@kvell007/embed-labs-cli 0.1.0-alpha.12 → 0.1.0-alpha.14

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { constants } from "node:fs";
 import { spawn } from "node:child_process";
-import { access, cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { access, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
@@ -1351,17 +1351,29 @@ function isApiResponse(value) {
     return isJsonObject(error) && typeof error.code === "string" && typeof error.message === "string";
 }
 async function bridgeGet(path) {
-    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`);
+    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
+        headers: bridgeHeaders()
+    });
     return await response.json();
 }
 async function bridgePost(path, body) {
     const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
         method: "POST",
-        headers: { "content-type": "application/json" },
+        headers: bridgeHeaders({ "content-type": "application/json" }),
         body: JSON.stringify(body)
     });
     return await response.json();
 }
+function bridgeHeaders(base = {}) {
+    const token = process.env.EMBED_BRIDGE_TOKEN?.trim();
+    if (!token) {
+        return base;
+    }
+    return {
+        ...base,
+        authorization: `Bearer ${token}`
+    };
+}
 async function cloudGet(path) {
     return await cloudRequest("GET", path);
 }
@@ -1374,6 +1386,7 @@ async function cloudDownloadArtifact(artifactId, outputPath) {
         const token = await cloudAuthToken();
         if (token) {
             headers.authorization = `Bearer ${token}`;
+            addCloudRequestSignature(headers, "GET", `/v1/artifacts/${encodeURIComponent(artifactId)}/download`, "", token);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}/v1/artifacts/${encodeURIComponent(artifactId)}/download`, {
             headers: Object.keys(headers).length > 0 ? headers : undefined
@@ -1409,17 +1422,19 @@ async function cloudDownloadArtifact(artifactId, outputPath) {
 async function cloudRequest(method, path, body) {
     try {
         const headers = {};
-        if (body !== undefined) {
+        const bodyText = body === undefined ? "" : JSON.stringify(body);
+        if (bodyText) {
             headers["content-type"] = "application/json";
         }
         const token = await cloudAuthToken();
         if (token) {
             headers.authorization = `Bearer ${token}`;
+            addCloudRequestSignature(headers, method, path, bodyText, token);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}${path}`, {
             method,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
-            body: body === undefined ? undefined : JSON.stringify(body)
+            body: body === undefined ? undefined : bodyText
         });
         return await response.json();
     }
@@ -1429,6 +1444,39 @@ async function cloudRequest(method, path, body) {
         });
     }
 }
+function addCloudRequestSignature(headers, method, pathWithQuery, bodyText, token) {
+    if (process.env.EMBED_CLOUD_API_SIGNING === "0") {
+        return;
+    }
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const nonce = randomBytes(16).toString("hex");
+    const bodySha256 = createHash("sha256").update(bodyText).digest("hex");
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const canonical = cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256);
+    headers["x-embed-key-id"] = keyId;
+    headers["x-embed-timestamp"] = timestamp;
+    headers["x-embed-nonce"] = nonce;
+    headers["x-embed-body-sha256"] = bodySha256;
+    headers["x-embed-signature"] = createHmac("sha256", token).update(canonical).digest("hex");
+}
+function cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256) {
+    return [
+        method.toUpperCase(),
+        normalizeCloudPathForSignature(pathWithQuery),
+        timestamp,
+        nonce,
+        bodySha256
+    ].join("\n");
+}
+function normalizeCloudPathForSignature(pathWithQuery) {
+    try {
+        const parsed = new URL(pathWithQuery, "http://embed.local");
+        return `${parsed.pathname}${parsed.search}`;
+    }
+    catch {
+        return pathWithQuery.startsWith("/") ? pathWithQuery : `/${pathWithQuery}`;
+    }
+}
 async function pluginList(parsed) {
     const releaseDir = stringFlag(parsed, "release-dir");
     const manifest = releaseDir ? await readPluginReleaseManifest(releaseDir) : undefined;
@@ -1535,6 +1583,7 @@ async function installCodexPlugin(parsed, context) {
     }
     const targetRoot = codexPluginTargetRoot(parsed, context.installingAll);
     const targetPath = join(targetRoot, "embed-labs");
+    const legacyCleanup = await cleanupLegacyCodexPluginRemnants(targetRoot);
     if (await pathExists(targetPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `Codex plugin already exists at ${targetPath}.`, {
             remediation: "Pass --force to replace it, or pass --codex-target/--target to install into a different directory."
