@getmegabrain/cli 0.1.3 → 0.1.5

package/LICENSE.md

@@ -0,0 +1,19 @@
+Copyright 2025-present Kilo Code Inc.
+
+Open Core Ventures Source Available License (OCVSAL) version 1.0
+
+Using software and associated documentation files (the "Software") in production requires a valid commercial agreement from the copyright holder.
+
+You are free to modify the Software, test it, and publish modifications to the Software. You agree that the copyright holder retains all right, title and interest in and to all modifications.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+For all third party components incorporated into this Software, those
+components are licensed under the original license provided by the owner of the
+applicable component.

package/README.md

@@ -32,9 +32,14 @@ e.g. `megabrain run "fix the failing test"`.
   provider pointed at the MegaBrain Gateway — the same config shape BrainClaw
   writes server-side for its own sandboxes
   (`services/kiloclaw/controller/src/opencode-config.ts`).
-- Every other command execs the real `opencode` binary (installed as a
-  dependency of this package), so it behaves exactly like OpenCode — this
-  package only handles auth and gateway wiring.
+- Every other command execs the real `opencode` binary. That binary ships
+  bundled inside this package (the `opencode-ai` dependency), and the CLI runs
+  it by its absolute path in `node_modules` — it is never expected on your
+  `PATH`, and you never install `opencode` yourself. If a restrictive install
+  (e.g. `--ignore-scripts`, pnpm, or an allow-scripts policy) skipped
+  `opencode-ai`'s postinstall, the CLI fetches the native binary on first
+  launch. So it behaves exactly like OpenCode — this package only handles auth
+  and gateway wiring.
 
 Override the target deployment for local development with
 `MEGABRAIN_APP_URL` (defaults to `https://getmegabrain.com`).

package/dist/cloud-fork.js

@@ -0,0 +1,104 @@
+/**
+ * `megabrain --session <id> --cloud-fork` — fork a MegaBrain cloud session
+ * into a local OpenCode session.
+ *
+ * The web UI hands users this command for any cloud session. Flow:
+ *   1. Download the session export from the session-ingest worker
+ *      (`GET /api/session/:id/export`, authenticated with the same Kilo user
+ *      JWT issued by `megabrain login`).
+ *   2. `opencode import <file>` to materialize the session locally.
+ *   3. Launch `opencode --session <id> --fork` so the user continues on a
+ *      fork instead of mutating the imported original.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export const SESSION_INGEST_URL = (process.env.MEGABRAIN_SESSION_INGEST_URL ?? 'https://session-ingest.vasilij-lukin.workers.dev').replace(/\/+$/, '');
+const SESSION_ID_RE = /^ses_[a-z0-9]+$/i;
+export function isValidSessionId(sessionId) {
+    return SESSION_ID_RE.test(sessionId);
+}
+/**
+ * Detects `--cloud-fork` and extracts the `--session <id>` / `--session=<id>`
+ * value from raw argv. `--session` stays in passthroughArgs — it is only
+ * removed together with `--cloud-fork` by the caller when forking.
+ */
+export function parseCloudForkArgs(argv) {
+    let cloudFork = false;
+    let sessionId = null;
+    const passthroughArgs = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--cloud-fork') {
+            cloudFork = true;
+            continue;
+        }
+        if (arg === '--session' && i + 1 < argv.length) {
+            sessionId = argv[i + 1];
+            passthroughArgs.push(arg, argv[i + 1]);
+            i++;
+            continue;
+        }
+        if (arg.startsWith('--session=')) {
+            sessionId = arg.slice('--session='.length);
+            passthroughArgs.push(arg);
+            continue;
+        }
+        passthroughArgs.push(arg);
+    }
+    return { cloudFork, sessionId, passthroughArgs };
+}
+/**
+ * Guards against error surfaces served as 200 (e.g. `{"detail":"..."}`):
+ * a valid OpenCode session export always carries `info.id`, and `opencode
+ * import` crashes with a cryptic error when it's missing.
+ */
+export function exportPayloadSessionId(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return null;
+    const info = payload.info;
+    if (info === null || typeof info === 'undefined' || typeof info !== 'object')
+        return null;
+    const id = info.id;
+    return typeof id === 'string' && id.length > 0 ? id : null;
+}
+/**
+ * Downloads the cloud session export to a temp file and returns its path.
+ * The caller owns cleanup.
+ */
+export async function downloadSessionExport(sessionId, token) {
+    const url = `${SESSION_INGEST_URL}/api/session/${encodeURIComponent(sessionId)}/export`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(300_000),
+        });
+    }
+    catch (err) {
+        throw new Error(`Could not reach MegaBrain to download session ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (res.status === 404) {
+        throw new Error(`Cloud session ${sessionId} was not found (or does not belong to your account).`);
+    }
+    if (res.status === 401 || res.status === 403) {
+        throw new Error('Your MegaBrain sign-in is no longer valid. Run `megabrain login` and retry.');
+    }
+    if (!res.ok) {
+        throw new Error(`Downloading session ${sessionId} failed (HTTP ${res.status}). Try again.`);
+    }
+    const body = await res.text();
+    let payload;
+    try {
+        payload = JSON.parse(body);
+    }
+    catch {
+        throw new Error(`Session ${sessionId} export is not valid JSON. Try again.`);
+    }
+    if (exportPayloadSessionId(payload) === null) {
+        throw new Error(`Session ${sessionId} export is missing session metadata. Try again.`);
+    }
+    const tmpPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'megabrain-cloud-fork-')), `${sessionId}.json`);
+    fs.writeFileSync(tmpPath, body, { mode: 0o600 });
+    return tmpPath;
+}

