@hraness/dawg 0.0.0-stage → 0.2.0

package/src/auth/cli.ts

@@ -0,0 +1,112 @@
+import { hostname } from "node:os";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { defaultAuthEnv } from "./credentials.ts";
+import {
+  authStatus,
+  login,
+  logout,
+  type LoginIO,
+  type LoginMode,
+} from "./login.ts";
+import { systemRunner } from "./runner.ts";
+import { audioStatusLine } from "../audio/engine.ts";
+
+export const AUTH_USAGE = `Usage:
+  dawg login            create an AI Gateway key with the Vercel CLI (default)
+  dawg login --key      paste an existing AI Gateway key (hidden input)
+  dawg login --xcb      use a Claude/Codex/Devin subscription through xcb
+  dawg login --budget <dollars>   spend limit for the created key
+  dawg logout           remove the stored key and provider choice
+  dawg auth status [--check]      show provider, key, xcb account, audio backend`;
+
+/** Entry for `dawg login|logout|auth`. Returns the process exit code. */
+export async function runAuthCommand(argv: readonly string[]): Promise<number> {
+  const [command, ...rest] = argv;
+  const io = terminalIO();
+  const deps = { auth: defaultAuthEnv(systemRunner), io, hostname: hostname() };
+  if (rest.includes("--help") || rest.includes("-h")) {
+    io.print(AUTH_USAGE);
+    return 0;
+  }
+  if (command === "logout") return logout(deps);
+  if (command === "auth") {
+    if (
+      rest[0] !== undefined &&
+      rest[0] !== "status" &&
+      rest[0] !== "--check"
+    ) {
+      io.print(AUTH_USAGE);
+      return 2;
+    }
+    for (const line of await authStatus(deps, {
+      verify: rest.includes("--check"),
+    }))
+      io.print(line);
+    io.print(audioStatusLine());
+    return 0;
+  }
+  const flags = new Set(rest.filter((arg) => arg.startsWith("--")));
+  const mode: LoginMode = flags.has("--xcb")
+    ? "xcb"
+    : flags.has("--key")
+      ? "key"
+      : "gateway";
+  let budget: number | undefined;
+  const budgetIndex = rest.indexOf("--budget");
+  if (budgetIndex >= 0) {
+    budget = Number(rest[budgetIndex + 1]);
+    if (!Number.isFinite(budget) || budget < 1 || budget > 1_000_000) {
+      io.print("--budget takes a dollar amount of at least 1");
+      return 2;
+    }
+  }
+  return login(mode, deps, budget === undefined ? {} : { budget });
+}
+
+function terminalIO(): LoginIO {
+  return {
+    interactive: Boolean(stdin.isTTY && stdout.isTTY),
+    print: (line) => void stdout.write(`${line}\n`),
+    async ask(prompt) {
+      const rl = createInterface({ input: stdin, output: stdout });
+      try {
+        return (await rl.question(prompt)).slice(0, 200);
+      } finally {
+        rl.close();
+      }
+    },
+    readSecret: (prompt) => readHidden(prompt),
+  };
+}
+
+/** Read one line in raw mode without echo. Ctrl-C rejects. */
+function readHidden(prompt: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    stdout.write(prompt);
+    let value = "";
+    const wasRaw = stdin.isRaw;
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    const done = (error?: Error) => {
+      stdin.off("data", onData);
+      stdin.setRawMode?.(wasRaw);
+      stdin.pause();
+      stdout.write("\n");
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk: Buffer) => {
+      let text = chunk.toString("utf8");
+      // Bracketed paste markers, if the terminal sends them.
+      text = text.replace(/\u001b\[20[01]~/g, "");
+      for (const char of text) {
+        if (char === "\u0003") return done(new Error("cancelled"));
+        if (char === "\r" || char === "\n") return done();
+        if (char === "\u007f" || char === "\b") value = value.slice(0, -1);
+        else if (char >= " " && value.length < 512) value += char;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}

package/src/auth/credentials.ts

@@ -0,0 +1,285 @@
+import { randomBytes } from "node:crypto";
+import {
+  chmod,
+  mkdir,
+  open,
+  readFile,
+  rename,
+  rm,
+  stat,
+} from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { CommandRunner } from "./runner.ts";
+
+/**
+ * Local credentials and provider choice. Secrets live in the macOS Keychain
+ * or `~/.config/dawg/credentials.json` (0600 under a 0700 directory), never in
+ * the project's `.dawg/` directory. `AI_GATEWAY_API_KEY` always wins.
