@omg-dev/vite-plugin 0.4.24

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@omg-dev/vite-plugin",
+  "version": "0.4.24",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "bin": {
+    "vibes-build": "./src/build.ts"
+  },
+  "scripts": {
+    "build": "vp pack src/index.ts --no-fail-on-warn"
+  },
+  "dependencies": {
+    "@omg-dev/server": "0.4.24",
+    "@omg-dev/schema": "0.4.24",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.5.13"
+  },
+  "peerDependencies": {
+    "vite": "*"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BennyKok/vibes.git"
+  },
+  "homepage": "https://docs.omg.dev",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/src/auth-bridge.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, describe, expect, it } from "vitest"
+import { fetchAuthUpstream, relayAuthUpstream } from "./auth-bridge.ts"
+
+// Minimal ServerResponse stand-in capturing what the bridge writes.
+function mockRes() {
+  const headers: Record<string, string> = {}
+  const state = { statusCode: 0, body: null as Buffer | null, headers }
+  const res = {
+    get statusCode() { return state.statusCode },
+    set statusCode(v: number) { state.statusCode = v },
+    setHeader(key: string, value: string) { headers[key.toLowerCase()] = String(value) },
+    end(body?: Buffer) { state.body = body ?? Buffer.alloc(0) },
+  }
+  return { res: res as unknown as Parameters<typeof relayAuthUpstream>[0], state }
+}
+
+describe("relayAuthUpstream", () => {
+  it("strips upstream framing + cookie headers and recomputes content-length", async () => {
+    // Mirrors the production failure: Cloudflare zstd-compressed the 200
+    // token response, fetch() decompressed it, and the old relay copied the
+    // stale framing headers onto the plaintext body — CF 520'd the desync.
+    const body = JSON.stringify({ token: "x".repeat(400), expiresAt: "2026-01-01T00:00:00Z" })
+    const upstream = new Response(body, {
+      status: 200,
+      headers: {
+        "Content-Type": "application/json;charset=utf-8",
+        "Content-Encoding": "zstd",
+        "Transfer-Encoding": "chunked",
+        "Set-Cookie": "evil=1",
+        Connection: "keep-alive",
+        "Access-Control-Allow-Origin": "https://omg.dev",
+      },
+    })
+    // Response normally re-derives content-length; force the stale value the
+    // way fetch() surfaces it after transparent decompression.
+    upstream.headers.set("Content-Length", "460")
+
+    const { res, state } = mockRes()
+    await relayAuthUpstream(res, upstream)
+
+    expect(state.statusCode).toBe(200)
+    expect(state.body?.toString()).toBe(body)
+    expect(state.headers["content-encoding"]).toBeUndefined()
+    expect(state.headers["transfer-encoding"]).toBeUndefined()
+    expect(state.headers["set-cookie"]).toBeUndefined()
+    expect(state.headers["connection"]).toBeUndefined()
+    expect(state.headers["content-length"]).toBe(String(Buffer.byteLength(body)))
+    expect(state.headers["content-type"]).toBe("application/json;charset=utf-8")
+    expect(state.headers["access-control-allow-origin"]).toBe("https://omg.dev")
+  })
+
+  it("relays error statuses verbatim", async () => {
+    const upstream = new Response(JSON.stringify({ error: "unauthorized" }), { status: 401 })
+    const { res, state } = mockRes()
+    await relayAuthUpstream(res, upstream)
+    expect(state.statusCode).toBe(401)
+    expect(state.body?.toString()).toContain("unauthorized")
+  })
+})
+
+describe("fetchAuthUpstream", () => {
+  const originalFetch = globalThis.fetch
+  const originalProxy = process.env.OMG_AI_URL
+  const originalAuthUrl = process.env.VIBES_AUTH_URL
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    if (originalProxy === undefined) delete process.env.OMG_AI_URL
+    else process.env.OMG_AI_URL = originalProxy
+    if (originalAuthUrl === undefined) delete process.env.VIBES_AUTH_URL
+    else process.env.VIBES_AUTH_URL = originalAuthUrl
+  })
+
+  it("uses the host-side proxy when it advertises the auth route", async () => {
+    process.env.OMG_AI_URL = "http://169.254.0.1:9090"
+    const calls: string[] = []
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      calls.push(String(input))
+      return new Response("{}", { status: 200, headers: { "X-Vibes-Auth-Proxy": "1" } })
+    }) as typeof fetch
+
+    const res = await fetchAuthUpstream("token", { method: "POST" })
+    expect(res.status).toBe(200)
+    expect(calls).toEqual(["http://169.254.0.1:9090/auth/token"])
+  })
+
+  it("falls back to direct when the proxy lacks the marker (old orchestrator)", async () => {
+    process.env.OMG_AI_URL = "http://169.254.0.1:9090"
+    delete process.env.VIBES_AUTH_URL
+    const calls: string[] = []
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      calls.push(String(input))
+      if (calls.length === 1) return new Response("not the auth route", { status: 404 })
+      return new Response("{}", { status: 200 })
+    }) as typeof fetch
+
+    const res = await fetchAuthUpstream("session", { method: "GET" }, "?a=1")
+    expect(res.status).toBe(200)
+    expect(calls).toEqual([
+      "http://169.254.0.1:9090/auth/get-session?a=1",
+      "https://auth.omg.dev/api/auth/get-session?a=1",
+    ])
+  })
+
+  it("goes direct when no proxy env is present", async () => {
+    delete process.env.OMG_AI_URL
+    process.env.VIBES_AUTH_URL = "https://auth.example.test/"
+    const calls: string[] = []
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      calls.push(String(input))
+      return new Response("{}", { status: 401 })
+    }) as typeof fetch
+
+    const res = await fetchAuthUpstream("token", { method: "POST" })
+    expect(res.status).toBe(401)
+    expect(calls).toEqual(["https://auth.example.test/token"])
+  })
+})

