+    if (typeof auth === 'string') {
+      const value = auth.replace(/^Bearer\s+/i, '').trim();
+      if (!isPlaceholder(value)) return value;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function readRawFromCredsStore(credsKey) {
+  if (!credsKey) return null;
+  try {
+    const key = readCreds()?.[credsKey]?.key;
+    return key ? String(key).trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+export function discoverAlternateRawForCredential(entry, { home = os.homedir() } = {}) {
+  if (!entry) return null;
+  const fromCreds = readRawFromCredsStore(entry.credsKey);
+  if (fromCreds) return fromCreds;
+  if (entry.openCodeProvider) {
+    return readRawFromOpenCodeProvider(entry.openCodeProvider, openCodeConfigPath(home));
+  }
+  return null;
+}
+
+export function discoverAlternateRawForVar(varName, opts = {}) {
+  const entry = API_KEY_CREDENTIALS.find((item) => item.envVars.includes(varName));
+  return entry ? discoverAlternateRawForCredential(entry, opts) : null;
+}

package/lib/providers/creds.mjs

@@ -25,11 +25,14 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const CONSTRUCT_DIR = path.join(os.homedir(), '.construct');
 const CONFIG_FILE = 'config.env';
 
+function constructDir() {
+  return path.join(os.homedir(), '.construct');
+}
+
 export function credsFilePath() {
-  return path.join(CONSTRUCT_DIR, CONFIG_FILE);
+  return path.join(constructDir(), CONFIG_FILE);
 }
 
 function providerKey(provider) {

package/lib/providers/op-run.mjs

@@ -0,0 +1,59 @@
+/**
+ * lib/providers/op-run.mjs — optionally launch a child under 1Password `op run`.
+ *
+ * When CONSTRUCT_OP_ENV_FILE points to an `op run` env-file (KEY=op://… lines)
+ * and the `op` CLI is installed, long-lived Construct services — the dashboard
+ * daemon that runs chat turns — are spawned through
+ * `op run --no-masking --env-file <file> -- <cmd>`, so op:// references resolve
+ * once at startup into the process env. This mirrors the per-invocation model
+ * other LLM CLIs use (e.g. `op run -- opencode`) and means a bare `construct chat`
+ * gets resolved provider keys without a shell wrapper.
+ *
+ * Strictly opt-in: with the var unset, the file missing, or `op` absent, the
+ * command is returned unchanged and 1Password is never invoked. No other setup
+ * path forces it.
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+function expandHome(file, homeDir) {
+  if (file === '~') return homeDir;
+  if (file.startsWith('~/')) return `${homeDir}${file.slice(1)}`;
+  return file;
+}
+
+export function resolveOpEnvFile(env = process.env, homeDir = os.homedir()) {
+  const raw = env.CONSTRUCT_OP_ENV_FILE;
+  if (!raw || !raw.trim()) return null;
+  const file = expandHome(raw.trim(), homeDir);
+  try {
+    return fs.statSync(file).isFile() ? file : null;
+  } catch {
+    return null;
+  }
+}
+
+export function opCliAvailable() {
+  try {
+    return spawnSync('op', ['--version'], { stdio: 'ignore', timeout: 3000 }).status === 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Return the command/args to spawn, wrapped in `op run` when opted in. Falls back
+ * to the original command unchanged otherwise. `hasOp` is injectable for tests.
+ */
+export function wrapWithOpRun(command, args = [], { env = process.env, homeDir = os.homedir(), hasOp = opCliAvailable } = {}) {
+  const file = resolveOpEnvFile(env, homeDir);
+  if (!file || !hasOp()) return { command, args, wrapped: false, envFile: null };
+  return {
+    command: 'op',
+    args: ['run', '--no-masking', `--env-file=${file}`, '--', command, ...args],
+    wrapped: true,
+    envFile: file,
+  };
+}