@hraness/dawg 0.2.0 → 0.4.0

package/src/auth/cli.ts

@@ -1,26 +1,44 @@
 import { hostname } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
-import { defaultAuthEnv } from "./credentials.ts";
+import {
+  defaultAuthEnv,
+  readConfig,
+  writeConfig,
+  type DawgConfig,
+} from "./credentials.ts";
 import {
   authStatus,
+  isLogoutTarget,
   login,
   logout,
+  modelCommand,
   type LoginIO,
-  type LoginMode,
+  type LoginOptions,
+  type LoginTarget,
 } from "./login.ts";
-import { systemRunner } from "./runner.ts";
+import { LOGIN_OPTIONS } from "./discover.ts";
+import { chooseOnTerminal } from "./picker.ts";
+import { systemRunner, type CommandRunner } from "./runner.ts";
+import { selectProvider } from "../agent/provider.ts";
 import { audioStatusLine } from "../audio/engine.ts";
 
 export const AUTH_USAGE = `Usage:
-  dawg login            create an AI Gateway key with the Vercel CLI (default)
-  dawg login --key      paste an existing AI Gateway key (hidden input)
-  dawg login --xcb      use a Claude/Codex/Devin subscription through xcb
-  dawg login --budget <dollars>   spend limit for the created key
-  dawg logout           remove the stored key and provider choice
-  dawg auth status [--check]      show provider, key, xcb account, audio backend`;
+  dawg login                  find existing setups and pick a provider (reuses a saved one)
+  dawg login gateway          Vercel AI Gateway: existing key, or create one with the Vercel CLI
+  dawg login openrouter       OpenRouter: sign in through your browser (OAuth PKCE)
+  dawg login codex            ChatGPT/Codex subscription through xcb
+  dawg login claude           Claude subscription through xcb
+  dawg login --pick           show the picker even when a provider is saved
+  dawg login --key            paste an AI Gateway key (hidden input)
+  dawg login --xcb            any xcb account (Devin included)
+  dawg login gateway --budget <dollars>   spend limit for a created key
+  dawg login codex|claude [--account <id>] [--model <key>]
+  dawg model [<alias>|<vendor/model>]     pick the model (cost per prompt shown)
+  dawg logout [gateway|openrouter|codex|claude|xcb]   forget keys and the saved choice
+  dawg auth status [--check]  every provider: detected, active, validated`;
 