package/src/auth-bridge.ts

@@ -0,0 +1,73 @@
+// Preview auth bridge upstream helpers — shared by the /__vibes/auth/token
+// and /__vibes/auth/session dev-server middlewares in index.ts.
+
+import type { ServerResponse } from "node:http"
+
+// Auth-state headers the preview bridges must never relay downstream:
+// - set-cookie: the bridges are read-only for auth state (sign-in/out go
+//   direct to auth.omg.dev through the better-auth client).
+// - content-encoding / content-length / transfer-encoding / connection /
+//   keep-alive: fetch() has already decompressed and de-chunked the body, so
+//   upstream's framing headers describe bytes we are NOT sending. Relaying
+//   them verbatim produced protocol-desynced responses (a `content-encoding:
+//   zstd` header on a plaintext body) that Cloudflare's edge killed with a
+//   520 — which made token minting hang for every signed-in preview user
+//   while signed-out 401s (too small for compression) sailed through.
+export const AUTH_RELAY_SKIP_HEADERS = new Set([
+  "set-cookie",
+  "content-encoding",
+  "content-length",
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+])
+
+/** Relay an upstream auth response with sane framing for the buffered body. */
+export async function relayAuthUpstream(res: ServerResponse, upstream: Response): Promise<void> {
+  const body = Buffer.from(await upstream.arrayBuffer())
+  res.statusCode = upstream.status
+  upstream.headers.forEach((value, key) => {
+    if (AUTH_RELAY_SKIP_HEADERS.has(key.toLowerCase())) return
+    res.setHeader(key, value)
+  })
+  res.setHeader("Content-Length", String(body.byteLength))
+  res.end(body)
+}
+
+/**
+ * Fetch the auth upstream for the preview bridges.
+ *
+ * Prefers the host-side per-sandbox proxy (OMG_AI_URL, the same listener the
+ * LLM proxy uses at 169.254.0.1:9090) when it advertises the auth route via
+ * the `x-vibes-auth-proxy` marker: in-VM Bun fetch to the Cloudflare-proxied
+ * auth host is the AAAA-first/no-IPv6-route hang class, while the host-side
+ * Go client dials dual-stack. Falls back to a direct fetch when the proxy is
+ * absent (local dev outside a sandbox) or predates the auth route.
+ */
+export async function fetchAuthUpstream(
+  kind: "token" | "session",
+  init: RequestInit,
+  qs = "",
+): Promise<Response> {
+  const proxyBase = (process.env.OMG_AI_URL ?? "").trim().replace(/\/+$/, "")
+  if (proxyBase) {
+    const proxyUrl = kind === "token"
+      ? `${proxyBase}/auth/token`
+      : `${proxyBase}/auth/get-session${qs}`
+    try {
+      const viaProxy = await fetch(proxyUrl, init)
+      if (viaProxy.headers.get("x-vibes-auth-proxy")) return viaProxy
+      // No marker: an older orchestrator's catch-all LLM route answered.
+      // Discard and go direct.
+      await viaProxy.arrayBuffer().catch(() => {})
+    } catch {
+      // Host proxy unreachable — go direct.
+    }
+  }
+  const authUrl = (process.env.VIBES_AUTH_URL || process.env.VITE_AUTH_URL || "https://auth.omg.dev")
+    .replace(/\/+$/, "")
+  const directUrl = kind === "token"
+    ? `${authUrl}/token`
+    : `${authUrl}/api/auth/get-session${qs}`
+  return fetch(directUrl, init)
+}

