@illuminis/comprism 0.1.0

package/out/commands/keys.js

@@ -0,0 +1,344 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyState = keyState;
+exports.hasAnyKey = hasAnyKey;
+exports.cmdKeys = cmdKeys;
+/**
+ * `comprism keys` — the provider keys, and the one thing the product cannot
+ * work without.
+ *
+ * ── Why a key is not optional ─────────────────────────────────────────────
+ *
+ * Every answer is billed to the CUSTOMER'S OWN provider account. That is the
+ * whole basis of the product's claim: a saving on somebody else's bill is a
+ * marketing number, and a saving on your own bill is an invoice you can check.
+ *
+ * So with no key there is nothing to run and nothing to measure. A person in
+ * that state is not "partly set up", they are stopped, and the product says so
+ * and takes them straight here rather than letting them discover it one
+ * refused prompt at a time.
+ *
+ * ── Two ways in, because people keep their secrets differently ────────────
+ *
+ * PASTE ONE. Pick a vendor, paste the key. It goes once, over TLS, to the
+ * workspace, is checked with the vendor before it is kept, and is never
+ * written to this machine.
+ *
+ * POINT AT A FILE. Many developers already keep their keys in an environment
+ * file. Naming that file is faster than pasting four keys, and the file never
+ * leaves the machine: it is read here and the values are sent the same way.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const prompt_1 = require("../lib/prompt");
+const gateway_1 = require("../lib/gateway");
+const ui = __importStar(require("../lib/ui"));
+const out = (s = '') => process.stdout.write(s + '\n');
+/**
+ * The vendors, and the environment variable each one is conventionally kept in.
+ *
+ * Named here rather than fetched, because these are OUR OWN vendor names and
+ * the standard variable names their own documentation uses. Neither is model
+ * logic and neither changes when a price does.
+ */
+const PROVIDERS = [
+    { key: 'anthropic', label: 'Anthropic', env: 'ANTHROPIC_API_KEY' },
+    { key: 'openai', label: 'OpenAI', env: 'OPENAI_API_KEY' },
+    { key: 'google', label: 'Google', env: 'GOOGLE_GEMINI_API_KEY' },
+    { key: 'xai', label: 'xAI', env: 'GROK_API_KEY' },
+];
+/**
+ * What the workspace says it can reach.
+ *
+ * **The workspace is the only source of truth.** This function does not look at
+ * the machine, and no caller may treat a key found on the machine as an answer
+ * to this question. A key sitting in somebody's shell is not a key the account
+ * holds: it works for that one shell, it is invisible to the portal, to the
+ * editor and to their colleagues, and a product that counts it tells four
+ * different people four different things about the same account.
+ *
+ * The machine is still SEARCHED, but only in `offerLocalImport` below, and only
+ * once this has answered `{ reached: true, hasKey: false }`. That is the owner's
+ * rule of 17 September 2026: look on the computer when the account has nothing,
+ * and when something is found, store it on the server through the one service.
+ */
+async function keyState() {
+    const reply = await (0, gateway_1.ask)({ intent: 'catalog', prompt: '' });
+    // `ok` is false when we never heard from the workspace. Every other field is
+    // then this client's placeholder, and reading an empty `providers` as "no
+    // keys" is precisely the fault above.
+    if (!reply.ok)
+        return { reached: false, why: reply.message || 'the workspace could not be reached' };
+    // An older workspace that does not serve this question has also not told us
+    // there are no keys. It has told us it cannot answer.
+    if (reply.served === false)
+        return { reached: false, why: reply.message || 'this workspace is running an older build' };
+    // The workspace answered but could not establish part of what it answered.
+    // An empty vendor list here is a list we failed to obtain, not a list of
+    // nothing, and drawing it as "you have no keys" is the original fault with
+    // one more layer in front of it.
+    if (reply.complete === false)
+        return { reached: false, why: reply.message || 'your workspace could not check its vendor keys' };
+    return { reached: true, hasKey: reply.providers.some((p) => p.has_key) };
+}
+/**
+ * Kept for callers that genuinely only need a yes.
+ *
+ * Unreachable counts as NO here, and every caller must have already reported
+ * the unreachable case in its own words before calling this. Prefer `keyState`.
+ */
+async function hasAnyKey() {
+    const state = await keyState();
+    return state.reached && state.hasKey;
+}
+/** Read `NAME=value` pairs out of an environment file. Comments ignored. */
+function readEnvFile(file) {
+    const found = {};
+    for (const line of node_fs_1.default.readFileSync(file, 'utf8').split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eq = trimmed.indexOf('=');
+        if (eq < 1)
+            continue;
+        const name = trimmed.slice(0, eq).replace(/^export\s+/, '').trim();
+        // Surrounding quotes are a shell convention, not part of the value.
