@oh-my-pi/pi-coding-agent 1.337.0

package/src/core/auth-storage.ts

@@ -0,0 +1,236 @@
+/**
+ * Credential storage for API keys and OAuth tokens.
+ * Handles loading, saving, and refreshing credentials from auth.json.
+ */
+
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+	getEnvApiKey,
+	getOAuthApiKey,
+	loginAnthropic,
+	loginAntigravity,
+	loginGeminiCli,
+	loginGitHubCopilot,
+	type OAuthCredentials,
+	type OAuthProvider,
+} from "@oh-my-pi/pi-ai";
+
+export type ApiKeyCredential = {
+	type: "api_key";
+	key: string;
+};
+
+export type OAuthCredential = {
+	type: "oauth";
+} & OAuthCredentials;
+
+export type AuthCredential = ApiKeyCredential | OAuthCredential;
+
+export type AuthStorageData = Record<string, AuthCredential>;
+
+/**
+ * Credential storage backed by a JSON file.
+ */
+export class AuthStorage {
+	private data: AuthStorageData = {};
+	private runtimeOverrides: Map<string, string> = new Map();
+	private fallbackResolver?: (provider: string) => string | undefined;
+
+	constructor(private authPath: string) {
+		this.reload();
+	}
+
+	/**
+	 * Set a runtime API key override (not persisted to disk).
+	 * Used for CLI --api-key flag.
+	 */
+	setRuntimeApiKey(provider: string, apiKey: string): void {
+		this.runtimeOverrides.set(provider, apiKey);
+	}
+
+	/**
+	 * Remove a runtime API key override.
+	 */
+	removeRuntimeApiKey(provider: string): void {
+		this.runtimeOverrides.delete(provider);
+	}
+
+	/**
+	 * Set a fallback resolver for API keys not found in auth.json or env vars.
+	 * Used for custom provider keys from models.json.
+	 */
+	setFallbackResolver(resolver: (provider: string) => string | undefined): void {
+		this.fallbackResolver = resolver;
+	}
+
+	/**
+	 * Reload credentials from disk.
+	 */
+	reload(): void {
+		if (!existsSync(this.authPath)) {
+			this.data = {};
+			return;
+		}
+		try {
+			const file = Bun.file(this.authPath);
+			this.data = JSON.parse(file.text() as unknown as string);
+		} catch {
+			this.data = {};
+		}
+	}
+
+	/**
+	 * Save credentials to disk.
+	 */
+	private save(): void {
+		const dir = dirname(this.authPath);
+		if (!existsSync(dir)) {
+			mkdirSync(dir, { recursive: true, mode: 0o700 });
+		}
+		Bun.write(this.authPath, JSON.stringify(this.data, null, 2));
+		chmodSync(this.authPath, 0o600);
+	}
+
+	/**
+	 * Get credential for a provider.
+	 */
+	get(provider: string): AuthCredential | undefined {
+		return this.data[provider] ?? undefined;
+	}
+
+	/**
+	 * Set credential for a provider.
+	 */
+	set(provider: string, credential: AuthCredential): void {
+		this.data[provider] = credential;
+		this.save();
+	}
+
+	/**
+	 * Remove credential for a provider.
+	 */
+	remove(provider: string): void {
+		delete this.data[provider];
+		this.save();
+	}
+
+	/**
+	 * List all providers with credentials.
+	 */
+	list(): string[] {
+		return Object.keys(this.data);
+	}
+
+	/**
+	 * Check if credentials exist for a provider.
+	 */
+	has(provider: string): boolean {
+		return provider in this.data;
+	}
+
+	/**
+	 * Get all credentials (for passing to getOAuthApiKey).
+	 */
+	getAll(): AuthStorageData {
+		return { ...this.data };
+	}
+
+	/**
+	 * Login to an OAuth provider.
