@openagents-org/agent-launcher 0.2.130 → 0.2.132

package/src/github-client.js

@@ -0,0 +1,165 @@
+'use strict';
+
+const https = require('https');
+
+const DEFAULT_BASE_URL = 'https://api.github.com';
+const USER_AGENT = '@openagents-org/agent-launcher';
+
+/**
+ * Thin GitHub REST API client used by the launcher's GitHub integration.
+ *
+ * Auth is via a personal access token (classic or fine-grained) or GitHub
+ * App installation token. Each call accepts an explicit token so the caller
+ * can resolve it from the launcher's credentials store at request time.
+ */
+class GitHubClient {
+  constructor(opts = {}) {
+    this.baseUrl = (opts.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
+  }
+
+  /**
+   * Verify a token and return identity / rate-limit info.
+   * Mirrors `GET /user` + `GET /rate_limit`.
+   */
+  async probe(token) {
+    if (!token) throw new Error('Missing GitHub token');
+    const user = await this._get('/user', token);
+    const rate = await this._get('/rate_limit', token).catch(() => null);
+    return {
+      ok: true,
+      login: user.login,
+      name: user.name,
+      avatarUrl: user.avatar_url,
+      scopes: user.__scopes || [],
+      rate: rate ? rate.rate : null,
+    };
+  }
+
+  async getRepo(owner, name, token) {
+    return this._get(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, token);
+  }
+
+  /**
+   * @param {string} owner
+   * @param {string} name
+   * @param {{ state?: 'open'|'closed'|'all', perPage?: number, page?: number }} opts
+   * @param {string} token
+   */
+  async listIssues(owner, name, opts = {}, token) {
+    const state = opts.state || 'open';
+    const perPage = opts.perPage || 20;
+    const page = opts.page || 1;
+    // GitHub's /issues endpoint returns PRs too — filter to issue-only.
+    const items = await this._get(
+      `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/issues?state=${state}&per_page=${perPage}&page=${page}`,
+      token,
+    );
+    return items.filter((i) => !i.pull_request);
+  }
+
+  async listPullRequests(owner, name, opts = {}, token) {
+    const state = opts.state || 'open';
+    const perPage = opts.perPage || 20;
+    const page = opts.page || 1;
+    return this._get(
+      `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls?state=${state}&per_page=${perPage}&page=${page}`,
+      token,
+    );
+  }
+
+  async createIssueComment(owner, name, issueNumber, body, token) {
+    return this._post(
+      `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/issues/${issueNumber}/comments`,
+      { body },
+      token,
+    );
+  }
+
+  /**
+   * Parse a GitHub-ish input into { owner, name }.
+   * Accepts: "owner/name", "https://github.com/owner/name", "git@github.com:owner/name.git".
+   */
+  static parseRepo(input) {
+    if (!input) return null;
+    const v = String(input).trim();
+    if (!v) return null;
+    // SSH form: git@github.com:owner/name(.git)
+    const ssh = v.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (ssh) return { owner: ssh[1], name: ssh[2] };
+    // URL form
+    try {
+      const u = new URL(v);
+      if (/github\.com$/i.test(u.hostname)) {
+        const parts = u.pathname.replace(/^\//, '').replace(/\.git$/, '').split('/');
+        if (parts.length >= 2 && parts[0] && parts[1]) {
+          return { owner: parts[0], name: parts[1] };
+        }
+      }
+    } catch {
+      // not a URL — fall through
+    }
+    // Plain "owner/name"
+    const plain = v.match(/^([^/\s]+)\/([^/\s]+?)(?:\.git)?$/);
+    if (plain) return { owner: plain[1], name: plain[2] };
+    return null;
+  }
+
+  _headers(token, extra = {}) {
+    return {
+      Accept: 'application/vnd.github+json',
+      'X-GitHub-Api-Version': '2022-11-28',
+      'User-Agent': USER_AGENT,
+      Authorization: `Bearer ${token}`,
+      ...extra,
+    };
+  }
+
+  _get(urlPath, token, timeout = 20000) {
+    return this._request('GET', urlPath, null, token, timeout);
+  }
+
+  _post(urlPath, body, token, timeout = 30000) {
+    return this._request('POST', urlPath, body, token, timeout);
+  }
+
+  _request(method, urlPath, body, token, timeout) {
+    const fullUrl = this.baseUrl + urlPath;
+    const jsonBody = body == null ? null : JSON.stringify(body);
+    const headers = this._headers(token);
+    if (jsonBody != null) headers['Content-Type'] = 'application/json';
+
+    return new Promise((resolve, reject) => {
+      const req = https.request(fullUrl, { method, headers, timeout }, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          const status = res.statusCode || 0;
+          let parsed = null;
+          try { parsed = data ? JSON.parse(data) : null; } catch { parsed = null; }
+          if (status >= 400) {
+            const msg = (parsed && (parsed.message || parsed.error)) || `HTTP ${status}`;
+            const err = new Error(`GitHub ${method} ${urlPath} failed: ${msg}`);
+            err.status = status;
+            err.body = parsed;
+            return reject(err);
+          }
+          // Attach OAuth scopes for /user probe convenience.
+          if (parsed && method === 'GET' && urlPath === '/user') {
+            const scopes = res.headers['x-oauth-scopes'];
+            if (typeof scopes === 'string') {
+              parsed.__scopes = scopes.split(',').map((s) => s.trim()).filter(Boolean);
+            }
+          }
+          resolve(parsed);
+        });
+      });
+
+      req.on('error', reject);
+      req.on('timeout', () => { req.destroy(); reject(new Error('GitHub request timed out')); });
+      if (jsonBody != null) req.write(jsonBody);
+      req.end();
+    });
+  }
+}
+
+module.exports = { GitHubClient };

package/src/index.js

@@ -6,6 +6,7 @@ const { Registry } = require('./registry');
 const { Installer } = require('./installer');
 const { Daemon } = require('./daemon');
 const { WorkspaceClient } = require('./workspace-client');
+const { GitHubClient } = require('./github-client');
 
