@getmegabrain/cli 0.1.2 → 0.1.4

package/LICENSE.md

@@ -0,0 +1,19 @@
+Copyright 2025-present Kilo Code Inc.
+
+Open Core Ventures Source Available License (OCVSAL) version 1.0
+
+Using software and associated documentation files (the "Software") in production requires a valid commercial agreement from the copyright holder.
+
+You are free to modify the Software, test it, and publish modifications to the Software. You agree that the copyright holder retains all right, title and interest in and to all modifications.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+For all third party components incorporated into this Software, those
+components are licensed under the original license provided by the owner of the
+applicable component.

package/README.md

@@ -32,9 +32,14 @@ e.g. `megabrain run "fix the failing test"`.
   provider pointed at the MegaBrain Gateway — the same config shape BrainClaw
   writes server-side for its own sandboxes
   (`services/kiloclaw/controller/src/opencode-config.ts`).
-- Every other command execs the real `opencode` binary (installed as a
-  dependency of this package), so it behaves exactly like OpenCode — this
-  package only handles auth and gateway wiring.
+- Every other command execs the real `opencode` binary. That binary ships
+  bundled inside this package (the `opencode-ai` dependency), and the CLI runs
+  it by its absolute path in `node_modules` — it is never expected on your
+  `PATH`, and you never install `opencode` yourself. If a restrictive install
+  (e.g. `--ignore-scripts`, pnpm, or an allow-scripts policy) skipped
+  `opencode-ai`'s postinstall, the CLI fetches the native binary on first
+  launch. So it behaves exactly like OpenCode — this package only handles auth
+  and gateway wiring.
 
 Override the target deployment for local development with
 `MEGABRAIN_APP_URL` (defaults to `https://getmegabrain.com`).

package/dist/index.js

@@ -4,6 +4,7 @@ import { login } from './device-auth.js';
 import { readCredentials, writeCredentials, clearCredentials } from './credentials.js';
 import { writeOpenCodeConfig } from './opencode-config.js';
 import { fetchGatewayModelIds } from './models.js';
+import { ensureOpencodeBinary } from './opencode.js';
 async function signIn() {
     console.log('Signing in to MegaBrain…');
     const { token, userId, userEmail } = await login();
@@ -40,10 +41,10 @@ function runWhoami() {
 }
 function runOpenCode(args) {
     return new Promise((resolve, reject) => {
-        const child = spawn('opencode', args, { stdio: 'inherit' });
+        const child = spawn(ensureOpencodeBinary(), args, { stdio: 'inherit' });
         child.on('error', err => {
             if (err.code === 'ENOENT') {
-                reject(new Error('Could not find `opencode` on your PATH. Try reinstalling: npm install -g @getmegabrain/cli'));
+                reject(new Error('The bundled `opencode` binary is missing. Try reinstalling: npm install -g @getmegabrain/cli'));
             }
             else {
                 reject(err);

package/dist/opencode-config.js

@@ -74,6 +74,11 @@ export function writeOpenCodeConfig(token, modelIds = []) {
         // LSP diagnostics make the agent's edits far more reliable, but OpenCode
         // ships with LSP off. Default it on; a user's explicit choice survives.
         lsp: existing.lsp ?? true,
+        // OpenCode auto-connects a direct OpenRouter provider when it finds
+        // OPENROUTER_API_KEY or stored credentials, routing traffic (and billing)
+        // around the MegaBrain Gateway. Hide it by default — BYOK goes through
+        // the gateway. A user who wants it back can set disabled_providers: [].
+        disabled_providers: existing.disabled_providers ?? ['openrouter'],
     };
     fs.mkdirSync(OPENCODE_CONFIG_DIR, { recursive: true });
     fs.writeFileSync(OPENCODE_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });

package/dist/opencode.js

@@ -0,0 +1,65 @@
+/**
+ * Resolves the OpenCode binary that ships *inside* this package.
+ *
+ * `opencode` is a dependency (`opencode-ai`), not something the user installs
+ * or needs to know about. We must NOT invoke it by bare name off `PATH`:
+ * npm only links the top-level package's bin (`megabrain`) into the global bin
+ * directory on `npm install -g`, so a nested dependency's `opencode` bin never
+ * lands on `PATH`. Instead we resolve the bundled binary's absolute path from
+ * our own `node_modules` and exec that.
+ *
+ * `opencode-ai` materializes the platform-specific native binary in its
+ * `postinstall` (it copies the right `opencode-<platform>-<arch>` build into
+ * `bin/opencode.exe`). If install scripts were skipped (pnpm's default, npm
+ * `--ignore-scripts`, or an allow-scripts policy), that file is still the stub
+ * shell script shipped in the tarball. Detect that case and run the postinstall
+ * ourselves so the binary is fetched on first launch.
+ */
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+const require = createRequire(import.meta.url);
+/** Marker printed by the placeholder bin when opencode-ai's postinstall never ran. */
+const STUB_MARKER = 'postinstall script was not run';
+function opencodePackageDir() {
+    return path.dirname(require.resolve('opencode-ai/package.json'));
+}
+/** Absolute path to the bundled OpenCode binary. Pure: no side effects. */
+export function opencodeBinaryPath() {
+    return path.join(opencodePackageDir(), 'bin', 'opencode.exe');
+}
+/** True when the binary is missing or is still the un-materialized stub. */
+function needsPostinstall(binPath) {
+    let fd;
+    try {
+        fd = fs.openSync(binPath, 'r');
+    }
+    catch {
+        return true;
+    }
+    try {
+        const buf = Buffer.alloc(256);
+        const bytesRead = fs.readSync(fd, buf, 0, buf.length, 0);
+        return buf.toString('utf8', 0, bytesRead).includes(STUB_MARKER);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Returns the bundled OpenCode binary path, running opencode-ai's postinstall
+ * first if the native binary hasn't been materialized yet.
+ */
+export function ensureOpencodeBinary() {
+    const binPath = opencodeBinaryPath();
+    if (needsPostinstall(binPath)) {
+        const postinstall = path.join(opencodePackageDir(), 'postinstall.mjs');
+        console.log('Fetching OpenCode binary…');
+        spawnSync(process.execPath, [postinstall], {
+            cwd: opencodePackageDir(),
+            stdio: 'inherit',
+        });
+    }
+    return binPath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmegabrain/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "MegaBrain CLI — sign in once, then code from your terminal via OpenCode wired to the MegaBrain Gateway.",
   "license": "MIT",
   "type": "module",
@@ -16,6 +16,16 @@
   "engines": {
     "node": ">=18"
   },
+  "dependencies": {
+    "opencode-ai": "^1.17.11"
+  },
+  "devDependencies": {
+    "@types/node": "24.12.4",
+    "@typescript/native-preview": "7.0.0-dev.20260514.1",
+    "tsx": "4.21.0",
+    "typescript": "5.9.3",
+    "vitest": "4.1.6"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js",
@@ -24,15 +34,5 @@
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
     "lint": "pnpm -w exec oxlint --config .oxlintrc.json packages/megabrain-cli/src"
-  },
-  "dependencies": {
-    "opencode-ai": "^1.17.11"
-  },
-  "devDependencies": {
-    "@types/node": "catalog:",
-    "@typescript/native-preview": "catalog:",
-    "tsx": "catalog:",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
   }
-}
+}