@goodtek/vibeops 0.2.0 → 0.4.0

package/dist/lib/plan-apply-planner.js

@@ -0,0 +1,131 @@
+import { join } from "node:path";
+import { codexOAuthTextCompletion } from "./plan-codex-responses.js";
+import { cursorAgentPrint, extractAgentAssistantText } from "./plan-llm-cursor-agent.js";
+import { openAiChatCompletionText } from "./plan-llm-openai.js";
+import { writeText } from "./filesystem.js";
+import { bold, dim, log } from "./logger.js";
+import { isGitRepository, runGit, gitCommit } from "./git.js";
+const PLANNER_APPLY_SYSTEM = `You are executing the VibeOps **Planner Agent** step in this run.
+
+The user message is the full planning prompt (role, ProjectBrief, output format, and file list). Follow it exactly: same doc files, same TASK template sections, same hard rules (docs only under docs/, no application code, no .vibeops edits).
+
+Reply with normal markdown only. Include the **Plan Summary** bullets first, then one fenced code block per file.
+
+For every file block:
+- Use a fenced block (\`\`\`markdown ... \`\`\` or plain \`\`\` ... \`\`\`).
+- The **first line inside the block** must be exactly: \`<!-- file: <repo-relative-path> -->\` with a path under \`docs/project/\` or \`docs/tasks/\` only.
+- The remaining lines are the full file body.`;
+const ALLOWED_PREFIXES = ["docs/project/", "docs/tasks/"];
+export function isSafePlannerRepoRelPath(p) {
+    const norm = p.replace(/\\/g, "/").trim().replace(/^\/+/, "");
+    if (norm.includes(".."))
+        return false;
+    return ALLOWED_PREFIXES.some((pre) => norm.startsWith(pre));
+}
+/**
+ * Extracts `<!-- file: path -->` fenced blocks from planner markdown output.
+ */
+export function parsePlannerFenceFiles(markdown) {
+    const out = [];
+    const re = /```(?:[a-zA-Z0-9+-]*)?\s*\n([\s\S]*?)```/g;
+    let m;
+    while ((m = re.exec(markdown)) !== null) {
+        const inner = m[1].replace(/\r\n/g, "\n");
+        const firstNl = inner.indexOf("\n");
+        const firstLine = (firstNl >= 0 ? inner.slice(0, firstNl) : inner).trim();
+        const body = firstNl >= 0 ? inner.slice(firstNl + 1) : "";
+        const dm = /^\s*<!--\s*file:\s*(.+?)\s*-->\s*$/i.exec(firstLine);
+        if (!dm)
+            continue;
+        const relPath = dm[1].trim().replace(/\\/g, "/");
+        if (!isSafePlannerRepoRelPath(relPath)) {
+            log.warn(`Skipping disallowed planner path: ${relPath}`);
+            continue;
+        }
+        out.push({ relativePath: relPath, content: body });
+    }
+    return out;
+}
+function dedupeByPath(files) {
+    const map = new Map();
+    for (const f of files) {
+        if (map.has(f.relativePath)) {
+            log.warn(`Duplicate planner path in model output (using last): ${f.relativePath}`);
+        }
+        map.set(f.relativePath, f);
+    }
+    return [...map.values()];
+}
+export async function runPlannerApplyMarkdown(params) {
+    const { cwd, planPromptMarkdown, provider, model } = params;
+    if (provider === "openai") {
+        const messages = [
+            { role: "system", content: PLANNER_APPLY_SYSTEM },
+            { role: "user", content: planPromptMarkdown },
+        ];
+        return openAiChatCompletionText({ messages, model });
+    }
+    if (provider === "codex-oauth") {
+        const messages = [
+            { role: "system", content: PLANNER_APPLY_SYSTEM },
+            { role: "user", content: planPromptMarkdown },
+        ];
+        return codexOAuthTextCompletion(messages, model !== undefined ? { model } : undefined);
+    }
+    const prompt = `${PLANNER_APPLY_SYSTEM}\n\n--- Planning prompt ---\n${planPromptMarkdown}`;
+    const raw = await cursorAgentPrint({ cwd, prompt, model });
