@manyoars/oars 0.2.0 → 0.4.0

package/dist/gate/transcripts.js

@@ -0,0 +1,232 @@
+// Where a replay reads: the raw transcripts of the allowed folders, the harness's copy first and then what only the archive still holds. Reads only.
+import { join } from 'node:path';
+import { INJECTED_TAGS, isErrorResult, isObj, LEADING_TAG, resultText } from '../sessions/extract.js';
+import { SOURCES } from '../sessions/sources.js';
+import { listDir, logLines, sessionFolders, subagentFiles } from '../sessions/store.js';
+import { checkCall } from './checks.js';
+import { permissionOf } from './record.js';
+const projectTranscripts = async (folder, project, seen) => {
+    const found = [];
+    const add = (file, relative) => {
+        if (seen.has(`${project}/${relative}`))
+            return;
+        seen.add(`${project}/${relative}`);
+        found.push(file);
+    };
+    for (const entry of await listDir(folder)) {
+        if (entry.isFile() && entry.name.endsWith('.jsonl'))
+            add({ file: join(folder, entry.name), project, session: entry.name.slice(0, -'.jsonl'.length), agent: null }, entry.name);
+    }
+    for (const { dir, path, parent, name } of await subagentFiles(folder, await sessionFolders(folder))) {
+        add({ file: join(dir, name), project, session: parent, agent: name.slice(0, -'.jsonl'.length) }, [parent, 'subagents', ...path, name].join('/'));
+    }
+    return found;
+};
+/** One copy per project and relative path. `raw/` hard-links the same file, and the harness's copy, when it still has one, is at least as long. */
+export const discover = async (roots, allow) => {
+    const seen = new Set();
+    const files = [];
+    let unreadable = 0;
+    for (const root of roots) {
+        // Replay reads only the harness's transcript format: a source-table folder (Cursor, Codex, Copilot, Gemini CLI, Grok Build, OpenCode, Pi, VS Code Copilot Chat) is not that format, and a project folder is never named for one.
+        const projects = (await listDir(root)).filter((entry) => entry.isDirectory() && !SOURCES.some((source) => source.name === entry.name) && allow.allows(entry.name));
+        for (const project of projects) {
+            try {
+                files.push(...(await projectTranscripts(join(root, project.name), project.name, seen)));
+            }
+            catch {
+                unreadable += 1;
+            }
+        }
+    }
+    return { files, unreadable };
+};
+/** What a call that named nothing leaves in `CallsSeen`: shared, since nothing is ever added to it. */
+const NO_ENTRY = { found: [], removals: [] };
+const stringOf = (value) => (typeof value === 'string' && value !== '' ? value : null);
+const blocksOf = (line) => {
+    const content = isObj(line.message) ? line.message.content : undefined;
+    return Array.isArray(content) ? content.filter(isObj) : [];
+};
+const REFUSED = /^The user doesn't want to (?:proceed|take)/;
+/** What a failed result says when the thing named does not exist. Read here and never kept: the record holds only the closed value. */
+const NOT_FOUND = [
+    /\bE404\b|404 Not Found|is not in this registry|could not determine executable/i,
+    /No matching distribution|Could not find a version|404 Client Error|Package .{0,200} not found/i,
+    // The harness says "No such tool available". A server's own "unknown tool" names one of its actions (a batch step), so the server exists.
+    /No such tool available|server .{0,200} not (?:found|connected)/i,
+    /Unknown skill|skill .{0,200} not found/i,
+];
+const statusOf = (block, text) => {
+    if (!isErrorResult(block, text))
+        return 'ok';
+    return REFUSED.test(text) ? 'refused' : 'error';
+};
+const settle = (entry, block) => {