+        const value = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, '');
+        if (name && value)
+            found[name] = value;
+    }
+    return found;
+}
+async function store(provider, label, value) {
+    const live = new ui.LiveIndicator();
+    live.start(`checking the key with ${label}`);
+    const reply = await (0, gateway_1.ask)({ intent: 'store_key', prompt: '', provider, key: value });
+    live.stop();
+    process.stdout.write('\r');
+    if (reply.stored) {
+        out(ui.ok(`${label} key stored and confirmed working.`));
+        return true;
+    }
+    out(ui.fail(`${label}: ${reply.message || 'the key was not accepted'}`));
+    return false;
+}
+/** Show which vendors this workspace can already reach. */
+/**
+ * How a vendor's name is written, as the vendor writes it.
+ *
+ * The workspace returns a machine name and title-cases it, which turns `openai`
+ * into "Openai" and `xai` into "Xai". Neither company spells itself that way,
+ * and a product that misspells its suppliers' names on the first screen a
+ * developer sees looks like it was assembled rather than built.
+ */
+function vendorLabel(providerKey, fallback) {
+    const known = PROVIDERS.find((p) => p.key === providerKey.toLowerCase());
+    return known ? known.label : fallback;
+}
+/**
+ * The vendor list, and whether the account holds a key for each.
+ *
+ * Returns how many are stored, so the caller can tell "all set" from "nothing
+ * set" without asking the workspace a second time.
+ */
+async function show() {
+    const reply = await (0, gateway_1.ask)({ intent: 'catalog', prompt: '' });
+    if (!reply.ok || reply.served === false || reply.complete === false) {
+        // NOT "you have no keys". We did not get an answer, so nothing is known
+        // about this account, and saying otherwise is the 17 September fault.
+        out(ui.fail('Your workspace could not be reached, so nothing is known about your keys.'));
+        out(`      ${ui.c.dim(reply.message || reply.decision.rationale || 'no answer from the workspace')}`);
+        out();
+        return { reached: false, stored: 0, total: 0 };
+    }
+    if (reply.providers.length === 0) {
+        // A workspace with no vendors at all is not a workspace that told us it
+        // holds no keys. Treated as unreachable so no caller offers to take one.
+        out(ui.fail('Your workspace returned no vendors, so nothing is known about your keys.'));
+        out(`      ${ui.c.dim(reply.message || 'the vendor list came back empty')}`);
+        out();
+        return { reached: false, stored: 0, total: 0 };
+    }
+    for (const p of reply.providers) {
+        out(`  ${p.has_key ? ui.c.green('stored ') : ui.c.dim('none   ')} ${vendorLabel(p.provider, p.label)}`);
+    }
+    out();
+    return {
+        reached: true,
+        stored: reply.providers.filter((p) => p.has_key).length,
+        total: reply.providers.length,
+    };
+}
+async function cmdKeys(args) {
+    out(ui.banner('Provider keys'));
+    out();
+    out(ui.c.dim('  Every answer is billed to your own provider account, so your saving'));
+    out(ui.c.dim('  is a figure on your own invoice rather than a claim of ours.'));
+    out();
+    const state = await show();
+    // Point at a file, either named on the line or asked for. Always honored
+    // when it was ASKED FOR: somebody replacing a key that has been rotated is
+    // doing something perfectly reasonable, and this is the only path that adds
+    // one, so refusing it because keys already exist would be refusing the job.
+    const fileFlag = args.indexOf('--file');
+    if (fileFlag >= 0 || args.includes('--from-file')) {
+        const named = fileFlag >= 0 ? args[fileFlag + 1] : undefined;
+        return fromFile(named);
+    }
+    // Nothing was reachable. Offering to take a key here is the exact fault
+    // reported on 17 September: a person with four working keys was asked to
+    // paste one because the product could not ask the account and drew the
+    // silence as an absence.
+    if (!state.reached) {
+        out(`  ${ui.c.dim('check the address with')} ${ui.c.bold('comprism status')}${ui.c.dim(', or sign in again with')} ${ui.c.bold('comprism login')}`);
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // Every vendor already has a key. There is nothing to do, so the command
+    // says so and stops rather than walking somebody through a form to replace
+    // something that is working. Rule set by the owner, 17 September 2026: look
+    // on the computer only when the ACCOUNT has none.