+    return extractAgentAssistantText(raw);
+}
+export async function writePlannerFiles(cwd, files) {
+    const written = [];
+    for (const f of files) {
+        const abs = join(cwd, f.relativePath);
+        await writeText(abs, f.content);
+        written.push(f.relativePath);
+    }
+    return written;
+}
+export async function commitPlannerGit(cwd, repoRelativePaths, message) {
+    if (!(await isGitRepository(cwd))) {
+        log.warn("Not a Git repository — skipping commit.");
+        return;
+    }
+    if (repoRelativePaths.length === 0)
+        return;
+    for (const p of repoRelativePaths) {
+        await runGit(cwd, ["add", "--", p]);
+    }
+    await gitCommit(cwd, message);
+}
+export async function pushPlannerGit(cwd) {
+    if (!(await isGitRepository(cwd))) {
+        log.warn("Not a Git repository — skipping push.");
+        return;
+    }
+    await runGit(cwd, ["push"]);
+}
+export async function applyPlannerMarkdownFlow(params) {
+    log.blank();
+    log.step(bold("Planner apply — calling LLM with the planning prompt"));
+    log.info(dim(`  provider: ${params.provider}${params.model ? `  model: ${params.model}` : ""}`));
+    const rawMarkdown = await runPlannerApplyMarkdown(params);
+    const files = dedupeByPath(parsePlannerFenceFiles(rawMarkdown));
+    if (files.length === 0) {
+        throw new Error("Planner apply: model output contained no usable <!-- file: ... --> fenced blocks under docs/project/ or docs/tasks/.");
+    }
+    if (params.dryRun) {
+        log.blank();
+        log.info(bold("[dry-run] Would write:"));
+        for (const f of files) {
+            log.info(`  · ${f.relativePath} (${f.content.length} chars)`);
+        }
+        return { rawMarkdown, files, writtenRelativePaths: [] };
+    }
+    const writtenRelativePaths = await writePlannerFiles(params.cwd, files);
+    log.blank();
+    log.ok(`Wrote ${writtenRelativePaths.length} file(s) under docs/`);
+    for (const p of writtenRelativePaths) {
+        log.info(dim(`  · ${p}`));
+    }
+    return { rawMarkdown, files, writtenRelativePaths };
+}

package/dist/lib/plan-codex-auth.js

@@ -0,0 +1,183 @@
+/**
+ * Codex / ChatGPT OAuth — same public client_id and token endpoint as
+ * Hermes (`hermes_cli/auth.py`) and OpenClaw's openai-codex provider.
+ * Reads credentials written by the official Codex CLI (`codex login`) under
+ * `CODEX_HOME` (default ~/.codex/auth.json).
+ *
+ * @see https://developers.openai.com/codex/auth
+ * @see https://docs.openclaw.ai/concepts/oauth (OpenAI Codex OAuth)
+ */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/** Public OAuth client id used by Codex CLI / Hermes / OpenClaw for ChatGPT login. */
+export const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const DEFAULT_CODEX_HOME = () => join(homedir(), ".codex");
+export function codexAuthJsonPath() {
+    const home = process.env.CODEX_HOME?.trim();
+    return join(home && home.length > 0 ? home : DEFAULT_CODEX_HOME(), "auth.json");
+}
+function decodeJwtExpMs(accessToken) {
+    const parts = accessToken.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - (b64.length % 4));
+        const json = Buffer.from(b64 + pad, "base64").toString("utf8");
+        const payload = JSON.parse(json);
+        return typeof payload.exp === "number" ? payload.exp * 1000 : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function codexAccessTokenExpiring(accessToken, skewSeconds) {
+    const expMs = decodeJwtExpMs(accessToken);
+    if (expMs === null)
+        return true;
+    return Date.now() >= expMs - skewSeconds * 1000;
+}
+/**
+ * Checks that `auth.json` exists and contains access + refresh tokens (shape
+ * compatible with the Codex CLI file store).