@@ -1552,8 +1601,10 @@ async function installCodexPlugin(parsed, context) {
         command_hint: mcpRegistration.registered
             ? "Codex MCP was registered. Start a new Codex session to reload tools."
             : mcpRegistration.hint,
+        warning: legacyCodexCleanupWarning(legacyCleanup),
         mcp_registered: mcpRegistration.registered,
-        mcp_warning: mcpRegistration.warning
+        mcp_warning: mcpRegistration.warning,
+        cleanup: legacyCleanup
     });
 }
 async function installOpenCodePlugin(parsed, context) {
@@ -1562,8 +1613,10 @@ async function installOpenCodePlugin(parsed, context) {
         return source;
     }
     const targetRoot = openCodePluginTargetRoot(parsed, context.installingAll);
-    const wrapperPath = join(targetRoot, "plugins", "development-board-toolchain.js");
-    if (await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
+    const globalInstall = isGlobalOpenCodeRoot(targetRoot);
+    const wrapperPath = join(targetRoot, "plugins", "embed-labs.js");
+    const legacyCleanup = await cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall);
+    if (!globalInstall && await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `OpenCode plugin wrapper already exists at ${wrapperPath}.`, {
             remediation: "Pass --force to replace it, or pass --opencode-target/--target to install into a different directory."
         });
@@ -1589,15 +1642,25 @@ async function installOpenCodePlugin(parsed, context) {
         });
     }
     await ensureOpenCodeInstallPackageJson(targetRoot);
-    await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    if (globalInstall) {
+        await rm(wrapperPath, { force: true });
+        legacyCleanup.legacy_removed_config_entries?.push(...await ensureOpenCodeGlobalPluginConfig());
+    }
+    else {
+        await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    }
     const duplicateWarning = await openCodeDuplicatePluginWarning(targetRoot);
+    const cleanupWarning = legacyOpenCodeCleanupWarning(legacyCleanup);
     return ok({
         id: "opencode",
         target_path: targetRoot,
         source: source.data.sourceLabel,
         version: source.data.version,
-        command_hint: "Start OpenCode from the project containing this .opencode directory.",
-        warning: duplicateWarning
+        command_hint: globalInstall
+            ? "Restart OpenCode so the global embed-labs package plugin is reloaded."
+            : "Start OpenCode from the project containing this .opencode directory.",
+        warning: combineWarnings(cleanupWarning, duplicateWarning),
+        cleanup: legacyCleanup
     });
 }
 async function resolveCodexPluginSource(context) {
@@ -1811,7 +1874,251 @@ function openCodePluginTargetRoot(parsed, installingAll) {
     return resolve(target ?? defaultOpenCodeRoot());
 }
 function defaultCodexPluginRoot() {
-    return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "plugins");
+    return join(defaultCodexHome(), "plugins");
+}
+function defaultCodexHome() {
+    return resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
+}
+function codexConfigPath() {
+    return join(defaultCodexHome(), "config.toml");
+}
+async function cleanupLegacyCodexPluginRemnants(targetRoot) {
+    const removedPaths = [];
+    const removedConfigTables = [];
+    const warnings = [];
+    const stoppedProcesses = await stopLegacyCodexPluginProcesses(warnings);
+    const legacyPaths = [
+        join(targetRoot, "dbt-agent"),
+        join(targetRoot, "development-board-toolchain"),
+        join(targetRoot, "cache", "embed-labs", "dbt-agent"),
+        join(targetRoot, "cache", "dbt-agent"),
+        join(targetRoot, "cache", "plugins", "dbt-agent")
+    ];
+    legacyPaths.push(...await discoverLegacyCodexCachePaths(targetRoot));
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        legacyPaths.push(join(defaultCodexHome(), ".tmp", "plugins"), join(defaultCodexHome(), ".tmp", "plugins.sha"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-live-board-ops"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-platform-plugin-maintenance"));
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        const configPath = codexConfigPath();
+        try {
+            if (await pathExists(configPath)) {
+                const current = await readFile(configPath, "utf8");
+                const updated = removeLegacyCodexConfigTables(current);
+                if (updated.text !== current) {
+                    await writeFile(configPath, updated.text, "utf8");
+                }
