@numairbaseer/scifcode 0.1.5 → 0.2.0

package/README.md

@@ -21,23 +21,24 @@ Supported runtime packages cover:
 - Windows: arm64 and x64
 - baseline x64 builds for CPUs without AVX2
 
-## Configure
+## Log in
 
-Scifcode does not store API keys in the repo. Set the API key or bearer token
-for your configured endpoint in the current shell:
+Authenticate once through the Scifcode control-plane portal. The CLI opens a
+short-lived authorization page and receives its own revocable session after you
+approve it:
 
 ```bash
-export SCIFCODE_API_KEY="endpoint_or_modal_bearer_token"
+scifcode login
 ```
 
-Scifcode uses the project's fixed Modal endpoint:
+The session is stored at `~/.scifcode/session.json` with owner-only permissions.
+Scifcode uses it only to authenticate with the control plane; upstream model
+URLs and credentials remain server-side.
 
-```bash
-https://danishshaik--reservoir-vllm-serve.modal.run/v1
-```
-
-You usually only need to set `SCIFCODE_API_KEY`. The provider and model are
-fixed to the Scifcode Modal deployment.
+The control plane defaults to `http://localhost:8080` for local development.
+Self-hosted customers pass their URL once with
+`scifcode login --control-plane https://scifcode.customer.example`; the URL is
+stored with the session and reused. Non-local control planes must use HTTPS.
 
 ## Run
 
@@ -64,7 +65,8 @@ This happens before the runtime launches, so no separate initialization command
 
 | Variable | Required | Default | Description |
 | --- | ---: | --- | --- |
-| `SCIFCODE_API_KEY` | yes | none | API key or bearer token for the configured endpoint |
+| `SCIFCODE_CONTROL_PLANE_URL` | no | `http://localhost:8080` | Alternative to `login --control-plane`; useful for managed installation and automation |
+| `SCIFCODE_SESSION_TOKEN` | no | stored login session | Ephemeral process override for the control-plane session |
 | `SCIFCODE_CONTEXT_WINDOW` | no | `32768` | Context window reported for `scifcode-1.0` |
 | `SCIFCODE_MAX_TOKENS` | no | `8192` | Maximum output tokens reported for `scifcode-1.0` |
 | `SCIFCODE_RUNTIME_BIN` | no | installed platform package | Override path to a compiled Scifcode runtime binary |
@@ -78,23 +80,25 @@ Scifcode also loads private env defaults from:
 ./.scifcode.env
 ```
 
-Shell environment variables win over these files. Keep API keys in the global
-file or an ignored project `.scifcode.env`, not in committed source.
+Shell environment variables win over these files. Do not put session tokens in
+project env files or commit them to source control.
 
 ## Troubleshooting
 
-### `Scifcode requires SCIFCODE_API_KEY`
+### `Scifcode requires a control-plane session`
 
-Set your key:
+Log in through the browser. If you already have a portal session, you only need
+to approve the CLI. Otherwise, complete the portal's email verification first:
 
 ```bash
-export SCIFCODE_API_KEY="endpoint_or_modal_bearer_token"
+scifcode login
 ```
 
-Then retry:
+Inspect or revoke the current session with:
 
 ```bash
-scifcode
+scifcode whoami
+scifcode logout
 ```
 
 ### Invalid Scifcode config
@@ -111,17 +115,12 @@ If this file contains invalid JSON, fix it or move it aside and rerun:
 scifcode
 ```
 
-### Modal A100 endpoint
-
-Scifcode can also point at an OpenAI Chat Completions-compatible endpoint
-served from Modal. See `docs/modal-a100.md` for a Laguna XS.2 vLLM scaffold.
-
 ## Security
 
-Scifcode v0.1 does not store API keys in the repo. It writes an environment
-variable reference such as `{env:SCIFCODE_API_KEY}` into its runtime config and
-passes the current process environment to the agent process. `LAGUNA_API_KEY` is
-still accepted as a legacy fallback.
+Scifcode never receives the upstream model credential. The control plane owns
+the model endpoint, model-ID translation, and upstream authentication. The CLI
+stores only a revocable user session token in an owner-readable file and injects
+it into the runtime through `SCIFCODE_SESSION_TOKEN`.
 