+ */
+export async function probeCodexOAuthFile() {
+    const path = codexAuthJsonPath();
+    try {
+        const raw = await readFile(path, "utf-8");
+        const data = JSON.parse(raw);
+        const tokens = (data.tokens ?? data);
+        const access = typeof tokens.access_token === "string" ? tokens.access_token.trim() : "";
+        const refresh = typeof tokens.refresh_token === "string" ? tokens.refresh_token.trim() : "";
+        if (access.length === 0 || refresh.length === 0) {
+            return {
+                ok: false,
+                path,
+                reason: "auth.json exists but is missing access_token or refresh_token.",
+            };
+        }
+        return { ok: true, path };
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === "ENOENT") {
+            return {
+                ok: false,
+                path,
+                reason: "No Codex auth file yet. With an interactive TTY, `vibeops plan` can open ChatGPT OAuth in the browser; otherwise run `codex login` or copy auth.json.",
+            };
+        }
+        const msg = e instanceof Error ? e.message : String(e);
+        return { ok: false, path, reason: msg };
+    }
+}
+async function readAuthPayload() {
+    const path = codexAuthJsonPath();
+    try {
+        const raw = await readFile(path, "utf-8");
+        const root = JSON.parse(raw);
+        return { path, root };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Writes or merges OAuth tokens into the Codex CLI auth file (`auth.json`).
+ */
+export async function saveCodexAuthTokens(tokens) {
+    const path = codexAuthJsonPath();
+    await mkdir(dirname(path), { recursive: true });
+    let root = {};
+    try {
+        root = JSON.parse(await readFile(path, "utf-8"));
+    }
+    catch {
+        /* new file */
+    }
+    const tokenBag = root.tokens !== undefined && typeof root.tokens === "object" && !Array.isArray(root.tokens)
+        ? { ...root.tokens }
+        : {};
+    tokenBag.access_token = tokens.access_token;
+    tokenBag.refresh_token = tokens.refresh_token;
+    if (typeof tokens.id_token === "string" && tokens.id_token.length > 0) {
+        tokenBag.id_token = tokens.id_token;
+    }
+    root.tokens = tokenBag;
+    root.auth_mode = "chatgpt";
+    await writeFile(path, `${JSON.stringify(root, null, 2)}\n`, "utf-8");
+}
+function extractTokens(root) {
+    const tokens = (root.tokens ?? root);
+    const access = typeof tokens.access_token === "string" ? tokens.access_token.trim() : "";
+    const refresh = typeof tokens.refresh_token === "string" ? tokens.refresh_token.trim() : "";
+    if (!access || !refresh)
+        return null;
+    return { access_token: access, refresh_token: refresh };
+}
+/**
+ * Exchanges refresh_token for a new access_token (and optional rotated refresh).
+ */
+export async function refreshCodexOAuthTokens(refreshToken) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: CODEX_OAUTH_CLIENT_ID,
+    });
+    const res = await fetch(CODEX_OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`Codex OAuth refresh failed (${res.status}): ${text.slice(0, 400)}`);
+    }
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Codex OAuth refresh returned invalid JSON.");
+    }
+    const access = typeof json.access_token === "string" ? json.access_token.trim() : "";
+    if (!access) {
+        throw new Error("Codex OAuth refresh response missing access_token.");
+    }
+    const nextRefresh = typeof json.refresh_token === "string" && json.refresh_token.trim().length > 0
+        ? json.refresh_token.trim()
+        : refreshToken;
+    return { access_token: access, refresh_token: nextRefresh };
+}
+/**
+ * Returns a usable access token, refreshing and persisting to auth.json when
+ * the JWT is near expiry (same pattern as Hermes `resolve_codex_runtime_credentials`).
+ */
+export async function resolveCodexOAuthAccessToken(skewSeconds = 120) {
+    const loaded = await readAuthPayload();
+    if (!loaded) {
+        throw new Error(`Codex auth file missing: ${codexAuthJsonPath()}`);
+    }
+    const { path, root } = loaded;
+    let pair = extractTokens(root);
+    if (!pair) {
+        throw new Error(`Codex auth file has no tokens: ${path}`);
+    }
+    if (codexAccessTokenExpiring(pair.access_token, skewSeconds)) {
+        pair = await refreshCodexOAuthTokens(pair.refresh_token);
+        const nextRoot = { ...root };
+        const tokenBag = nextRoot.tokens !== undefined && typeof nextRoot.tokens === "object" && !Array.isArray(nextRoot.tokens)
+            ? { ...nextRoot.tokens }
+            : {};
+        tokenBag.access_token = pair.access_token;
+        tokenBag.refresh_token = pair.refresh_token;
+        nextRoot.tokens = tokenBag;
+        await writeFile(path, `${JSON.stringify(nextRoot, null, 2)}\n`, "utf-8");
+    }
+    return { accessToken: pair.access_token };
+}

package/dist/lib/plan-codex-pkce.js

@@ -0,0 +1,234 @@
+/**
+ * Browser PKCE OAuth for OpenAI Codex (ChatGPT) — same parameters as community
+ * clients (authorize URL, localhost redirect, S256 challenge, token exchange).
