@gizai/cli 2.0.0 → 2.1.0

package/cli/codex-relay.mjs

@@ -1,46 +0,0 @@
-// Runs ONLY inside the user's Computer. stdout is the authenticated gateway wire,
-// never credentials or provider error bodies. No listener or separate credential store.
-import { readFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { execFileSync } from 'node:child_process'
-
-const emit = value => process.stdout.write(JSON.stringify(value) + '\n')
-try {
-  const auth = JSON.parse(await readFile(join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'auth.json'), 'utf8'))
-  const token = auth.tokens?.access_token
-  const account = auth.tokens?.account_id
-  if (auth.OPENAI_API_KEY || !token || !account) {
-    emit({ status: 401 }); process.exitCode = 1
-  } else {
-    const headers = { authorization: `Bearer ${token}`, 'chatgpt-account-id': account, 'content-type': 'application/json', originator: 'codex_cli_rs' }
-    const mode = process.argv[2]
-    if (mode === 'models') {
-      const version = execFileSync('codex', ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim().split(' ').at(-1)
-      const response = await fetch(`https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(version)}`, { headers, signal: AbortSignal.timeout(30000) })
-      if (!response.ok) emit({ status: response.status })
-      else {
-        const payload = await response.json()
-        emit({ status: 200, models: (payload.models || []).filter(model => model.visibility !== 'hide').map(model => ({ id: model.slug, label: model.display_name || model.slug })).filter(model => typeof model.id === 'string' && model.id.length <= 256) })
-      }
-    } else if (mode === 'responses') {
-      let input = ''
-      for await (const chunk of process.stdin) input += chunk
-      const body = JSON.parse(input)
-      body.store = false
-      body.stream = true
-      body.instructions ??= ''
-      delete body.max_output_tokens
-      delete body.temperature
-      delete body.top_p
-      const response = await fetch('https://chatgpt.com/backend-api/codex/responses', { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(300000) })
-      emit({ status: response.status })
-      if (response.ok) {
-        for await (const chunk of response.body) emit({ chunk: Buffer.from(chunk).toString('base64') })
-        emit({ done: true })
-      }
-    } else emit({ status: 400 })
-  }
-} catch {
-  emit({ status: 503 }); process.exitCode = 1
-}

package/cli/computer-identity.mjs

@@ -1,76 +0,0 @@
-import { lstat, readFile } from 'node:fs/promises'
-import { request } from 'node:http'
-
-export const IDENTITY_SOCKET = '/opt/giz/identity/identity.sock'
-
-// One-release bridge: the managed CLI overlay can arrive before the Region gateway migration.
-export async function resolveIdentitySocket() {
-  try {
-    await lstat(IDENTITY_SOCKET)
-    return IDENTITY_SOCKET
-  } catch (error) {
-    if (error.code !== 'ENOENT') throw error
-    return '/run/giz/identity.sock'
-  }
-}
-let cached
-let pending
-
-// The release overlay owns this stamp; outside npm installations do not have it.
-export async function managedRevision() {
-  return readFile(new URL('../REVISION', import.meta.url), 'utf8').catch(error => {
-    if (error.code !== 'ENOENT') throw error
-  })
-}
-
-// The CLI never accepts a socket path from options, environment, or request data.
-export async function computerIdentity(rejectedToken) {
-  if (cached?.access_token !== rejectedToken && cached?.expires_at > Date.now() + 60_000) return cached
-  pending ??= resolveIdentitySocket().then(socketPath => new Promise((resolve, reject) => {
-    const req = request({ socketPath, path: '/token', method: 'POST',
-      headers: { 'content-length': '0' } }, res => {
-      let body = ''
-      res.setEncoding('utf8')
-      res.on('data', chunk => {
-        body += chunk
-        if (body.length > 16_384) req.destroy(new Error('The Computer identity response is too large.'))
-      })
-      res.on('error', reject)
-      res.on('end', () => {
-        try {
-          const value = JSON.parse(body)
-          if (res.statusCode !== 200) throw new Error(value.error_description || value.message || 'The Computer identity is unavailable.')
-          const url = new URL(value.baseUrl)
-          if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password ||
-              url.pathname !== '/' || url.search || url.hash || !value.access_token ||
-              value.token_type !== 'Bearer' || Number(value.expires_in) <= 0 || Number(value.expires_in) > 900) {
-            throw new Error('The Computer identity response is invalid.')
-          }
-          cached = { access_token: value.access_token, baseUrl: url.origin,
-            expires_at: Date.now() + Number(value.expires_in) * 1000 }
-          resolve(cached)
-        } catch (error) { reject(error) }
-      })
-    })
-    req.on('error', async error => {
-      if (error.code !== 'ENOENT') return reject(error)
-      try {
-        await lstat(socketPath)
-        reject(new Error('Cannot reach the Computer identity service. Try again shortly.'))
-      } catch (lookupError) {
-        if (lookupError.code !== 'ENOENT') return reject(lookupError)
-        try {
-          if (await managedRevision() !== undefined) {
-            reject(new Error('Cannot verify the Computer identity. Try again shortly or contact the owner.'))
-          } else resolve(undefined)
-        } catch (error) { reject(error) }
-      }
-    })
-    req.setTimeout(10_000, () => req.destroy(new Error('The Computer identity response timed out.')))
-    req.end()
-  })).catch(error => {
-    error.hint = 'Check that the Computer is running and try again; if it is blocked, contact the owner or an organization admin.'
-    throw error
-  }).finally(() => { pending = undefined })
-  return pending
-}