 Scifcode launches the installed platform runtime directly with argument arrays
 and does not use shell string execution. Bun/source execution remains available

package/bin/scifcode.js

@@ -2,4 +2,4 @@
 
 import { main } from "../src/cli.js";
 
-main();
+await main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numairbaseer/scifcode",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Scifcode: a coding CLI agent powered by Poolside Laguna.",
   "type": "module",
   "repository": {
@@ -24,11 +24,11 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check bin/scifcode.js && node --check src/cli.js && node --check src/constants.js && node --check src/env-config.js && node --check src/ensure-scifcode-config.js && node --check src/paths.js && node --check src/run-runtime.js",
+    "lint": "node --check bin/scifcode.js && node --check src/cli.js && node --check src/constants.js && node --check src/control-plane-auth.js && node --check src/env-config.js && node --check src/ensure-scifcode-config.js && node --check src/paths.js && node --check src/run-runtime.js",
     "prepack": "npm test && npm run lint"
   },
   "dependencies": {
-    "@numairbaseer/scifcode-runtime": "0.1.5"
+    "@numairbaseer/scifcode-runtime": "0.2.0"
   },
   "engines": {
     "node": ">=22.19.0"

package/src/cli.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { ensureScifcodeConfig } from "./ensure-scifcode-config.js";
 import { loadScifcodeEnv } from "./env-config.js";
 import { runRuntime } from "./run-runtime.js";
+import { login, logout, whoami } from "./control-plane-auth.js";
 
 export function printHelp(stdout = console.log) {
   stdout(`Scifcode - coding CLI agent powered by Poolside Laguna
@@ -11,11 +12,13 @@ export function printHelp(stdout = console.log) {
 Usage:
   scifcode                 Start interactive coding agent
   scifcode -p "prompt"     Run one-shot prompt
-
-Required environment:
-  SCIFCODE_API_KEY        API key or bearer token for the configured endpoint
+  scifcode login [--control-plane <url>]
+                           Authenticate in the portal and start Scifcode
+  scifcode logout          Revoke the current CLI session
+  scifcode whoami          Show the authenticated user
 
 Optional environment:
+  SCIFCODE_CONTROL_PLANE_URL  Control-plane origin (default: http://localhost:8080)
   SCIFCODE_RUNTIME_BIN     Path to a compiled Scifcode runtime binary
   SCIFCODE_SOURCE_DIR      Path to the Scifcode OpenCode fork
   SCIFCODE_BUN_BIN         Path to Bun when launching the fork from source
@@ -45,7 +48,31 @@ function createConsoleWriters(stdout, stderr) {
   };
 }
 
-export function main(options = {}) {
+export function parseLoginControlPlaneUrl(args = []) {
+  const loginArgs = args.slice(1);
+  let controlPlaneUrl;
+  for (let index = 0; index < loginArgs.length; index += 1) {
+    const argument = loginArgs[index];
+    let value;
+    if (argument === "--control-plane") {
+      value = loginArgs[index + 1];
+      if (!value || value.startsWith("-")) {
+        throw new Error("--control-plane requires a URL.");
+      }
+      index += 1;
+    } else if (argument.startsWith("--control-plane=")) {
+      value = argument.slice("--control-plane=".length);
+      if (!value) throw new Error("--control-plane requires a URL.");
+    } else {
+      throw new Error(`Unknown login option: ${argument}`);
+    }
+    if (controlPlaneUrl) throw new Error("Specify --control-plane only once.");
+    controlPlaneUrl = value;
+  }
+  return controlPlaneUrl;
+}
+
+export async function main(options = {}) {
   const args = options.args || process.argv.slice(2);
   const command = args[0];
   const baseEnv = options.env || process.env;
@@ -66,6 +93,16 @@ export function main(options = {}) {
     options.stderr || console.error
   );
 