+	 */
+	async login(
+		provider: OAuthProvider,
+		callbacks: {
+			onAuth: (info: { url: string; instructions?: string }) => void;
+			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
+			onProgress?: (message: string) => void;
+		},
+	): Promise<void> {
+		let credentials: OAuthCredentials;
+
+		switch (provider) {
+			case "anthropic":
+				credentials = await loginAnthropic(
+					(url) => callbacks.onAuth({ url }),
+					() => callbacks.onPrompt({ message: "Paste the authorization code:" }),
+				);
+				break;
+			case "github-copilot":
+				credentials = await loginGitHubCopilot({
+					onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),
+					onPrompt: callbacks.onPrompt,
+					onProgress: callbacks.onProgress,
+				});
+				break;
+			case "google-gemini-cli":
+				credentials = await loginGeminiCli(callbacks.onAuth, callbacks.onProgress);
+				break;
+			case "google-antigravity":
+				credentials = await loginAntigravity(callbacks.onAuth, callbacks.onProgress);
+				break;
+			default:
+				throw new Error(`Unknown OAuth provider: ${provider}`);
+		}
+
+		this.set(provider, { type: "oauth", ...credentials });
+	}
+
+	/**
+	 * Logout from a provider.
+	 */
+	logout(provider: string): void {
+		this.remove(provider);
+	}
+
+	/**
+	 * Get API key for a provider.
+	 * Priority:
+	 * 1. Runtime override (CLI --api-key)
+	 * 2. API key from auth.json
+	 * 3. OAuth token from auth.json (auto-refreshed)
+	 * 4. Environment variable
+	 * 5. Fallback resolver (models.json custom providers)
+	 */
+	async getApiKey(provider: string): Promise<string | undefined> {
+		// Runtime override takes highest priority
+		const runtimeKey = this.runtimeOverrides.get(provider);
+		if (runtimeKey) {
+			return runtimeKey;
+		}
+
+		const cred = this.data[provider];
+
+		if (cred?.type === "api_key") {
+			return cred.key;
+		}
+
+		if (cred?.type === "oauth") {
+			// Filter to only oauth credentials for getOAuthApiKey
+			const oauthCreds: Record<string, OAuthCredentials> = {};
+			for (const [key, value] of Object.entries(this.data)) {
+				if (value.type === "oauth") {
+					oauthCreds[key] = value;
+				}
+			}
+
+			try {
+				const result = await getOAuthApiKey(provider as OAuthProvider, oauthCreds);
+				if (result) {
+					this.data[provider] = { type: "oauth", ...result.newCredentials };
+					this.save();
+					return result.apiKey;
+				}
+			} catch {
+				this.remove(provider);
+			}
+		}
+
+		// Fall back to environment variable
+		const envKey = getEnvApiKey(provider);
+		if (envKey) return envKey;
+
+		// Fall back to custom resolver (e.g., models.json custom providers)
+		return this.fallbackResolver?.(provider) ?? undefined;
+	}
+}

package/src/core/bash-executor.ts

@@ -0,0 +1,196 @@
+/**
+ * Bash command execution with streaming support and cancellation.
+ *
+ * This module provides a unified bash execution implementation used by:
+ * - AgentSession.executeBash() for interactive and RPC modes
+ * - Direct calls from modes that need bash execution
+ */
+
+import { createWriteStream, type WriteStream } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Subprocess } from "bun";
+import stripAnsi from "strip-ansi";
+import { getShellConfig, killProcessTree, sanitizeBinaryOutput } from "../utils/shell.js";
+import { DEFAULT_MAX_BYTES, truncateTail } from "./tools/truncate.js";
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface BashExecutorOptions {
+	/** Callback for streaming output chunks (already sanitized) */
+	onChunk?: (chunk: string) => void;
+	/** AbortSignal for cancellation */
+	signal?: AbortSignal;
+}
+
+export interface BashResult {
+	/** Combined stdout + stderr output (sanitized, possibly truncated) */
+	output: string;
+	/** Process exit code (undefined if killed/cancelled) */
+	exitCode: number | undefined;
+	/** Whether the command was cancelled via signal */
+	cancelled: boolean;
+	/** Whether the output was truncated */
+	truncated: boolean;
+	/** Path to temp file containing full output (if output exceeded truncation threshold) */
+	fullOutputPath?: string;
+}
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+/**
+ * Execute a bash command with optional streaming and cancellation support.