+    if (entry.found.every((one) => one.status !== 'none') && entry.removals.every((one) => one.status !== 'none'))
+        return;
+    const text = resultText(block);
+    const status = statusOf(block, text);
+    const miss = status === 'error' && NOT_FOUND.some((pattern) => pattern.test(text)) ? 'not-found' : 'none';
+    for (const found of entry.found) {
+        found.status = status;
+        found.miss = miss;
+    }
+    for (const removal of entry.removals)
+        removal.status = status;
+};
+const parseLine = (raw) => {
+    if (raw === '')
+        return { line: null, bad: false };
+    try {
+        const parsed = JSON.parse(raw);
+        return { line: isObj(parsed) && parsed.type !== 'api-request-blob' ? parsed : null, bad: false };
+    }
+    catch {
+        return { line: null, bad: true };
+    }
+};
+/** The first pass: every call and its answer. Text is read only to settle a status; nothing of it leaves this function. */
+export const readCalls = async (file, agent, redact, seen) => {
+    const read = { found: [], removals: [], unread: [], pipes: [], calls: 0, fresh: 0, badLines: 0 };
+    let position = -1;
+    let permission = 'unknown';
+    const readUse = (line, block) => {
+        read.calls += 1;
+        const id = stringOf(block.id);
+        if (id !== null && seen.has(id))
+            return;
+        read.fresh += 1;
+        const check = checkCall({ tool: stringOf(block.name) ?? '', input: block.input }, redact);
+        if (check.crossings.length === 0 && check.unread.length === 0 && check.removals.length === 0) {
+            // Seen all the same, so a transcript that replays this call does not count it twice.
+            if (id !== null)
+                seen.set(id, NO_ENTRY);
+            return;
+        }
+        const ts = stringOf(line.timestamp);
+        const side = agent !== null || line.isSidechain === true;
+        const found = check.crossings.map((crossing) => ({ crossing, ts, cwd: stringOf(line.cwd), toolUseId: id, permission, call: read.calls, line: position, side, status: 'none', miss: 'none' }));
+        const removals = check.removals.map((removal) => ({ removal, ts, status: 'none' }));
+        read.found.push(...found);
+        read.removals.push(...removals);
+        read.unread.push(...check.unread);
+        if (check.unread.includes('pipe-to-shell'))
+            read.pipes.push(read.calls);
+        if (id !== null)
+            seen.set(id, { found, removals });
+    };
+    for await (const raw of logLines(file)) {
+        position += 1;
+        const { line, bad } = parseLine(raw);
+        if (bad)
+            read.badLines += 1;
+        if (line === null)
+            continue;
+        const mode = stringOf(line.permissionMode);
+        if (mode !== null)
+            permission = permissionOf(mode);
+        for (const block of blocksOf(line)) {
+            if (block.type === 'tool_use')
+                readUse(line, block);
+            else if (block.type === 'tool_result') {
+                const entry = seen.get(stringOf(block.tool_use_id) ?? '');
+                if (entry !== undefined)
+                    settle(entry, block);
+            }
+        }
+    }
+    return read;
+};
+const REPO_TOOLS = new Set(['Read', 'NotebookRead', 'Grep', 'Glob', 'LS']);
+const WEB_TOOLS = new Set(['WebFetch', 'WebSearch']);
+const resultSource = (tool) => {
+    if (tool === undefined)
+        return 'tool-output';
+    if (REPO_TOOLS.has(tool))
+        return 'repo-file';
+    if (WEB_TOOLS.has(tool))
+        return 'web';
+    return tool === 'Skill' ? 'skill' : 'tool-output';
+};
+/** A meta line is a skill's or a command's body. A leading tag the harness injects is the harness speaking, not the operator. */
+const textSource = (line, text) => {