+  const authOptions = {
+    env,
+    homeDir: options.homeDir,
+    stdout: writers.log,
+    input: options.input,
+    output: options.output,
+    question: options.question,
+    fetchFn: options.fetchFn
+  };
+
   if (command === "--help" || command === "-h") {
     printHelp(writers.log);
     exit(0);
@@ -78,13 +115,43 @@ export function main(options = {}) {
     return;
   }
 
+  let runtimeArgs = args;
+  try {
+    if (command === "login") {
+      await (options.loginFn || login)({
+        ...authOptions,
+        controlPlaneUrl: parseLoginControlPlaneUrl(args)
+      });
+      runtimeArgs = [];
+    }
+    else if (command === "logout") {
+      await (options.logoutFn || logout)(authOptions);
+      writers.log("Logged out.");
+      exit(0);
+      return;
+    }
+    else if (command === "whoami") {
+      const identity = await (options.whoamiFn || whoami)(authOptions);
+      writers.log(identity.user.email);
+      writers.log(`Role: ${identity.user.role}`);
+      writers.log(`Session expires: ${identity.expiresAt}`);
+      writers.log(`Control plane: ${identity.controlPlaneUrl}`);
+      exit(0);
+      return;
+    }
+  } catch (error) {
+    writers.error(error.message);
+    exit(1);
+    return;
+  }
+
   try {
-    ensureScifcodeConfigFn({ env });
+    ensureScifcodeConfigFn({ env, homeDir: options.homeDir });
   } catch (error) {
     writers.error(error.message);
     exit(1);
     return;
   }
 
-  runRuntimeFn(args, { env, exit, stderr: writers.error });
+  runRuntimeFn(runtimeArgs, { env, exit, stderr: writers.error, homeDir: options.homeDir });
 }

package/src/constants.js

@@ -1,8 +1,31 @@
 export const DEFAULT_PROVIDER_NAME = "scifcode";
-export const DEFAULT_BASE_URL = "https://danishshaik--reservoir-vllm-serve.modal.run/v1";
-export const DEFAULT_MODEL = "reservoir-modal";
+export const DEFAULT_CONTROL_PLANE_URL = "http://localhost:8080";
+export const DEFAULT_MODEL = "scifcode-1.0";
 export const DEFAULT_MODEL_NAME = "scifcode-1.0";
 export const DEFAULT_CONTEXT_WINDOW = 32768;
 export const DEFAULT_MAX_TOKENS = 8192;
-export const API_KEY_ENV_NAME = "SCIFCODE_API_KEY";
-export const LEGACY_API_KEY_ENV_NAME = "LAGUNA_API_KEY";
+export const SESSION_TOKEN_ENV_NAME = "SCIFCODE_SESSION_TOKEN";
+
+export function normalizeControlPlaneUrl(value) {
+  const normalized = String(value || "").trim();
+  let url;
+  try {
+    url = new URL(normalized);
+  } catch {
+    throw new Error(`Invalid control-plane URL: ${normalized}`);
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:")) {
+    throw new Error("The control-plane URL must use HTTPS except on localhost.");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+
+export function getControlPlaneUrl(env = process.env) {
+  const value = String(env.SCIFCODE_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL).trim();
+  return normalizeControlPlaneUrl(value);
+}
+
+export function getModelBaseUrl(env = process.env) {
+  return `${getControlPlaneUrl(env)}/v1`;
+}