+ *
+ * Features:
+ * - Streams sanitized output via onChunk callback
+ * - Writes large output to temp file for later retrieval
+ * - Supports cancellation via AbortSignal
+ * - Sanitizes output (strips ANSI, removes binary garbage, normalizes newlines)
+ * - Truncates output if it exceeds the default max bytes
+ *
+ * @param command - The bash command to execute
+ * @param options - Optional streaming callback and abort signal
+ * @returns Promise resolving to execution result
+ */
+export function executeBash(command: string, options?: BashExecutorOptions): Promise<BashResult> {
+	return new Promise((resolve, reject) => {
+		const { shell, args } = getShellConfig();
+		const child: Subprocess = Bun.spawn([shell, ...args, command], {
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "pipe",
+		});
+
+		// Track sanitized output for truncation
+		const outputChunks: string[] = [];
+		let outputBytes = 0;
+		const maxOutputBytes = DEFAULT_MAX_BYTES * 2;
+
+		// Temp file for large output
+		let tempFilePath: string | undefined;
+		let tempFileStream: WriteStream | undefined;
+		let totalBytes = 0;
+
+		// Handle abort signal
+		const abortHandler = () => {
+			killProcessTree(child.pid);
+		};
+
+		if (options?.signal) {
+			if (options.signal.aborted) {
+				// Already aborted, don't even start
+				child.kill();
+				resolve({
+					output: "",
+					exitCode: undefined,
+					cancelled: true,
+					truncated: false,
+				});
+				return;
+			}
+			options.signal.addEventListener("abort", abortHandler, { once: true });
+		}
+
+		const handleData = (data: Buffer) => {
+			totalBytes += data.length;
+
+			// Sanitize once at the source: strip ANSI, replace binary garbage, normalize newlines
+			const text = sanitizeBinaryOutput(stripAnsi(data.toString())).replace(/\r/g, "");
+
+			// Start writing to temp file if exceeds threshold
+			if (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {
+				const randomId = crypto.getRandomValues(new Uint8Array(8));
+				const id = Array.from(randomId, (b) => b.toString(16).padStart(2, "0")).join("");
+				tempFilePath = join(tmpdir(), `pi-bash-${id}.log`);
+				tempFileStream = createWriteStream(tempFilePath);
+				// Write already-buffered chunks to temp file
+				for (const chunk of outputChunks) {
+					tempFileStream.write(chunk);
+				}
+			}
+
+			if (tempFileStream) {
+				tempFileStream.write(text);
+			}
+
+			// Keep rolling buffer of sanitized text
+			outputChunks.push(text);
+			outputBytes += text.length;
+			while (outputBytes > maxOutputBytes && outputChunks.length > 1) {
+				const removed = outputChunks.shift()!;
+				outputBytes -= removed.length;
+			}
+
+			// Stream to callback if provided
+			if (options?.onChunk) {
+				options.onChunk(text);
+			}
+		};
+
+		// Read streams asynchronously
+		(async () => {
+			try {
+				const stdoutReader = (child.stdout as ReadableStream<Uint8Array>).getReader();
+				const stderrReader = (child.stderr as ReadableStream<Uint8Array>).getReader();
+
+				await Promise.all([
+					(async () => {
+						while (true) {
+							const { done, value } = await stdoutReader.read();
+							if (done) break;
+							handleData(Buffer.from(value));
+						}
+					})(),
+					(async () => {
+						while (true) {
+							const { done, value } = await stderrReader.read();
+							if (done) break;
+							handleData(Buffer.from(value));
+						}
+					})(),
+				]);
+
+				const exitCode = await child.exited;
+
+				// Clean up abort listener
+				if (options?.signal) {
+					options.signal.removeEventListener("abort", abortHandler);
+				}
+
+				if (tempFileStream) {
+					tempFileStream.end();
+				}
+
+				// Combine buffered chunks for truncation (already sanitized)
+				const fullOutput = outputChunks.join("");
+				const truncationResult = truncateTail(fullOutput);
+
+				// Non-zero exit codes or signal-killed processes are considered cancelled if killed via signal
+				const cancelled = exitCode === null || (exitCode !== 0 && (options?.signal?.aborted ?? false));
+
+				resolve({
+					output: truncationResult.truncated ? truncationResult.content : fullOutput,
+					exitCode: cancelled ? undefined : exitCode,
+					cancelled,
+					truncated: truncationResult.truncated,
+					fullOutputPath: tempFilePath,
+				});
+			} catch (err) {
+				// Clean up abort listener
+				if (options?.signal) {
+					options.signal.removeEventListener("abort", abortHandler);
+				}
+
+				if (tempFileStream) {
+					tempFileStream.end();
+				}
+
+				reject(err);
+			}
+		})();
+	});
+}