+    if (line.isMeta === true)
+        return 'skill';
+    const tag = LEADING_TAG.exec(text)?.[1];
+    return tag !== undefined && INJECTED_TAGS.has(tag) ? 'harness' : 'prompt';
+};
+const sourcedTexts = (line, tools) => {
+    if (line.type === 'attachment')
+        return isObj(line.attachment) ? [['harness', JSON.stringify(line.attachment)]] : [];
+    if (line.type === 'assistant') {
+        for (const block of blocksOf(line)) {
+            const id = stringOf(block.id);
+            const name = stringOf(block.name);
+            if (block.type === 'tool_use' && id !== null && name !== null)
+                tools.set(id, name);
+        }
+        return [];
+    }
+    if (line.type !== 'user')
+        return [];
+    const content = isObj(line.message) ? line.message.content : undefined;
+    if (typeof content === 'string')
+        return [[textSource(line, content), content]];
+    return blocksOf(line).flatMap((block) => {
+        if (block.type === 'tool_result')
+            return [[resultSource(tools.get(stringOf(block.tool_use_id) ?? '')), resultText(block)]];
+        const text = block.type === 'text' ? stringOf(block.text) : null;
+        return text === null ? [] : [[textSource(line, text), text]];
+    });
+};
+const canon = (name) => name.toLowerCase().replace(/[-_.]+/g, '-');
+const patternOf = (name) => name
+    .split(/[-_.]+/)
+    .map((part) => part.replace(/[\\^$.*+?()[\]{}|/]/g, '\\$&'))
+    .join('[-_.]+');
+export const readOrigins = async (file, firstLines, servers) => {
+    const origins = new Map();
+    const prompted = new Set();
+    const byCanon = new Map();
+    for (const name of firstLines.keys())
+        byCanon.set(canon(name), [...(byCanon.get(canon(name)) ?? []), name]);
+    const alternatives = [...firstLines.keys()]
+        .sort((one, two) => two.length - one.length)
+        .map(patternOf)
+        .join('|');
+    // Not inside a longer word or a path: `lib` is neither `lib-extra` nor `other/lib`, while `/lib` is how a skill is typed.
+    // An MCP server reaches the agent only as `mcp__<server>__<tool>`, which that rule refuses (`_` joins words), so that spelling is a mention too,
+    // but only of a name that crossed as a server, so a listed server that was never called lends its name to nothing; origins are keyed by name, so a package that also crossed as that server in the same transcript shares its origin. With no server the branch is
+    // left out, since an empty alternation matches everywhere.
+    const serverNames = [...servers]
+        .sort((one, two) => two.length - one.length)
+        .map(patternOf)
+        .join('|');
+    const serverBranch = serverNames === '' ? '' : `|(?<=(?<!\\w)mcp__)(?:${serverNames})(?=__)`;
+    const words = new RegExp(`(?<![\\w@.-])(?<![\\w.-]/)(?:${alternatives})(?![\\w-]|\\.\\w)${serverBranch}`, 'gi');
+    const last = Math.max(...firstLines.values());
+    const tools = new Map();
+    let position = -1;
+    for await (const raw of logLines(file)) {
+        position += 1;
+        if (position >= last)
+            break;
+        const { line } = parseLine(raw);
+        if (line === null)
+            continue;
+        for (const [source, text] of sourcedTexts(line, tools)) {
+            for (const match of text.matchAll(words)) {
+                for (const name of byCanon.get(canon(match[0])) ?? []) {
+                    if (position >= (firstLines.get(name) ?? 0))
+                        continue;
+                    if (!origins.has(name))
+                        origins.set(name, source);
+                    if (source === 'prompt')
+                        prompted.add(name);
+                }
+            }
+        }
+    }
+    return { origins, prompted };
+};