package/dist/index.js

@@ -1,9 +1,13 @@
 #!/usr/bin/env node
 import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 import { login } from './device-auth.js';
 import { readCredentials, writeCredentials, clearCredentials } from './credentials.js';
 import { writeOpenCodeConfig } from './opencode-config.js';
 import { fetchGatewayModelIds } from './models.js';
+import { ensureOpencodeBinary } from './opencode.js';
+import { parseCloudForkArgs, isValidSessionId, downloadSessionExport } from './cloud-fork.js';
 async function signIn() {
     console.log('Signing in to MegaBrain…');
     const { token, userId, userEmail } = await login();
@@ -40,10 +44,10 @@ function runWhoami() {
 }
 function runOpenCode(args) {
     return new Promise((resolve, reject) => {
-        const child = spawn('opencode', args, { stdio: 'inherit' });
+        const child = spawn(ensureOpencodeBinary(), args, { stdio: 'inherit' });
         child.on('error', err => {
             if (err.code === 'ENOENT') {
-                reject(new Error('Could not find `opencode` on your PATH. Try reinstalling: npm install -g @getmegabrain/cli'));
+                reject(new Error('The bundled `opencode` binary is missing. Try reinstalling: npm install -g @getmegabrain/cli'));
             }
             else {
                 reject(err);
@@ -52,6 +56,31 @@ function runOpenCode(args) {
         child.on('exit', code => resolve(code ?? 0));
     });
 }
+/**
+ * Forks a cloud session locally: downloads the session export from the
+ * MegaBrain session-ingest service, imports it into OpenCode, then launches
+ * OpenCode on a fork of the imported session.
+ */
+async function runCloudFork(sessionId) {
+    const credentials = readCredentials();
+    if (!credentials) {
+        throw new Error('Not signed in. Run `megabrain login` and retry.');
+    }
+    console.log(`Downloading cloud session ${sessionId}…`);
+    const exportPath = await downloadSessionExport(sessionId, credentials.token);
+    try {
+        console.log('Importing session into OpenCode…');
+        const importExitCode = await runOpenCode(['import', exportPath]);
+        if (importExitCode !== 0) {
+            throw new Error(`Importing session ${sessionId} failed (opencode exit ${importExitCode}).`);
+        }
+    }
+    finally {
+        fs.rmSync(path.dirname(exportPath), { recursive: true, force: true });
+    }
+    console.log('Starting a fork of the imported session…\n');
+    return runOpenCode(['--session', sessionId, '--fork']);
+}
 async function main() {
     const command = process.argv[2];
     switch (command) {
@@ -65,8 +94,18 @@ async function main() {
             runWhoami();
             return;
         default: {
+            const args = process.argv.slice(2);
+            const { cloudFork, sessionId } = parseCloudForkArgs(args);
+            if (cloudFork) {
+                if (!sessionId || !isValidSessionId(sessionId)) {
+                    throw new Error('Usage: megabrain --session <ses_…> --cloud-fork (a valid cloud session id is required).');
+                }
+                await ensureSignedIn();
+                process.exitCode = await runCloudFork(sessionId);
+                return;
+            }
             await ensureSignedIn();
-            const exitCode = await runOpenCode(process.argv.slice(2));
+            const exitCode = await runOpenCode(args);
             process.exitCode = exitCode;
         }
     }