package/src/control-plane-auth.js

@@ -0,0 +1,143 @@
+import fs from "node:fs";
+import { spawn } from "node:child_process";
+import { getControlPlaneUrl, normalizeControlPlaneUrl } from "./constants.js";
+import { getScifcodeHomeDir, getScifcodeSessionPath } from "./paths.js";
+
+async function requestJson(fetchFn, url, options = {}) {
+  let response;
+  try {
+    response = await fetchFn(url, options);
+  } catch (error) {
+    throw new Error(`Could not reach the Scifcode control plane. ${error.message}`);
+  }
+  const text = await response.text();
+  let body = {};
+  try { body = text ? JSON.parse(text) : {}; } catch {}
+  if (!response.ok) {
+    const reason = body.error || body.message || `HTTP ${response.status}`;
+    const error = new Error(`Control-plane request failed: ${reason}`);
+    error.status = response.status;
+    error.code = body.error;
+    throw error;
+  }
+  return body;
+}
+
+export function readSession(options = {}) {
+  const sessionPath = options.sessionPath || getScifcodeSessionPath(options.homeDir);
+  if (!fs.existsSync(sessionPath)) return null;
+  try {
+    const session = JSON.parse(fs.readFileSync(sessionPath, "utf8"));
+    if (!session.sessionToken || !session.controlPlaneUrl) return null;
+    return session;
+  } catch {
+    throw new Error(`Scifcode could not parse ${sessionPath}. Run \`scifcode login\` again.`);
+  }
+}
+
+export function writeSession(session, options = {}) {
+  const homeDir = options.homeDir;
+  const directory = options.sessionDir || getScifcodeHomeDir(homeDir);
+  const sessionPath = options.sessionPath || getScifcodeSessionPath(homeDir);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  const temporaryPath = `${sessionPath}.${process.pid}.tmp`;
+  fs.writeFileSync(temporaryPath, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temporaryPath, sessionPath);
+  fs.chmodSync(sessionPath, 0o600);
+  return sessionPath;
+}
+
+export function deleteSession(options = {}) {
+  const sessionPath = options.sessionPath || getScifcodeSessionPath(options.homeDir);
+  if (fs.existsSync(sessionPath)) fs.unlinkSync(sessionPath);
+}
+
+export function openBrowser(url, options = {}) {
+  const platform = options.platform || process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd.exe" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = (options.spawnFn || spawn)(command, args, {
+    stdio: "ignore",
+    detached: true
+  });
+  child.on?.("error", () => {});
+  child.unref?.();
+}
+
+export async function login(options = {}) {
+  const fetchFn = options.fetchFn || fetch;
+  const stdout = options.stdout || console.log;
+  const controlPlaneUrl = normalizeControlPlaneUrl(
+    options.controlPlaneUrl || getControlPlaneUrl(options.env)
+  );
+  const authorization = await requestJson(fetchFn, `${controlPlaneUrl}/auth/device/request`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{}"
+  });
+  if (!authorization.deviceCode || !authorization.verificationUriComplete) {
+    throw new Error("The control plane returned an invalid device authorization.");
+  }
+
+  stdout("Authenticate Scifcode in your browser:");
+  stdout(authorization.verificationUriComplete);
+  try {
+    (options.openBrowserFn || openBrowser)(authorization.verificationUriComplete);
+  } catch {}
+
+  const now = options.nowFn || Date.now;
+  const sleep = options.sleepFn || (milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds)));
+  const interval = Math.max(Number(authorization.interval) || 2, 1) * 1000;
+  const deadline = now() + Math.max(Number(authorization.expiresIn) || 600, 1) * 1000;
+  let verified;
+  while (now() < deadline) {
+    await sleep(interval);
+    try {
+      verified = await requestJson(fetchFn, `${controlPlaneUrl}/auth/device/token`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceCode: authorization.deviceCode })
+      });
+      break;
+    } catch (error) {
+      if (error.code === "authorization_pending") continue;
+      throw error;
+    }
+  }
+  if (!verified?.sessionToken) {
+    throw new Error("CLI authorization expired. Run `scifcode login` again.");
+  }
+  const session = {
+    sessionToken: verified.sessionToken,
+    email: verified.user?.email,
+    expiresAt: verified.expiresAt,
+    controlPlaneUrl
+  };
+  writeSession(session, options);
+  stdout(`Logged in as ${session.email}.`);
+  return session;
+}
+
+export async function whoami(options = {}) {
+  const session = readSession(options);
+  if (!session) throw new Error("Not logged in. Run `scifcode login`.");
+  const result = await requestJson(options.fetchFn || fetch, `${session.controlPlaneUrl}/auth/me`, {
+    headers: { authorization: `Bearer ${session.sessionToken}` }
+  });
+  return { ...result, controlPlaneUrl: session.controlPlaneUrl };
+}
+
+export async function logout(options = {}) {
+  const session = readSession(options);
+  try {
+    if (session) {
+      await requestJson(options.fetchFn || fetch, `${session.controlPlaneUrl}/auth/logout`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${session.sessionToken}` }
+      });
+    }
+  } finally {
+    deleteSession(options);
+  }
+}