+ *
+ * @see https://docs.rs/codex-oauth/latest/codex_oauth/
+ */
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { askInput } from "./inquirer-helpers.js";
+import { bold, cyan, dim, log, yellow } from "./logger.js";
+import { CODEX_OAUTH_CLIENT_ID, CODEX_OAUTH_TOKEN_URL, saveCodexAuthTokens, } from "./plan-codex-auth.js";
+export const CODEX_OAUTH_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+/** Must match OpenAI's registered redirect for this public Codex client. */
+export const CODEX_OAUTH_REDIRECT_URI = "http://localhost:1455/auth/callback";
+const CODEX_SCOPES = "openid profile email offline_access";
+const CALLBACK_WAIT_MS = 600_000;
+function toBase64Url(buf) {
+    return buf
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/g, "");
+}
+export function createPkceVerifier() {
+    return toBase64Url(randomBytes(32));
+}
+export function createPkceChallenge(verifier) {
+    return toBase64Url(createHash("sha256").update(verifier).digest());
+}
+export function createOAuthState() {
+    return randomBytes(16).toString("hex");
+}
+export function buildCodexAuthorizeUrl(params) {
+    const challenge = createPkceChallenge(params.verifier);
+    const url = new URL(CODEX_OAUTH_AUTHORIZE_URL);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", CODEX_OAUTH_CLIENT_ID);
+    url.searchParams.set("redirect_uri", CODEX_OAUTH_REDIRECT_URI);
+    url.searchParams.set("scope", CODEX_SCOPES);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("id_token_add_organizations", "true");
+    url.searchParams.set("codex_cli_simplified_flow", "true");
+    url.searchParams.set("originator", "pi");
+    return url.toString();
+}
+function openSystemBrowser(url) {
+    const platform = process.platform;
+    if (platform === "darwin") {
+        spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
+    }
+    else if (platform === "win32") {
+        spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+    }
+    else {
+        spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    }
+}
+function parseCallbackInput(input, expectedState) {
+    const value = input.trim();
+    if (value.length === 0)
+        return null;
+    try {
+        const u = new URL(value);
+        if (u.searchParams.get("state") !== expectedState)
+            return null;
+        const code = u.searchParams.get("code");
+        return code && code.length > 0 ? code : null;
+    }
+    catch {
+        if (value.includes("code=")) {
+            try {
+                const params = value.startsWith("http") ? new URL(value).searchParams : new URLSearchParams(value);
+                if (params.get("state") !== expectedState)
+                    return null;
+                const c = params.get("code");
+                return c && c.length > 0 ? c : null;
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return null;
+}
+export async function exchangeCodexAuthorizationCode(code, verifier) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: CODEX_OAUTH_CLIENT_ID,
+        code,
+        code_verifier: verifier,
+        redirect_uri: CODEX_OAUTH_REDIRECT_URI,
+    });
+    const res = await fetch(CODEX_OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`Codex token exchange failed (${res.status}): ${text.slice(0, 600)}`);
+    }
+    const json = JSON.parse(text);
+    const access = typeof json.access_token === "string" ? json.access_token.trim() : "";
+    const refresh = typeof json.refresh_token === "string" ? json.refresh_token.trim() : "";
+    if (!access || !refresh) {
+        throw new Error("Codex token exchange returned no access_token/refresh_token.");
+    }
+    const id = typeof json.id_token === "string" && json.id_token.trim().length > 0
+        ? json.id_token.trim()
+        : undefined;
+    return { access_token: access, refresh_token: refresh, id_token: id };
+}
+export function startCodexCallbackServer(expectedState) {
+    return new Promise((outerResolve) => {
+        let outerDone = false;
+        let deliverCode = null;
+        const codePromise = new Promise((r) => {
+            deliverCode = r;
+        });
+        const server = createServer((req, res) => {
+            try {
+                const addr = server.address();
+                const port = addr?.port ?? 1455;