+                removedConfigTables.push(...updated.removedTables);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not update ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const removedHistoryEntries = await cleanupLegacyCodexTextState(warnings);
+    return {
+        legacy_removed_paths: Array.from(new Set(removedPaths)),
+        legacy_removed_config_tables: removedConfigTables,
+        legacy_removed_history_entries: removedHistoryEntries,
+        legacy_stopped_processes: stoppedProcesses,
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+async function stopLegacyCodexPluginProcesses(warnings) {
+    if (process.platform === "win32")
+        return 0;
+    try {
+        const ps = await runLocalProcess("ps", ["-axo", "pid=,command="]);
+        if (ps.code !== 0)
+            return 0;
+        let stopped = 0;
+        for (const line of ps.stdout.split("\n")) {
+            const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+            if (!match)
+                continue;
+            const pid = Number(match[1]);
+            const command = match[2] || "";
+            if (!isLegacyCodexPluginProcess(command))
+                continue;
+            try {
+                process.kill(pid, "SIGTERM");
+                stopped += 1;
+            }
+            catch (error) {
+                warnings.push(`Could not stop legacy Codex plugin process ${pid}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return stopped;
+    }
+    catch (error) {
+        warnings.push(`Could not scan legacy Codex plugin processes: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexPluginProcess(command) {
+    const trimmed = command.trim();
+    return /^\/.*\/dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed)
+        || /^dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed);
+}
+async function discoverLegacyCodexCachePaths(targetRoot) {
+    const paths = [];
+    const cacheRoot = join(targetRoot, "cache");
+    try {
+        const marketplaces = await readdir(cacheRoot, { withFileTypes: true });
+        for (const entry of marketplaces) {
+            if (!entry.isDirectory())
+                continue;
+            paths.push(join(cacheRoot, entry.name, "dbt-agent"));
+            paths.push(join(cacheRoot, entry.name, "development-board-toolchain"));
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+async function cleanupLegacyCodexTextState(warnings) {
+    let removed = 0;
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "history.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "session_index.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "rules", "default.rules"), warnings);
+    return removed;
+}
+async function cleanupLegacyCodexTextFile(filePath, warnings) {
+    try {
+        if (!await pathExists(filePath))
+            return 0;
+        const current = await readFile(filePath, "utf8");
+        const lines = current.split("\n");
+        let removed = 0;
+        const kept = lines.filter((line) => {
+            if (!line)
+                return true;
+            if (isLegacyCodexHistoryMention(line)) {
+                removed += 1;
+                return false;
+            }
+            return true;
+        });
+        if (removed > 0) {
+            await writeFile(filePath, kept.join("\n"), "utf8");
+        }
+        return removed;
+    }
+    catch (error) {
+        warnings.push(`Could not clean Codex legacy text state ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexHistoryMention(line) {
+    return line.includes("plugin://dbt-agent@plugins")
+        || line.includes("plugin://dbt-agent@embed-labs")
+        || /dbt-agent/i.test(line);
+}
+function removeLegacyCodexConfigTables(text) {
+    const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    const output = [];
+    const removedTables = [];
+    let skipping = false;
+    for (const line of lines) {
+        const table = parseTomlTableHeader(line);
+        if (table) {
+            skipping = isLegacyCodexConfigTable(table);
+            if (skipping) {
+                removedTables.push(table);
+                continue;
+            }
+        }
+        if (!skipping) {
+            output.push(line);
+        }
+    }
+    return { text: output.join("").replace(/\n{3,}/g, "\n\n"), removedTables };
+}
+function parseTomlTableHeader(line) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line);
+    return match?.[1]?.trim();
+}
+function isLegacyCodexConfigTable(table) {
+    return /^plugins\."dbt-agent@[^"]+"$/.test(table)
+        || table === "mcp_servers.dbt-agent"
+        || table.startsWith("mcp_servers.dbt-agent.")