package/src/brand-badge-inject.test.ts

@@ -0,0 +1,94 @@
+// Verifies the build-time injection of the published-app omg badge
+// (@omg-dev/sdk/brand/auto) into the app entry — default ON, opt-out via
+// vibes({ brandBadge: false }), build-only, app-entry-only.
+
+import { describe, expect, test } from "bun:test"
+import vibes from "./index.ts"
+
+const ROOT = "/app"
+const ENTRY = `${ROOT}/src/main.tsx`
+const BRAND_IMPORT = `import "@omg-dev/sdk/brand/auto";`
+
+function ctx() {
+  const warnings: string[] = []
+  return {
+    warnings,
+    resolve: async (src: string) => ({ id: src }),
+    warn: (msg: string) => warnings.push(msg),
+  }
+}
+
+async function runTransform(
+  plugin: ReturnType<typeof vibes>,
+  code: string,
+  id: string,
+  context: ReturnType<typeof ctx>,
+) {
+  const fn = plugin.transform as (this: unknown, code: string, id: string) => Promise<unknown>
+  return fn.call(context, code, id) as Promise<{ code: string } | null>
+}
+
+function buildPlugin(opts?: Parameters<typeof vibes>[0]) {
+  const plugin = vibes({ root: ROOT, pwa: false, feedback: false, ...opts })
+  const configResolved = plugin.configResolved as (cfg: unknown) => void
+  configResolved({ command: "build", root: ROOT })
+  return plugin
+}
+
+describe("brand badge injection", () => {
+  test("default ON: appends the auto-mount import to the app entry", async () => {
+    const plugin = buildPlugin()
+    const out = await runTransform(plugin, "export default 1", ENTRY, ctx())
+    expect(out?.code).toContain(BRAND_IMPORT)
+  })
+
+  test("opt-out via brandBadge:false omits the import", async () => {
+    const plugin = buildPlugin({ brandBadge: false })
+    const out = await runTransform(plugin, "export default 1", ENTRY, ctx())
+    expect(out).toBeNull()
+  })
+
+  test("injected exactly once across multiple entry transforms", async () => {
+    const plugin = buildPlugin()
+    const first = await runTransform(plugin, "export default 1", ENTRY, ctx())
+    const second = await runTransform(plugin, "export default 2", ENTRY, ctx())
+    expect(first?.code).toContain(BRAND_IMPORT)
+    expect(second).toBeNull()
+  })
+
+  test("non-entry modules are untouched", async () => {
+    const plugin = buildPlugin()
+    const out = await runTransform(plugin, "export const x = 1", `${ROOT}/src/util.ts`, ctx())
+    expect(out).toBeNull()
+  })
+
+  test("warns and skips when the SDK subpath cannot be resolved", async () => {
+    const plugin = buildPlugin()
+    const context = ctx()
+    context.resolve = async () => null
+    const out = await runTransform(plugin, "export default 1", ENTRY, context)
+    expect(out).toBeNull()
+    expect(context.warnings.some((w) => w.includes("brand badge"))).toBe(true)
+  })
+
+  test("badge ON bundles feedback + remix: no standalone imports injected", async () => {
+    // brand badge default ON, with feedback + pwa also on. The badge carries
+    // feedback (button-less) and the "Make it mine" CTA itself, so the
+    // standalone feedback/auto + remix-cta imports must NOT be appended.
+    const plugin = vibes({ root: ROOT })
+    const configResolved = plugin.configResolved as (cfg: unknown) => void
+    configResolved({ command: "build", root: ROOT })
+    const out = await runTransform(plugin, "export default 1", ENTRY, ctx())
+    expect(out?.code).toContain(BRAND_IMPORT)
+    expect(out?.code).not.toContain(`import "@omg-dev/sdk/feedback/auto";`)
+    expect(out?.code).not.toContain(`import "@omg-dev/pwa/remix-cta";`)
+  })
+
+  test("serve mode never injects the badge", async () => {
+    const plugin = vibes({ root: ROOT })
+    const configResolved = plugin.configResolved as (cfg: unknown) => void
+    configResolved({ command: "serve", root: ROOT })
+    const out = await runTransform(plugin, "export default 1", ENTRY, ctx())
+    expect(out).toBeNull()
+  })
+})