+ */
+export const KEYCHAIN_SERVICE = "dawg";
+export const CONFIG_DIR_NAME = "dawg";
+export const KEYCHAIN_ACCOUNT = "ai-gateway";
+const MAX_CONFIG_BYTES = 16 * 1024;
+/** Gateway keys are opaque tokens; restricting the alphabet keeps them quote-safe. */
+const KEY_PATTERN = /^[A-Za-z0-9._-]{16,256}$/;
+const XCB_ACCOUNT_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const XCB_MODEL_PATTERN = /^[A-Za-z0-9._:/-]{1,200}$/;
+
+export const PROVIDER_CHOICES = Object.freeze([
+  "gateway",
+  "xcb",
+  "auto",
+] as const);
+export type ProviderChoice = (typeof PROVIDER_CHOICES)[number];
+
+export type DawgConfig = Readonly<{
+  provider?: ProviderChoice;
+  xcb?: Readonly<{ account: string; model: string }>;
+}>;
+
+export type CredentialSource = "env" | "keychain" | "file";
+export type ResolvedKey = Readonly<{ key: string; source: CredentialSource }>;
+
+export type AuthEnv = Readonly<{
+  env: Readonly<Record<string, string | undefined>>;
+  runner: CommandRunner;
+  platform: string;
+  /** Absolute config directory; see `configDir`. */
+  dir: string;
+}>;
+
+export function configDir(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): string {
+  const explicit = env.DAWG_CONFIG_DIR;
+  if (explicit) return explicit;
+  const base = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), ".config");
+  return join(base, CONFIG_DIR_NAME);
+}
+
+export function defaultAuthEnv(runner: CommandRunner): AuthEnv {
+  return {
+    env: process.env,
+    runner,
+    platform: process.platform,
+    dir: configDir(),
+  };
+}
+
+export function isValidKey(value: unknown): value is string {
+  return typeof value === "string" && KEY_PATTERN.test(value);
+}
+
+/** `vck_…abcd`: never more than a short prefix and the last four characters. */
+export function maskKey(key: string): string {
+  if (key.length < 12) return "…";
+  const underscore = key.indexOf("_");
+  const prefix =
+    underscore > 0 && underscore <= 4 ? key.slice(0, underscore + 1) : "";
+  return `${prefix}…${key.slice(-4)}`;
+}
+
+function useKeychain(auth: AuthEnv): boolean {
+  return (
+    auth.platform === "darwin" &&
+    auth.env.DAWG_CREDENTIAL_STORE !== "file" &&
+    auth.runner.which("security") !== undefined
+  );
+}
+
+/** Env, then Keychain, then the credentials file. */
+export async function resolveGatewayKey(
+  auth: AuthEnv,
+): Promise<ResolvedKey | undefined> {
+  const fromEnv = auth.env.AI_GATEWAY_API_KEY?.trim();
+  if (fromEnv) return { key: fromEnv, source: "env" };
+  if (useKeychain(auth)) {
+    const key = (await readKeychain(auth, KEYCHAIN_SERVICE)) ?? "";
+    if (isValidKey(key)) return { key, source: "keychain" };
+  }
+  const file = await readJsonObject(join(auth.dir, "credentials.json"));
+  const key = file?.aiGateway;
+  if (isValidKey(key)) return { key, source: "file" };
+  return undefined;
+}
+
+/** Store the key. Returns where it went. Throws on an invalid key. */
+export async function storeGatewayKey(
+  auth: AuthEnv,
+  key: string,
+): Promise<"keychain" | "file"> {
+  if (!isValidKey(key))
+    throw new Error("that does not look like an AI Gateway key");
+  if (useKeychain(auth)) {
+    // `security -i` reads the command from stdin, so the secret never appears
+    // in any process's argv. KEY_PATTERN guarantees it needs no escaping.