package/dist/opencode.js

@@ -0,0 +1,65 @@
+/**
+ * Resolves the OpenCode binary that ships *inside* this package.
+ *
+ * `opencode` is a dependency (`opencode-ai`), not something the user installs
+ * or needs to know about. We must NOT invoke it by bare name off `PATH`:
+ * npm only links the top-level package's bin (`megabrain`) into the global bin
+ * directory on `npm install -g`, so a nested dependency's `opencode` bin never
+ * lands on `PATH`. Instead we resolve the bundled binary's absolute path from
+ * our own `node_modules` and exec that.
+ *
+ * `opencode-ai` materializes the platform-specific native binary in its
+ * `postinstall` (it copies the right `opencode-<platform>-<arch>` build into
+ * `bin/opencode.exe`). If install scripts were skipped (pnpm's default, npm
+ * `--ignore-scripts`, or an allow-scripts policy), that file is still the stub
+ * shell script shipped in the tarball. Detect that case and run the postinstall
+ * ourselves so the binary is fetched on first launch.
+ */
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+const require = createRequire(import.meta.url);
+/** Marker printed by the placeholder bin when opencode-ai's postinstall never ran. */
+const STUB_MARKER = 'postinstall script was not run';
+function opencodePackageDir() {
+    return path.dirname(require.resolve('opencode-ai/package.json'));
+}
+/** Absolute path to the bundled OpenCode binary. Pure: no side effects. */
+export function opencodeBinaryPath() {
+    return path.join(opencodePackageDir(), 'bin', 'opencode.exe');
+}
+/** True when the binary is missing or is still the un-materialized stub. */
+function needsPostinstall(binPath) {
+    let fd;
+    try {
+        fd = fs.openSync(binPath, 'r');
+    }
+    catch {
+        return true;
+    }
+    try {
+        const buf = Buffer.alloc(256);
+        const bytesRead = fs.readSync(fd, buf, 0, buf.length, 0);
+        return buf.toString('utf8', 0, bytesRead).includes(STUB_MARKER);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Returns the bundled OpenCode binary path, running opencode-ai's postinstall
+ * first if the native binary hasn't been materialized yet.
+ */
+export function ensureOpencodeBinary() {
+    const binPath = opencodeBinaryPath();
+    if (needsPostinstall(binPath)) {
+        const postinstall = path.join(opencodePackageDir(), 'postinstall.mjs');
+        console.log('Fetching OpenCode binary…');
+        spawnSync(process.execPath, [postinstall], {
+            cwd: opencodePackageDir(),
+            stdio: 'inherit',
+        });
+    }
+    return binPath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmegabrain/cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "MegaBrain CLI — sign in once, then code from your terminal via OpenCode wired to the MegaBrain Gateway.",
   "license": "MIT",
   "type": "module",
@@ -16,6 +16,16 @@
   "engines": {
     "node": ">=18"
   },
+  "dependencies": {
+    "opencode-ai": "^1.17.11"
+  },
+  "devDependencies": {
+    "@types/node": "24.12.4",
+    "@typescript/native-preview": "7.0.0-dev.20260514.1",
+    "tsx": "4.21.0",
+    "typescript": "5.9.3",
+    "vitest": "4.1.6"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "postbuild": "chmod +x dist/index.js",
@@ -24,15 +34,5 @@
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
     "lint": "pnpm -w exec oxlint --config .oxlintrc.json packages/megabrain-cli/src"
-  },
-  "dependencies": {
-    "opencode-ai": "^1.17.11"
-  },
-  "devDependencies": {
-    "@types/node": "catalog:",
-    "@typescript/native-preview": "catalog:",
-    "tsx": "catalog:",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
   }
-}
+}