package/src/ensure-scifcode-config.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
-import { API_KEY_ENV_NAME, DEFAULT_BASE_URL, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_TOKENS, DEFAULT_MODEL, DEFAULT_MODEL_NAME, DEFAULT_PROVIDER_NAME, LEGACY_API_KEY_ENV_NAME } from "./constants.js";
+import { DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_TOKENS, DEFAULT_MODEL, DEFAULT_MODEL_NAME, DEFAULT_PROVIDER_NAME, SESSION_TOKEN_ENV_NAME, getModelBaseUrl, normalizeControlPlaneUrl } from "./constants.js";
+import { readSession } from "./control-plane-auth.js";
 import { getScifcodeConfigDir, getScifcodeConfigPath } from "./paths.js";
 
 function positiveInteger(value, fallback) {
@@ -19,19 +20,16 @@ export function buildScifcodeModels(env = process.env) {
   };
 }
 
-export function getApiKeyReference(env = process.env) {
-  return env[LEGACY_API_KEY_ENV_NAME] && !env[API_KEY_ENV_NAME]
-    ? `{env:${LEGACY_API_KEY_ENV_NAME}}`
-    : `{env:${API_KEY_ENV_NAME}}`;
-}
-
-export function buildScifcodeProvider(env = process.env) {
+export function buildScifcodeProvider(env = process.env, options = {}) {
+  const baseURL = options.controlPlaneUrl
+    ? `${normalizeControlPlaneUrl(options.controlPlaneUrl)}/v1`
+    : getModelBaseUrl(env);
   return {
     npm: "@ai-sdk/openai-compatible",
     name: "Scifcode",
     options: {
-      baseURL: DEFAULT_BASE_URL,
-      apiKey: getApiKeyReference(env)
+      baseURL,
+      apiKey: `{env:${SESSION_TOKEN_ENV_NAME}}`
     },
     models: buildScifcodeModels(env)
   };
@@ -49,7 +47,10 @@ export function ensureScifcodeConfig(options = {}) {
   const configPath = getScifcodeConfigPath(options.homeDir);
   const providerName = DEFAULT_PROVIDER_NAME;
   const existing = readConfig(configPath);
-  const provider = buildScifcodeProvider(env);
+  const session = (options.readSessionFn || readSession)({ homeDir: options.homeDir });
+  const provider = buildScifcodeProvider(env, {
+    controlPlaneUrl: session?.controlPlaneUrl || env.SCIFCODE_CONTROL_PLANE_URL
+  });
   const merged = {
     ...existing,
     $schema: existing.$schema || "https://opencode.ai/config.json",

package/src/paths.js

@@ -3,6 +3,7 @@ import path from "node:path";
 
 export function getScifcodeHomeDir(homeDir = os.homedir()) { return path.join(homeDir, ".scifcode"); }
 export function getScifcodeEnvPath(homeDir = os.homedir()) { return path.join(getScifcodeHomeDir(homeDir), "env"); }
+export function getScifcodeSessionPath(homeDir = os.homedir()) { return path.join(getScifcodeHomeDir(homeDir), "session.json"); }
 export function getProjectScifcodeEnvPath(cwd = process.cwd()) { return path.join(cwd, ".scifcode.env"); }
 export function getScifcodeConfigDir(homeDir = os.homedir()) { return path.join(homeDir, ".config", "scifcode"); }
 export function getScifcodeConfigPath(homeDir = os.homedir()) { return path.join(getScifcodeConfigDir(homeDir), "scifcode.json"); }