+                const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+                if (url.pathname !== "/auth/callback") {
+                    res.writeHead(404, { "Content-Type": "text/plain" });
+                    res.end("Not found");
+                    return;
+                }
+                if (url.searchParams.get("state") !== expectedState) {
+                    res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<p>Invalid state. Close this tab and try again from the terminal.</p>");
+                    return;
+                }
+                const code = url.searchParams.get("code");
+                if (!code) {
+                    res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<p>Missing code. Close this tab and try again.</p>");
+                    return;
+                }
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<p>ChatGPT sign-in complete. You can close this tab and return to the terminal.</p>");
+                deliverCode?.(code);
+                deliverCode = null;
+                server.close();
+            }
+            catch {
+                res.writeHead(500);
+                res.end();
+            }
+        });
+        const finishOuter = (handle) => {
+            if (outerDone)
+                return;
+            outerDone = true;
+            outerResolve(handle);
+        };
+        server.once("error", () => {
+            finishOuter(null);
+        });
+        server.listen(1455, "127.0.0.1", () => {
+            finishOuter({
+                wait: () => Promise.race([
+                    codePromise,
+                    new Promise((r) => setTimeout(() => r(null), CALLBACK_WAIT_MS)),
+                ]),
+                close: () => {
+                    deliverCode?.(null);
+                    deliverCode = null;
+                    server.close();
+                },
+            });
+        });
+    });
+}
+/**
+ * Opens the system browser, completes PKCE OAuth, and writes `~/.codex/auth.json`.
+ */
+export async function runCodexPkceOAuthLogin() {
+    const verifier = createPkceVerifier();
+    const state = createOAuthState();
+    const authUrl = buildCodexAuthorizeUrl({ state, verifier });
+    log.blank();
+    log.info(bold("ChatGPT (Codex) OAuth"));
+    log.info("A browser window will open. Sign in with your ChatGPT account that has Codex access.");
+    log.info(`If it does not open, visit:`);
+    log.info(`  ${cyan(authUrl)}`);
+    log.blank();
+    const handle = await startCodexCallbackServer(state);
+    if (handle === null) {
+        log.warn(`${yellow("!")} Could not listen on ${cyan("localhost:1455")} (port may be in use). Complete sign-in in the browser, then paste the redirect URL below.`);
+        openSystemBrowser(authUrl);
+        const pasted = await askInput({
+            message: "Paste the full redirect URL (http://localhost:1455/auth/callback?...)",
+            nonInteractive: false,
+        });
+        const code = parseCallbackInput(pasted, state);
+        if (!code) {
+            throw new Error("Could not read authorization code from pasted URL.");
+        }
+        const tokens = await exchangeCodexAuthorizationCode(code, verifier);
+        await saveCodexAuthTokens(tokens);
+        log.ok(`Saved Codex tokens to ${dim("~/.codex/auth.json")} (or $CODEX_HOME).`);
+        return;
+    }
+    try {
+        openSystemBrowser(authUrl);
+        log.info(dim("Waiting for redirect (up to 10 minutes). Press Ctrl+C to cancel."));
+        let code = await handle.wait();
+        if (code === null || code.length === 0) {
+            log.warn("No redirect received in time — paste the callback URL from the browser.");
+            const pasted = await askInput({
+                message: "Paste the full redirect URL",
+                nonInteractive: false,
+            });
+            code = parseCallbackInput(pasted, state);
+        }
+        if (!code) {
+            throw new Error("No authorization code received.");
+        }
+        const tokens = await exchangeCodexAuthorizationCode(code, verifier);
+        await saveCodexAuthTokens(tokens);
+        log.ok(`Saved Codex tokens to ${dim("~/.codex/auth.json")} (or $CODEX_HOME).`);
+    }
+    finally {
+        handle.close();
+    }
+}