-/** Entry for `dawg login|logout|auth`. Returns the process exit code. */
+/** Entry for `dawg login|logout|auth|model`. Returns the process exit code. */
 export async function runAuthCommand(argv: readonly string[]): Promise<number> {
   const [command, ...rest] = argv;
   const io = terminalIO();
@@ -29,7 +47,15 @@ export async function runAuthCommand(argv: readonly string[]): Promise<number> {
     io.print(AUTH_USAGE);
     return 0;
   }
-  if (command === "logout") return logout(deps);
+  if (command === "logout") {
+    const target = rest[0];
+    if (target !== undefined && !isLogoutTarget(target)) {
+      io.print(AUTH_USAGE);
+      return 2;
+    }
+    return logout(deps, target);
+  }
+  if (command === "model") return modelCommand(deps, rest[0]);
   if (command === "auth") {
     if (
       rest[0] !== undefined &&
@@ -41,30 +67,117 @@ export async function runAuthCommand(argv: readonly string[]): Promise<number> {
     }
     for (const line of await authStatus(deps, {
       verify: rest.includes("--check"),
+      onProgress: (line) => io.print(line),
     }))
       io.print(line);
     io.print(audioStatusLine());
     return 0;
   }
-  const flags = new Set(rest.filter((arg) => arg.startsWith("--")));
-  const mode: LoginMode = flags.has("--xcb")
-    ? "xcb"
-    : flags.has("--key")
-      ? "key"
-      : "gateway";
-  let budget: number | undefined;
-  const budgetIndex = rest.indexOf("--budget");
-  if (budgetIndex >= 0) {
-    budget = Number(rest[budgetIndex + 1]);
-    if (!Number.isFinite(budget) || budget < 1 || budget > 1_000_000) {
-      io.print("--budget takes a dollar amount of at least 1");
-      return 2;
-    }
+  const parsed = parseLoginArgs(rest);
+  if (typeof parsed === "string") {
+    io.print(parsed);
+    io.print(AUTH_USAGE);
+    return 2;
+  }
+  return login(parsed.target, deps, parsed.options);
+}
+
+/**
+ * The first run of `dawg` in a terminal: when nothing is configured (and the
+ * picker was never dismissed), or a saved sign-in stopped working, show the
+ * sign-in picker before the TUI starts. Dismissing it is remembered.
+ */
+export async function runFirstRunLogin(
+  runner: CommandRunner = systemRunner,
+): Promise<void> {
+  const auth = defaultAuthEnv(runner);
+  const config = await readConfig(auth).catch(() => ({}) as DawgConfig);
+  if (auth.env.DAWG_PROVIDER) return;
+  if (!config.provider && config.setup === "skipped") return;
+  const selection = await selectProvider(auth).catch(() => undefined);
+  if (!selection || selection.kind !== "offline") return;
+  if (config.provider && !selection.invalidSaved) return;
+  const io = terminalIO();
+  if (!io.interactive) return;
+  if (selection.invalidSaved)
+    io.print(`Your saved sign-in stopped working: ${selection.reason}.`);
+  else io.print("Welcome to dawg. Sign in to enable the agent (Esc to skip).");
+  const code = await login("pick", {
+    auth,
+    io,
+    hostname: hostname(),
+  }).catch((error: unknown) => {
+    io.print(
+      `sign-in failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    return 1;
+  });
+  if (code !== 0 && !config.provider)
+    await writeConfig(auth, { setup: "skipped" }).catch(() => undefined);
+}
+
+/** `/login` in the TUI, run while the screen is handed back to the shell. */
+export async function runTuiLogin(
+  target: LoginTarget,
+  options: LoginOptions,
+  runner: CommandRunner = systemRunner,
+): Promise<number> {
+  const io = terminalIO();
+  return login(
+    target,
+    {
+      auth: defaultAuthEnv(runner),
+      io,
+      hostname: hostname(),
+    },
+    options,
+  ).catch((error: unknown) => {
+    io.print(
+      `sign-in failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    return 1;
+  });
+}
+
+export function parseLoginArgs(
+  args: readonly string[],
+): { target: LoginTarget; options: LoginOptions } | string {
+  const options: LoginOptions = {};
+  let target: LoginTarget = "auto";
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]!;
+    const value = () => {
+      const next = args[index + 1];
+      index += 1;
+      return next && !next.startsWith("--") ? next : undefined;
+    };
+    if ((LOGIN_OPTIONS as readonly string[]).includes(arg))
+      target = arg as LoginTarget;
+    else if (arg === "--gateway") target = "gateway";
+    else if (arg === "--openrouter") target = "openrouter";
+    else if (arg === "--xcb") target = "xcb";
+    else if (arg === "--key") target = "key";
+    else if (arg === "--pick") target = "pick";
+    else if (arg === "--budget") {
+      const budget = Number(value());
+      if (!Number.isFinite(budget) || budget < 1 || budget > 1_000_000)
+        return "--budget takes a dollar amount of at least 1";
+      options.budget = budget;
+      if (target === "auto") target = "gateway";
+    } else if (arg === "--account") {
+      const account = value();
+      if (!account) return "--account needs an account id";
+      options.account = account;
+    } else if (arg === "--model") {
+      const model = value();
+      if (!model) return "--model needs a model key";
+      options.model = model;
+    } else return `unknown argument: ${arg.slice(0, 40)}`;
   }
-  return login(mode, deps, budget === undefined ? {} : { budget });
+  return { target, options };
 }
 
-function terminalIO(): LoginIO {
+export function terminalIO(): LoginIO {
   return {
     interactive: Boolean(stdin.isTTY && stdout.isTTY),
     print: (line) => void stdout.write(`${line}\n`),
@@ -77,6 +190,12 @@ function terminalIO(): LoginIO {
       }
     },
     readSecret: (prompt) => readHidden(prompt),
+    ...(stdin.isTTY && stdout.isTTY
+      ? {
+          choose: (title, items, options) =>
+            chooseOnTerminal(title, items, options),
+        }
+      : {}),
   };
 }
 