package/dist/hook-bin.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hook-bin.js

@@ -0,0 +1,50 @@
+// The one entry file the installed hooks and the nightly task run: `node hook-bin.js <session-start|pre-tool|post-tool|stop|nightly>`, with the
+// hook event JSON on stdin. It imports only the store modules (not the CLI), so a call costs little more than the node start, and it
+// always exits 0 with no output on any failure: a hook must never fail or block a session.
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { hookEmitter } from './telemetry/hook-emit.js';
+import { sendNightly } from './telemetry/send.js';
+import { HOOK_EVENTS, hookRuntime, nightlyTelemetry, runHook } from './sessions/hooks.js';
+const readStdin = async () => {
+    process.stdin.setEncoding('utf8');
+    let text = '';
+    for await (const chunk of process.stdin)
+        text += String(chunk);
+    return text;
+};
+/** The version in this package's package.json (one folder up from dist/), or `0.0.0` when it cannot be read. */
+const versionOf = () => {
+    try {
+        const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+        const version = typeof manifest === 'object' && manifest !== null ? Reflect.get(manifest, 'version') : undefined;
+        return typeof version === 'string' ? version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+};
+/** After the covenant is accepted, the nightly task sends what the pool outbox holds; with no server, sign-in, or acceptance it sends nothing. Loaded only here so the per-tool hooks never pay for it. It never throws. */
+const nightlyPool = async (event) => {
+    const { nightlyPoolDeps } = await import('./sessions/pool-nightly-deps.js');
+    const { nightlyPoolSend } = await import('./sessions/pool-nightly.js');
+    await nightlyPoolSend(nightlyPoolDeps(process.env, hookRuntime(event, process.env, process.platform, homedir(), { stdin: process.stdin, stdout: process.stdout }), versionOf(), Date.now));
+};
+const eventOf = (name) => HOOK_EVENTS.find((event) => event === name);
+try {
+    const event = eventOf(process.argv[2]);
+    if (event !== undefined) {
+        const output = await runHook(event, event === 'nightly' ? '' : await readStdin(), hookRuntime(event, process.env, process.platform, homedir(), { stdin: process.stdin, stdout: process.stdout }), Date.now, nightlyTelemetry(event, process.env, process.platform, homedir(), versionOf, Date.now), hookEmitter(process.env, process.platform, homedir(), new URL('../package.json', import.meta.url), Date.now));
+        if (output !== undefined)
+            process.stdout.write(output);
+        // The nightly task is where telemetry is sent from; it never throws, and it sends nothing unless telemetry is on and the notice was shown (the server is OARS_POOL_URL, else the Many Oars pool).
+        if (event === 'nightly') {
+            await sendNightly(process.env, process.platform, homedir(), Date.now);
+            await nightlyPool(event);
+        }
+    }
+}
+catch {
+    // Fail-open.
+}
+process.exitCode = 0;

package/dist/issuer.d.ts

@@ -1,10 +1,14 @@
 import type { RunDeps } from './cli.js';
 /**
- * The production Keycloak realm (aor-platform/k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it:
- * the launch flag below only switches it on, so a compromised site cannot send logins anywhere else.
+ * The production Keycloak realm (the platform's k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it,
+ * and is the default for `oars login`: no site or file can send a login anywhere else.
  */
 export declare const PRODUCTION_ISSUER_URL = "https://login.manyoars.com/realms/aor";
-/** The marketing site serves `{"launched": true}` here from launch day. */
-export declare const LAUNCH_FLAG_URL = "https://manyoars.com/.well-known/oars.json";
-/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer once the launch flag is on. */
-export declare const resolveIssuerUrl: (deps: RunDeps, flag?: string) => Promise<string>;
+/**
+ * The built-in issuer is in use only when neither `--issuer-url` nor `OARS_ISSUER_URL` named one. If that issuer does not answer
+ * discovery (no answer, an error status, or a body that is not discovery JSON), the platform is not up yet, so say so (exit 2) and
+ * name the pool. An issuer the developer named keeps its own error.
+ */
+export declare const discoverIssuer: <T>(deps: RunDeps, flag: string | undefined, discover: () => Promise<T>) => Promise<T>;
+/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer. */
+export declare const resolveIssuerUrl: (deps: RunDeps, flag?: string) => string;