+    const result = await auth.runner
+      .run("security", ["-i"], {
+        stdin: `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT} -l "dawg AI Gateway key" -w "${key}"\n`,
+        timeoutMs: 15_000,
+        maxOutputBytes: 4096,
+      })
+      .catch(() => undefined);
+    if (result?.code === 0) {
+      const check = await resolveFromKeychainOnly(auth);
+      if (check === key) {
+        await removeFileKey(auth);
+        return "keychain";
+      }
+    }
+  }
+  const path = join(auth.dir, "credentials.json");
+  const current = (await readJsonObject(path)) ?? {};
+  await writePrivateJson(auth.dir, path, {
+    ...current,
+    version: 1,
+    aiGateway: key,
+  });
+  return "file";
+}
+
+async function resolveFromKeychainOnly(
+  auth: AuthEnv,
+): Promise<string | undefined> {
+  return readKeychain(auth, KEYCHAIN_SERVICE);
+}
+
+async function readKeychain(
+  auth: AuthEnv,
+  service: string,
+): Promise<string | undefined> {
+  const result = await auth.runner
+    .run(
+      "security",
+      ["find-generic-password", "-s", service, "-a", KEYCHAIN_ACCOUNT, "-w"],
+      { timeoutMs: 10_000, maxOutputBytes: 4096 },
+    )
+    .catch(() => undefined);
+  return result?.code === 0 ? result.stdout.trim() : undefined;
+}
+
+/** Remove stored keys from both backends. Env keys are left to the user. */
+export async function clearGatewayKey(auth: AuthEnv): Promise<string[]> {
+  const removed: string[] = [];
+  if (useKeychain(auth)) {
+    const result = await auth.runner
+      .run(
+        "security",
+        [
+          "delete-generic-password",
+          "-s",
+          KEYCHAIN_SERVICE,
+          "-a",
+          KEYCHAIN_ACCOUNT,
+        ],
+        { timeoutMs: 10_000, maxOutputBytes: 4096 },
+      )
+      .catch(() => undefined);
+    if (result?.code === 0) removed.push("keychain");
+  }
+  if (await removeFileKey(auth)) removed.push("file");
+  return removed;
+}
+
+async function removeFileKey(auth: AuthEnv): Promise<boolean> {
+  const path = join(auth.dir, "credentials.json");
+  const current = await readJsonObject(path);
+  if (!current || !("aiGateway" in current)) return false;
+  const { aiGateway: _removed, ...rest } = current;
+  if (Object.keys(rest).filter((key) => key !== "version").length === 0)
+    await rm(path, { force: true });
+  else await writePrivateJson(auth.dir, path, rest);
+  return true;
+}
+
+export async function readConfig(
+  auth: Pick<AuthEnv, "dir">,
+): Promise<DawgConfig> {
+  return parseConfig(await readJsonObject(join(auth.dir, "config.json")));
+}
+
+export function parseConfig(value: unknown): DawgConfig {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return {};
+  const record = value as Record<string, unknown>;
+  const config: {
+    provider?: ProviderChoice;
+    xcb?: { account: string; model: string };
+  } = {};
+  if (PROVIDER_CHOICES.includes(record.provider as ProviderChoice))
+    config.provider = record.provider as ProviderChoice;
+  const xcb = record.xcb;
+  if (typeof xcb === "object" && xcb !== null && !Array.isArray(xcb)) {
+    const { account, model } = xcb as Record<string, unknown>;
+    if (
+      typeof account === "string" &&
+      XCB_ACCOUNT_PATTERN.test(account) &&
+      typeof model === "string" &&
+      XCB_MODEL_PATTERN.test(model)
+    )
+      config.xcb = { account, model };
+  }
+  return config;
+}
+
+export async function writeConfig(
+  auth: Pick<AuthEnv, "dir">,
+  patch: Partial<{
+    provider: ProviderChoice | undefined;
+    xcb: DawgConfig["xcb"] | undefined;
+  }>,
+): Promise<DawgConfig> {
+  const next: Record<string, unknown> = { ...(await readConfig(auth)) };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === undefined) delete next[key];
+    else next[key] = value;
+  }
+  const parsed = parseConfig(next);
+  await writePrivateJson(auth.dir, join(auth.dir, "config.json"), {
+    version: 1,
+    ...parsed,
+  });
+  return parsed;
+}
+
+async function readJsonObject(
+  path: string,
+): Promise<Record<string, unknown> | undefined> {
+  try {
+    const info = await stat(path);
+    if (!info.isFile() || info.size > MAX_CONFIG_BYTES) return undefined;
+    const parsed: unknown = JSON.parse(await readFile(path, "utf8"));
+    return typeof parsed === "object" &&
+      parsed !== null &&
+      !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Write via a 0600 temp file and rename, under a 0700 directory. */
+export async function writePrivateJson(
+  dir: string,
+  path: string,
+  value: unknown,
+): Promise<void> {
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await chmod(dir, 0o700);
+  const temp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  const handle = await open(temp, "wx", 0o600);
+  try {
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    await rename(temp, path);
+  } catch (error) {
+    await rm(temp, { force: true });
+    throw error;
+  }
+}