package/src/auth/credentials.ts

@@ -15,30 +15,81 @@ import type { CommandRunner } from "./runner.ts";
 /**
  * Local credentials and provider choice. Secrets live in the macOS Keychain
  * or `~/.config/dawg/credentials.json` (0600 under a 0700 directory), never in
- * the project's `.dawg/` directory. `AI_GATEWAY_API_KEY` always wins.
+ * the project's `.dawg/` directory. `AI_GATEWAY_API_KEY` and
+ * `OPENROUTER_API_KEY` always win over stored keys.
  */
 export const KEYCHAIN_SERVICE = "dawg";
 export const CONFIG_DIR_NAME = "dawg";
 export const KEYCHAIN_ACCOUNT = "ai-gateway";
+
+/** The two key-based providers. Subscriptions keep their secrets in xcb. */
+export type KeyKind = "gateway" | "openrouter";
+type KeySpec = Readonly<{
+  account: string;
+  field: string;
+  env: string;
+  label: string;
+}>;
+const KEY_SPECS: Readonly<Record<KeyKind, KeySpec>> = Object.freeze({
+  gateway: {
+    account: KEYCHAIN_ACCOUNT,
+    field: "aiGateway",
+    env: "AI_GATEWAY_API_KEY",
+    label: "dawg AI Gateway key",
+  },
+  openrouter: {
+    account: "openrouter",
+    field: "openrouter",
+    env: "OPENROUTER_API_KEY",
+    label: "dawg OpenRouter key",
+  },
+});
+/** A Vercel OIDC token is a JWT; bound it and keep the alphabet quote-safe. */
+const OIDC_PATTERN = /^[A-Za-z0-9._-]{32,8192}$/;
 const MAX_CONFIG_BYTES = 16 * 1024;
 /** Gateway keys are opaque tokens; restricting the alphabet keeps them quote-safe. */
 const KEY_PATTERN = /^[A-Za-z0-9._-]{16,256}$/;
 const XCB_ACCOUNT_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
 const XCB_MODEL_PATTERN = /^[A-Za-z0-9._:/-]{1,200}$/;
 
+/**
+ * `codex` and `claude` are subscriptions through xcb; `xcb` is any xcb
+ * account (Devin included), kept for `dawg login --xcb`.
+ */
 export const PROVIDER_CHOICES = Object.freeze([
   "gateway",
+  "openrouter",
+  "codex",
+  "claude",
   "xcb",
   "auto",
 ] as const);
 export type ProviderChoice = (typeof PROVIDER_CHOICES)[number];
+export const SUBSCRIPTION_SLOTS = Object.freeze([
+  "codex",
+  "claude",
+  "xcb",
+] as const);
+export type SubscriptionSlot = (typeof SUBSCRIPTION_SLOTS)[number];
+export type XcbPick = Readonly<{ account: string; model: string }>;
 
 export type DawgConfig = Readonly<{
   provider?: ProviderChoice;
-  xcb?: Readonly<{ account: string; model: string }>;
+  xcb?: XcbPick;
+  codex?: XcbPick;
+  claude?: XcbPick;
+  /** Last model chosen per key-based provider: a `provider/model` ID. */
+  gatewayModel?: string;
+  openrouterModel?: string;
+  /** Set when the first-run picker was dismissed, so it does not nag. */
+  setup?: "skipped";
 }>;
 
-export type CredentialSource = "env" | "keychain" | "file";
+/** `vendor/model` IDs as the AI Gateway and OpenRouter spell them. */
+export const PROVIDER_MODEL_ID_PATTERN =
+  /^[a-z0-9][a-z0-9-]{0,63}\/[a-z0-9][a-z0-9._-]{0,127}$/i;
+
+export type CredentialSource = "env" | "keychain" | "file" | "oidc";
 export type ResolvedKey = Readonly<{ key: string; source: CredentialSource }>;
 
 export type AuthEnv = Readonly<{
@@ -74,6 +125,7 @@ export function isValidKey(value: unknown): value is string {
 /** `vck_…abcd`: never more than a short prefix and the last four characters. */
 export function maskKey(key: string): string {
   if (key.length < 12) return "…";
+  if (key.startsWith("sk-or-")) return `sk-or-…${key.slice(-4)}`;
   const underscore = key.indexOf("_");
   const prefix =
     underscore > 0 && underscore <= 4 ? key.slice(0, underscore + 1) : "";
@@ -89,42 +141,79 @@ function useKeychain(auth: AuthEnv): boolean {
 }
 