package/dist/issuer.js

@@ -1,38 +1,33 @@
 import { CliError, ExitCode } from './errors.js';
 /**
- * The production Keycloak realm (aor-platform/k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it:
- * the launch flag below only switches it on, so a compromised site cannot send logins anywhere else.
+ * The production Keycloak realm (the platform's k8s/configmap.yaml: KEYCLOAK_ISSUER_URI). It ships in the CLI, reviewed with it,
+ * and is the default for `oars login`: no site or file can send a login anywhere else.
  */
 export const PRODUCTION_ISSUER_URL = 'https://login.manyoars.com/realms/aor';
-/** The marketing site serves `{"launched": true}` here from launch day. */
-export const LAUNCH_FLAG_URL = 'https://manyoars.com/.well-known/oars.json';
-const FLAG_TIMEOUT_MS = 5000;
-const NOT_LAUNCHED = 'Many Oars has not launched yet: pass --issuer-url or set OARS_ISSUER_URL.';
-/** True only for a 200 answer whose JSON is an object with `launched: true`; every other answer, or none, means not launched. */
-const hasLaunched = async (deps) => {
+const UNAVAILABLE = 'Cannot reach Many Oars sign-in at login.manyoars.com (Many Oars and its pool at pool.manyoars.com may not be deployed yet). Pass --issuer-url or set OARS_ISSUER_URL to use another issuer.';
+/**
+ * The built-in issuer is in use only when neither `--issuer-url` nor `OARS_ISSUER_URL` named one. If that issuer does not answer
+ * discovery (no answer, an error status, or a body that is not discovery JSON), the platform is not up yet, so say so (exit 2) and
+ * name the pool. An issuer the developer named keeps its own error.
+ */
+export const discoverIssuer = async (deps, flag, discover) => {
     try {
-        const response = await fetch(LAUNCH_FLAG_URL, {
-            headers: { 'User-Agent': `oars/${deps.version}`, Accept: 'application/json' },
-            redirect: 'error',
-            signal: AbortSignal.timeout(FLAG_TIMEOUT_MS),
-        });
-        if (!response.ok)
-            return false;
-        const body = await response.json();
-        return typeof body === 'object' && body !== null && Reflect.get(body, 'launched') === true;
+        return await discover();
     }
-    catch {
-        return false;
+    catch (error) {
+        const named = flag !== undefined || (deps.env.OARS_ISSUER_URL !== undefined && deps.env.OARS_ISSUER_URL !== '');
+        const unanswered = error instanceof CliError && (error.exitCode === ExitCode.UNREACHABLE || error.exitCode === ExitCode.UNEXPECTED);
+        if (!named && unanswered)
+            throw new CliError(UNAVAILABLE, ExitCode.USAGE, 'usage');
+        throw error;
     }
 };
-/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer once the launch flag is on. */
-export const resolveIssuerUrl = async (deps, flag) => {
+/** `--issuer-url`, else `OARS_ISSUER_URL`, else the built-in production issuer. */
+export const resolveIssuerUrl = (deps, flag) => {
     if (flag !== undefined)
         return flag;
     const fromEnv = deps.env.OARS_ISSUER_URL;
     if (fromEnv !== undefined && fromEnv !== '')
         return fromEnv;
-    if (await hasLaunched(deps))
-        return PRODUCTION_ISSUER_URL;
-    throw new CliError(NOT_LAUNCHED, ExitCode.USAGE, 'usage');
+    return PRODUCTION_ISSUER_URL;
 };