+        || table === 'mcp_servers."dbt-agent"'
+        || table.startsWith('mcp_servers."dbt-agent".');
+}
+function legacyCodexCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} legacy Codex plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_tables?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_tables.length} legacy Codex config table(s)`);
+    }
+    if (cleanup.legacy_removed_history_entries) {
+        parts.push(`removed ${cleanup.legacy_removed_history_entries} legacy Codex text-state mention(s)`);
+    }
+    if (cleanup.legacy_stopped_processes) {
+        parts.push(`stopped ${cleanup.legacy_stopped_processes} legacy Codex plugin process(es)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Legacy dbt-agent cleanup: ${parts.join(", ")}.` : undefined;
+}
+async function cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall) {
+    const removedPaths = [];
+    const warnings = [];
+    const legacyPaths = [
+        join(targetRoot, "plugins", "development-board-toolchain.js"),
+        join(targetRoot, "plugins", "dbt-agent.js"),
+        join(targetRoot, "node_modules", "dbt-agent")
+    ];
+    if (globalInstall) {
+        legacyPaths.push(join(targetRoot, "plugins", "embed-labs.js"));
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        legacy_removed_paths: removedPaths,
+        legacy_removed_config_entries: [],
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+function legacyOpenCodeCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} legacy OpenCode plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_entries?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_entries.length} legacy OpenCode config entry(s)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Legacy OpenCode cleanup: ${parts.join(", ")}.` : undefined;
+}
+function combineWarnings(...warnings) {
+    const actual = warnings.filter((warning) => Boolean(warning));
+    return actual.length > 0 ? actual.join(" ") : undefined;
 }
 async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
     const explicitTarget = Boolean(stringFlag(parsed, "target") || stringFlag(parsed, "codex-target"));
@@ -1984,10 +2291,54 @@ async function resolveExecutableOnPath(name) {
     return undefined;
 }
 function defaultOpenCodeRoot() {
-    return join(process.cwd(), ".opencode");
+    return globalOpenCodeRoot();
+}
+function globalOpenCodeRoot() {
+    return join(homedir(), ".config", "opencode");
+}
+function isGlobalOpenCodeRoot(targetRoot) {
+    return resolve(targetRoot) === resolve(globalOpenCodeRoot());
+}
+async function ensureOpenCodeGlobalPluginConfig() {
+    const configPath = join(globalOpenCodeRoot(), "opencode.json");
+    let existing = {};
+    try {
+        const parsed = JSON.parse(await readFile(configPath, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            existing = parsed;
+        }
+    }
+    catch {
+        existing = {};
+    }
+    const configured = Array.isArray(existing.plugin)
+        ? existing.plugin.filter((item) => typeof item === "string")
+        : Array.isArray(existing.plugins)
+            ? existing.plugins.filter((item) => typeof item === "string")
+            : [];
+    const removed = configured.filter(isLegacyOpenCodePluginConfigEntry);
+    const cleaned = configured.filter((item) => !isLegacyOpenCodePluginConfigEntry(item));
+    if (!cleaned.includes("embed-labs")) {
+        cleaned.push("embed-labs");
+    }
+    await writeFile(configPath, `${JSON.stringify({
+        ...existing,
+        plugin: cleaned,
+        plugins: undefined
+    }, null, 2)}\n`, "utf8");
+    return removed;
+}
+function isLegacyOpenCodePluginConfigEntry(item) {
+    const normalized = item.replace(/\\/g, "/");
+    return item === "dbt-agent"
+        || item === "development-board-toolchain"
+        || normalized === "./plugins/development-board-toolchain"
+        || normalized === "./plugins/development-board-toolchain.js"
+        || normalized.endsWith("/plugins/development-board-toolchain.js")
+        || normalized.includes("development-board-toolchain");
 }
 async function openCodeDuplicatePluginWarning(targetRoot) {
-    const globalRoot = join(homedir(), ".config", "opencode");
+    const globalRoot = globalOpenCodeRoot();
     if (resolve(targetRoot) === resolve(globalRoot))
         return undefined;
     const configPath = join(globalRoot, "opencode.json");