package/src/run-runtime.js

@@ -3,7 +3,8 @@ import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { API_KEY_ENV_NAME, DEFAULT_MODEL, DEFAULT_PROVIDER_NAME, LEGACY_API_KEY_ENV_NAME } from "./constants.js";
+import { DEFAULT_MODEL, DEFAULT_PROVIDER_NAME, SESSION_TOKEN_ENV_NAME } from "./constants.js";
+import { readSession } from "./control-plane-auth.js";
 
 function executableOnPath(name, env = process.env) {
   return String(env.PATH || "").split(path.delimiter).map(dir => path.join(dir, name)).find(fs.existsSync);
@@ -81,28 +82,34 @@ export function buildRuntimeArgs(userArgs = [], env = process.env, runtime = res
   return [...runtime.argsPrefix, "--model", model, ...withoutModelOverrides];
 }
 
-export function buildRuntimeEnv(env = process.env) {
+export function buildRuntimeEnv(env = process.env, options = {}) {
   const runtimeEnv = { ...env };
-  if (!runtimeEnv[API_KEY_ENV_NAME] && env[LEGACY_API_KEY_ENV_NAME]) runtimeEnv[API_KEY_ENV_NAME] = env[LEGACY_API_KEY_ENV_NAME];
+  if (!runtimeEnv[SESSION_TOKEN_ENV_NAME]) {
+    const session = (options.readSessionFn || readSession)({ homeDir: options.homeDir });
+    const expiresAt = session?.expiresAt ? Date.parse(session.expiresAt) : Number.POSITIVE_INFINITY;
+    if (session?.sessionToken && expiresAt > Date.now()) {
+      runtimeEnv[SESSION_TOKEN_ENV_NAME] = session.sessionToken;
+    }
+  }
   return runtimeEnv;
 }
 
-export function validateLagunaApiKey(env = process.env) { return Boolean(env[API_KEY_ENV_NAME] || env[LEGACY_API_KEY_ENV_NAME]); }
-export function printMissingApiKey(stderr = console.error) {
-  stderr(`Scifcode requires ${API_KEY_ENV_NAME}.`);
+export function validateSession(env = process.env) { return Boolean(env[SESSION_TOKEN_ENV_NAME]); }
+export function printMissingSession(stderr = console.error) {
+  stderr("Scifcode requires a control-plane session.");
   stderr("");
-  stderr(`Run:\n  export ${API_KEY_ENV_NAME}="endpoint_or_modal_bearer_token"\n  scifcode`);
+  stderr("Run:\n  scifcode login");
 }
 
 export function runRuntime(userArgs = [], options = {}) {
   const env = options.env || process.env;
   const stderr = options.stderr || console.error;
   const exit = options.exit || process.exit;
-  if (!validateLagunaApiKey(env)) { printMissingApiKey(stderr); exit(1); return null; }
+  const runtimeEnv = buildRuntimeEnv(env, options);
+  if (!validateSession(runtimeEnv)) { printMissingSession(stderr); exit(1); return null; }
   let runtime;
   try { runtime = (options.resolveRuntimeFn || resolveRuntime)({ env }); }
   catch (error) { stderr("Failed to resolve the Scifcode agent runtime."); stderr(error.message); exit(1); return null; }
-  const runtimeEnv = buildRuntimeEnv(env);
   const projectDir = options.cwd || process.cwd();
   const child = (options.spawnFn || spawn)(runtime.command, buildRuntimeArgs(userArgs, runtimeEnv, runtime, projectDir), {
     stdio: "inherit",