+    if (state.total > 0 && state.stored === state.total) {
+        out(`  ${ui.c.green('Every vendor has a key stored on your account.')}`);
+        out(`  ${ui.c.dim('to replace one, run')} ${ui.c.bold('comprism keys --file <path>')}${ui.c.dim(', or add it in the portal')}`);
+        out();
+        return;
+    }
+    out(`  ${ui.c.dim('1')}. paste a key for one vendor`);
+    out(`  ${ui.c.dim('2')}. point at a file that already holds your keys`);
+    out();
+    const how = await (0, prompt_1.ask)('  1 or 2: ');
+    if (how === '2') {
+        (0, prompt_1.closePrompt)();
+        return fromFile(undefined);
+    }
+    PROVIDERS.forEach((p, i) => out(`  ${String(i + 1).padStart(2)}. ${p.label}`));
+    out();
+    const pick = await (0, prompt_1.ask)('  vendor: ');
+    const chosen = PROVIDERS[Number(pick) - 1]
+        || PROVIDERS.find((p) => p.key === pick.toLowerCase()
+            || p.label.toLowerCase() === pick.toLowerCase());
+    if (!chosen) {
+        (0, prompt_1.closePrompt)();
+        out(ui.fail(`"${pick}" is not one of the vendors above.`));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // Hidden, like a password. A key pasted in the clear sits in the scrollback
+    // of a terminal somebody else may be looking at.
+    const value = await (0, prompt_1.askHidden)(`  ${chosen.label} key: `);
+    (0, prompt_1.closePrompt)();
+    if (!value) {
+        out(ui.fail('Nothing was pasted.'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    out();
+    const ok = await store(chosen.key, chosen.label, value);
+    out();
+    if (!ok)
+        process.exitCode = 1;
+}
+async function fromFile(named) {
+    let file = named;
+    if (!file) {
+        // The two places almost everybody keeps them, offered rather than guessed.
+        const guesses = ['.env', node_path_1.default.join(process.env.HOME || '', '.env')]
+            .filter((f) => node_fs_1.default.existsSync(f));
+        if (guesses.length) {
+            out(ui.c.dim(`  found: ${guesses.join('  ')}`));
+        }
+        file = await (0, prompt_1.ask)('  file holding your keys: ');
+        (0, prompt_1.closePrompt)();
+    }
+    if (!file) {
+        out(ui.fail('No file named.'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    const resolved = node_path_1.default.resolve(file.replace(/^~/, process.env.HOME || '~'));
+    if (!node_fs_1.default.existsSync(resolved)) {
+        out(ui.fail(`There is no file at ${resolved}.`));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    const values = readEnvFile(resolved);
+    const matched = PROVIDERS.filter((p) => values[p.env]);
+    if (matched.length === 0) {
+        out(ui.fail('That file holds no key this product recognizes.'));
+        out(`      ${ui.c.dim(`looked for: ${PROVIDERS.map((p) => p.env).join(', ')}`)}`);
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    out();
+    out(ui.info(`${matched.length} key(s) found. Checking each one with its vendor.`));
+    out();
+    let kept = 0;
+    for (const p of matched) {
+        if (await store(p.key, p.label, values[p.env]))
+            kept += 1;
+    }
+    // NOTHING is remembered about where the file was.
+    //
+    // This used to write a shell command into the machine's own settings so a
+    // later run could re-read the key from that file. It was well meant and it
+    // was wrong: it taught the machine to go and fetch a vendor credential
+    // locally, which is the one behavior the owner ruled out on 17 September
+    // 2026. It also left a working instruction for reading a secret sitting in a
+    // settings file, worth nothing to us and something to anybody who gets the
+    // laptop.
+    //
+    // The keys are on the account now. That is the whole point of having sent
+    // them, and re-reading the file would be asking a question we already know
+    // the answer to.
+    out();
+    out(kept > 0
+        ? ui.ok(`${kept} of ${matched.length} key(s) stored.`)
+        : ui.fail('No key in that file was accepted.'));
+    out(`      ${ui.c.dim(`the file itself never left this machine; only the values did, once, over TLS`)}`);
+    out();
+    if (kept === 0)
+        process.exitCode = 1;
+}

package/out/commands/login.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Turn what a person typed into the address of their workspace.
+ *
+ * Accepts the workspace name, which is the normal case, and also a full URL or
+ * a bare host, because somebody who was given a link will paste the link. All
+ * three arrive at the same place rather than at an error message.
+ */
+export declare function workspaceUrl(typed: string): string;
+export declare function cmdLogin(args: string[]): Promise<void>;