 /** Env, then Keychain, then the credentials file. */
-export async function resolveGatewayKey(
+export async function resolveKey(
   auth: AuthEnv,
+  kind: KeyKind,
 ): Promise<ResolvedKey | undefined> {
-  const fromEnv = auth.env.AI_GATEWAY_API_KEY?.trim();
+  const spec = KEY_SPECS[kind];
+  const fromEnv = auth.env[spec.env]?.trim();
   if (fromEnv) return { key: fromEnv, source: "env" };
+  const stored = await resolveStoredKey(auth, kind);
+  return stored;
+}
+
+/** The Keychain or the credentials file, ignoring the environment. */
+export async function resolveStoredKey(
+  auth: AuthEnv,
+  kind: KeyKind,
+): Promise<ResolvedKey | undefined> {
+  const spec = KEY_SPECS[kind];
   if (useKeychain(auth)) {
-    const key = (await readKeychain(auth, KEYCHAIN_SERVICE)) ?? "";
+    const key = (await readKeychain(auth, spec.account)) ?? "";
     if (isValidKey(key)) return { key, source: "keychain" };
   }
   const file = await readJsonObject(join(auth.dir, "credentials.json"));
-  const key = file?.aiGateway;
+  const key = file?.[spec.field];
   if (isValidKey(key)) return { key, source: "file" };
   return undefined;
 }
 
-/** Store the key. Returns where it went. Throws on an invalid key. */
-export async function storeGatewayKey(
+/**
+ * The gateway credential: `AI_GATEWAY_API_KEY`, a stored key, then a
+ * `VERCEL_OIDC_TOKEN` (what `vercel env pull` writes for a linked project;
+ * AI Gateway accepts it as a bearer token until it expires).
+ */
+export async function resolveGatewayKey(
+  auth: AuthEnv,
+): Promise<ResolvedKey | undefined> {
+  const key = await resolveKey(auth, "gateway");
+  if (key) return key;
+  const oidc = auth.env.VERCEL_OIDC_TOKEN?.trim();
+  if (oidc && OIDC_PATTERN.test(oidc)) return { key: oidc, source: "oidc" };
+  return undefined;
+}
+
+export function resolveOpenRouterKey(
   auth: AuthEnv,
+): Promise<ResolvedKey | undefined> {
+  return resolveKey(auth, "openrouter");
+}
+
+/** Store a key. Returns where it went. Throws on an invalid key. */
+export async function storeKey(
+  auth: AuthEnv,
+  kind: KeyKind,
   key: string,
 ): Promise<"keychain" | "file"> {
+  const spec = KEY_SPECS[kind];
   if (!isValidKey(key))
-    throw new Error("that does not look like an AI Gateway key");
+    throw new Error(
+      `that does not look like an ${kind === "gateway" ? "AI Gateway" : "OpenRouter"} key`,
+    );
   if (useKeychain(auth)) {
     // `security -i` reads the command from stdin, so the secret never appears
     // in any process's argv. KEY_PATTERN guarantees it needs no escaping.
     const result = await auth.runner
       .run("security", ["-i"], {
-        stdin: `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT} -l "dawg AI Gateway key" -w "${key}"\n`,
+        stdin: `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${spec.account} -l "${spec.label}" -w "${key}"\n`,
         timeoutMs: 15_000,
         maxOutputBytes: 4096,
       })
       .catch(() => undefined);
     if (result?.code === 0) {
-      const check = await resolveFromKeychainOnly(auth);
+      const check = await readKeychain(auth, spec.account);
       if (check === key) {
-        await removeFileKey(auth);
+        await removeFileKey(auth, kind);
         return "keychain";
       }
     }
@@ -134,33 +223,37 @@ export async function storeGatewayKey(
   await writePrivateJson(auth.dir, path, {
     ...current,
     version: 1,
-    aiGateway: key,
+    [spec.field]: key,
   });
   return "file";
 }
 
-async function resolveFromKeychainOnly(
+export function storeGatewayKey(
   auth: AuthEnv,
-): Promise<string | undefined> {
-  return readKeychain(auth, KEYCHAIN_SERVICE);
+  key: string,
+): Promise<"keychain" | "file"> {
+  return storeKey(auth, "gateway", key);
 }
 
 async function readKeychain(
   auth: AuthEnv,
-  service: string,
+  account: string,
 ): Promise<string | undefined> {
   const result = await auth.runner
     .run(
       "security",
-      ["find-generic-password", "-s", service, "-a", KEYCHAIN_ACCOUNT, "-w"],
+      ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"],
       { timeoutMs: 10_000, maxOutputBytes: 4096 },
     )
     .catch(() => undefined);
   return result?.code === 0 ? result.stdout.trim() : undefined;
 }
 