package/dist/main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/main.js

@@ -0,0 +1,67 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { openBrowser } from './browser.js';
+import { run } from './cli.js';
+import { defaultConfigDir, fileCredentialStore } from './credentials.js';
+import { cursorRoot } from './sessions/cursor.js';
+import { claudeEvaluator, runClaude } from './sessions/gold-arms.js';
+import { SOURCES } from './sessions/sources.js';
+import { spawnDetachedSend } from './telemetry/send.js';
+/** The version in this package's package.json (one folder up from dist/). */
+const readVersion = () => {
+    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    const version = typeof manifest === 'object' && manifest !== null ? Reflect.get(manifest, 'version') : undefined;
+    return typeof version === 'string' ? version : '0.0.0';
+};
+const configDir = defaultConfigDir(process.env, process.platform, homedir());
+// exitCode rather than process.exit(), so a piped stdout is flushed before the process ends.
+process.exitCode = await run(process.argv.slice(2), {
+    env: process.env,
+    io: {
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+    },
+    store: fileCredentialStore(configDir),
+    telemetry: { dir: join(configDir, 'oars', 'telemetry'), platform: process.platform, spawnSend: spawnDetachedSend },
+    version: readVersion(),
+    sleep: (ms) => sleep(ms),
+    random: Math.random,
+    now: Date.now,
+    openBrowser,
+    install: {
+        platform: process.platform,
+        nodePath: process.execPath,
+        hookBin: fileURLToPath(new URL('./hook-bin.js', import.meta.url)),
+        userSettings: join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), 'settings.json'),
+        cwd: process.cwd(),
+        schtasks: (args) => new Promise((resolve) => {
+            let output = '';
+            const child = spawn('schtasks', args, { windowsHide: true });
+            child.stdout.on('data', (chunk) => {
+                output += chunk.toString();
+            });
+            child.stderr.on('data', (chunk) => {
+                output += chunk.toString();
+            });
+            child.on('error', (error) => {
+                resolve({ code: 1, output: error.message });
+            });
+            child.on('close', (code) => {
+                resolve({ code: code ?? 1, output });
+            });
+        }),
+    },
+    sessions: {
+        storeDir: join(configDir, 'oars', 'sessions'),
+        projectsRoot: join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), 'projects'),
+        cursorRoot: cursorRoot(process.platform, process.env),
+        evaluator: claudeEvaluator(runClaude, process.env),
+        sourceRoots: Object.fromEntries(SOURCES.map((source) => [source.name, source.root(process.platform, process.env, homedir())])),
+        stdin: process.stdin,
+        stdout: process.stdout,
+    },
+});

package/dist/oidc.js

@@ -21,7 +21,7 @@ const keycloakFetch = ({ version, step, sleep, random }, isTokenEndpoint) => {
             response = await (isTokenEndpoint(url) ? fetch(request) : retrying(request));
         }
         catch (error) {
-            throw unreachableError(step, error);
+            throw unreachableError(step, error, new URL(url).origin);
         }
         const { status } = response;
         if (status === 429 || status === 502 || status === 503 || status === 504) {

package/dist/sessions/actions.d.ts

@@ -0,0 +1,35 @@
+import type { Harness } from './schema.js';
+export declare const CANONICAL_ACTIONS: readonly ["file.read", "file.edit", "file.write", "file.search", "shell.exec", "web.search", "web.fetch", "mcp.call", "skill.run", "agent.spawn", "plan.update", "ask.user", "recall.pull", "recall.push", "other"];
+export type CanonicalAction = (typeof CANONICAL_ACTIONS)[number];
+export interface ActionTable {
+    /** Native name to action. A row may say `other`: that is a known public name with no canonical action, so it keeps its name. */
+    rows: {
+        readonly [native: string]: CanonicalAction;
+    };
+    /** How this harness spells an MCP call, with named groups `server` and `tool`; null when it has no such calls. */
+    mcp: RegExp | null;
+    /** Whether that spelling marks where the server name ends. One that cannot may have read a private server's name as the tool, so the tool stays out of class P. */
+    toolDelimited: boolean;
+    /** Native shell tool to the shell it runs, for the frame; a tool not listed does not say which shell it is. */
+    shells: {
+        readonly [native: string]: string;
+    };
+}
+export declare const ACTION_TABLES: {
+    readonly [harness in Harness]: ActionTable;
+};
+/** The MCP call a native name spells, in full, as the transcript wrote it; undefined for any other name. */
+export declare const mcpOf: (table: ActionTable, native: string) => {
+    server: string;
+    tool: string;
+} | undefined;
+/**
+ * What a native name becomes on a step. Rows win over the MCP pattern, so a harness can name a recall that travels over MCP. `native` is the
+ * name itself only when a row lists it; an MCP name holds a server name, so `callIdentity` decides whether it is shown.
+ */
+export declare const actionOf: (table: ActionTable, native: string) => {
+    action: CanonicalAction;
+    native: string;
+};
+/** The shell a native tool runs, or null when the table does not say. */
+export declare const shellOf: (table: ActionTable, native: string) => string | null;