package/cli/engine.mjs

@@ -1,58 +0,0 @@
-import { spawn, execFileSync } from 'node:child_process'
-import { mkdir } from 'node:fs/promises'
-import { randomUUID } from 'node:crypto'
-import path from 'node:path'
-
-/** Local Computer execution: official binary, existing permissions, isolated reviewable worktree. */
-export async function runEngine(engine, instruction, directory = process.cwd(), progress = () => {}) {
-  if (engine !== 'claude' || typeof instruction !== 'string' || !instruction.trim()) throw new Error('Run: giz engine run claude "instruction" [--dir path]')
-  const git = (args, cwd = directory) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 8 * 1024 * 1024 })
-  const env = { ...process.env }
-  for (const key of ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_BASE_URL', 'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY']) delete env[key]
-  const status = spawn('claude', ['auth', 'status'], { env, stdio: ['ignore', 'pipe', 'ignore'] })
-  let login = ''
-  status.stdout.on('data', chunk => { login += chunk })
-  await new Promise((resolve, reject) => { status.once('error', reject); status.once('close', code => code === 0 ? resolve() : reject(new Error('Log in to Claude Code in Connections.'))) })
-  const account = JSON.parse(login)
-  if (!account.loggedIn || account.authMethod !== 'claude.ai') throw new Error('A Claude subscription login is required.')
-  const root = git(['rev-parse', '--show-toplevel']).trim()
-  const common = path.resolve(root, git(['rev-parse', '--git-common-dir']).trim())
-  const worktree = path.join(common, 'giz-engine-worktrees', randomUUID())
-  await mkdir(path.dirname(worktree), { recursive: true })
-  git(['worktree', 'add', '--detach', worktree, 'HEAD'])
-  progress({ status: 'running', engine, worktree })
-  const child = spawn('claude', ['-p', instruction, '--output-format', 'stream-json', '--verbose', '--permission-mode', 'acceptEdits'],
-    { cwd: worktree, env, detached: true, stdio: ['ignore', 'pipe', 'pipe'] })
-  let output = '', summary = '', stopped = false
-  const stop = () => { stopped = true; try { process.kill(-child.pid, 'SIGTERM') } catch {} }
-  process.once('SIGTERM', stop); process.once('SIGINT', stop)
-  child.stdout.on('data', chunk => {
-    output += chunk
-    let newline
-    while ((newline = output.indexOf('\n')) >= 0) {
-      const line = output.slice(0, newline); output = output.slice(newline + 1)
-      try {
-        const event = JSON.parse(line)
-        if (event.type === 'result') summary = String(event.result || '')
-        // Do not pass raw tool inputs, prompts or authorization data into the task card.
-        progress({ status: 'running', event: event.type, engine, worktree })
-      } catch {}
-    }
-  })
-  child.stderr.resume()
-  let exitCode
-  try {
-    exitCode = await new Promise((resolve, reject) => { child.once('error', reject); child.once('close', code => resolve(code)) })
-  } finally { process.removeListener('SIGTERM', stop); process.removeListener('SIGINT', stop) }
-  const tracked = git(['diff', '--name-only', 'HEAD'], worktree).trim().split('\n').filter(Boolean)
-  const created = git(['ls-files', '--others', '--exclude-standard'], worktree).trim().split('\n').filter(Boolean)
-  let diff = git(['diff', '--binary', 'HEAD'], worktree)
-  for (const file of created) {
-    try { diff += git(['diff', '--no-index', '--binary', '--', '/dev/null', file], worktree) }
-    catch (error) {
-      if (error.status !== 1) throw error
-      diff += String(error.stdout)
-    }
-  }
-  return { status: stopped ? 'canceled' : exitCode === 0 ? 'completed' : 'failed', engine, exitCode, worktree, files: [...new Set([...tracked, ...created])], diff, summary }
-}