-/** Remove stored keys from both backends. Env keys are left to the user. */
-export async function clearGatewayKey(auth: AuthEnv): Promise<string[]> {
+/** Remove a stored key from both backends. Env keys are left to the user. */
+export async function clearKey(
+  auth: AuthEnv,
+  kind: KeyKind,
+): Promise<string[]> {
   const removed: string[] = [];
   if (useKeychain(auth)) {
     const result = await auth.runner
@@ -171,22 +264,32 @@ export async function clearGatewayKey(auth: AuthEnv): Promise<string[]> {
           "-s",
           KEYCHAIN_SERVICE,
           "-a",
-          KEYCHAIN_ACCOUNT,
+          KEY_SPECS[kind].account,
         ],
         { timeoutMs: 10_000, maxOutputBytes: 4096 },
       )
       .catch(() => undefined);
     if (result?.code === 0) removed.push("keychain");
   }
-  if (await removeFileKey(auth)) removed.push("file");
+  if (await removeFileKey(auth, kind)) removed.push("file");
   return removed;
 }
 
-async function removeFileKey(auth: AuthEnv): Promise<boolean> {
+export function clearGatewayKey(auth: AuthEnv): Promise<string[]> {
+  return clearKey(auth, "gateway");
+}
+
+/** The environment variable that overrides a stored key. */
+export function keyEnvName(kind: KeyKind): string {
+  return KEY_SPECS[kind].env;
+}
+
+async function removeFileKey(auth: AuthEnv, kind: KeyKind): Promise<boolean> {
+  const field = KEY_SPECS[kind].field;
   const path = join(auth.dir, "credentials.json");
   const current = await readJsonObject(path);
-  if (!current || !("aiGateway" in current)) return false;
-  const { aiGateway: _removed, ...rest } = current;
+  if (!current || !(field in current)) return false;
+  const { [field]: _removed, ...rest } = current;
   if (Object.keys(rest).filter((key) => key !== "version").length === 0)
     await rm(path, { force: true });
   else await writePrivateJson(auth.dir, path, rest);
@@ -205,30 +308,53 @@ export function parseConfig(value: unknown): DawgConfig {
   const record = value as Record<string, unknown>;
   const config: {
     provider?: ProviderChoice;
-    xcb?: { account: string; model: string };
+    xcb?: XcbPick;
+    codex?: XcbPick;
+    claude?: XcbPick;
+    gatewayModel?: string;
+    openrouterModel?: string;
+    setup?: "skipped";
   } = {};
   if (PROVIDER_CHOICES.includes(record.provider as ProviderChoice))
     config.provider = record.provider as ProviderChoice;
-  const xcb = record.xcb;
-  if (typeof xcb === "object" && xcb !== null && !Array.isArray(xcb)) {
-    const { account, model } = xcb as Record<string, unknown>;
-    if (
-      typeof account === "string" &&
-      XCB_ACCOUNT_PATTERN.test(account) &&
-      typeof model === "string" &&
-      XCB_MODEL_PATTERN.test(model)
-    )
-      config.xcb = { account, model };
+  for (const slot of SUBSCRIPTION_SLOTS) {
+    const pick = parsePick(record[slot]);
+    if (pick) config[slot] = pick;
   }
+  for (const field of ["gatewayModel", "openrouterModel"] as const) {
+    const id = record[field];
+    if (typeof id === "string" && PROVIDER_MODEL_ID_PATTERN.test(id))
+      config[field] = id;
+  }
+  if (record.setup === "skipped") config.setup = "skipped";
   return config;
 }
 
+function parsePick(value: unknown): XcbPick | undefined {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return undefined;
+  const { account, model } = value as Record<string, unknown>;
+  return typeof account === "string" &&
+    XCB_ACCOUNT_PATTERN.test(account) &&
+    typeof model === "string" &&
+    XCB_MODEL_PATTERN.test(model)
+    ? { account, model }
+    : undefined;
+}
+
+export type ConfigPatch = Partial<{
+  provider: ProviderChoice | undefined;
+  xcb: XcbPick | undefined;
+  codex: XcbPick | undefined;
+  claude: XcbPick | undefined;
+  gatewayModel: string | undefined;
+  openrouterModel: string | undefined;
+  setup: "skipped" | undefined;
+}>;
+
 export async function writeConfig(
   auth: Pick<AuthEnv, "dir">,
-  patch: Partial<{
-    provider: ProviderChoice | undefined;
-    xcb: DawgConfig["xcb"] | undefined;
-  }>,
+  patch: ConfigPatch,
 ): Promise<DawgConfig> {
   const next: Record<string, unknown> = { ...(await readConfig(auth)) };
   for (const [key, value] of Object.entries(patch)) {