 /**
  * Main entry point for the agent-connector library.
@@ -125,6 +126,17 @@ class AgentConnector {
     return { success: true };
   }
 
+  /**
+   * Delete the entire type-level env file (~/.openagents/env/<type>.env).
+   * Used by the launcher's "wipe saved credentials" path on uninstall so
+   * sensitive values (API keys) don't survive a reinstall as surprise
+   * pre-filled defaults in the setup wizard.
+   */
+  deleteAgentEnv(agentType) {
+    this.env.delete(agentType);
+    return { success: true };
+  }
+
   saveAgentInstanceEnv(agentName, env) {
     const agent = this.config.getAgent(agentName);
     if (!agent) throw new Error(`Agent '${agentName}' not found`);
@@ -274,4 +286,4 @@ class AgentConnector {
 const adapters = require('./adapters');
 
 const paths = require('./paths');
-module.exports = { AgentConnector, Daemon, WorkspaceClient, adapters, paths };
+module.exports = { AgentConnector, Daemon, WorkspaceClient, GitHubClient, adapters, paths };

package/src/installer.js

@@ -433,8 +433,15 @@ class Installer {
       if (proc.stdout) proc.stdout.setEncoding('utf-8');
       if (proc.stderr) proc.stderr.setEncoding('utf-8');
 
-      if (proc.stdout) proc.stdout.on('data', (d) => { if (onData) onData(d); });
-      if (proc.stderr) proc.stderr.on('data', (d) => { if (onData) onData(d); });
+      let outputTail = '';
+      const captureOutput = (d) => {
+        const text = String(d);
+        outputTail = (outputTail + text).slice(-4000);
+        if (onData) onData(text);
+      };
+
+      if (proc.stdout) proc.stdout.on('data', captureOutput);
+      if (proc.stderr) proc.stderr.on('data', captureOutput);
 
       proc.on('error', (err) => reject(err));
       proc.on('close', (code) => {
@@ -443,7 +450,21 @@ class Installer {
           if (onData) onData(`\nDone! ${agentType} is now installed.\n`);
           resolve({ success: true, command: cmd });
         } else {
-          const msg = `Install failed with exit code ${code}`;
+          // A partial install can leave a placeholder stub at
+          // bin/<binary>.exe and npm-generated cmd-shims under
+          // node_modules/.bin/<name>{,.cmd,.ps1} that point to it. On
+          // Windows, anything that later tries to run the binary (a health
+          // check, a shell open) triggers a "this app can't run on your PC"
+          // dialog because the stub isn't a real PE executable. Sweep them
+          // up so the next install (or uninstall+reinstall) starts clean.
+          try {
+            this._cleanStaleShims(agentType);
+            this._cleanStubBinary(agentType);
+          } catch {}
+          const tail = outputTail.trim();
+          const msg = tail
+            ? `Install failed with exit code ${code}\nCommand: ${cmd}\n\n${tail}`
+            : `Install failed with exit code ${code}\nCommand: ${cmd}`;
           if (onData) onData(`\n${msg}\n`);
           reject(new Error(msg));
         }
@@ -451,6 +472,35 @@ class Installer {
     });
   }
 
+  /**
+   * Remove the placeholder bin/<binary>.exe (and the npm package directory
+   * if it's effectively empty) left over from a failed postinstall.
+   */
+  _cleanStubBinary(agentType) {
+    const entry = this.registry.getEntry(agentType);
+    const install = entry && entry.install;
+    if (!install) return;
+    const binary = install.binary || agentType;
+    const npmPkg = install.npm_package
+      || (() => {
+          const cmd = this._getInstallCommand(install);
+          if (!cmd || !cmd.includes('npm install')) return null;
+          const m = cmd.match(/npm install\s+(?:-g\s+)?(@?[\w-]+(?:\/[\w-]+)?)(?:@\S*)?$/);
+          return m ? m[1] : null;
+        })();
+    if (!npmPkg) return;
+
+    const prefix = getRuntimePrefix(agentType);
+    const pkgDir = path.join(prefix, 'node_modules', npmPkg);
+    const stubDir = path.join(pkgDir, 'bin');
+    for (const ext of ['', '.exe', '.cmd', '.ps1']) {
+      try {
+        const f = path.join(stubDir, binary + ext);
+        if (fs.existsSync(f) && fs.statSync(f).size < 4096) fs.unlinkSync(f);
+      } catch {}
+    }
+  }
+
   /**
    * Uninstall an agent runtime.
    * @returns {Promise<{success: boolean, output: string}>}
@@ -566,7 +616,7 @@ class Installer {
    */
   _getInstallCommand(installCfg) {
     const plat = Installer.platform();
-    return installCfg[plat] || installCfg.command || null;
+    return installCfg[plat] || installCfg.command || installCfg.npm || null;
   }
 
   /**
@@ -608,7 +658,14 @@ class Installer {
   _whichBinary(agentType) {
     const entry = this.registry.getEntry(agentType);
     const binary = entry && entry.install ? entry.install.binary : agentType;
-    return whichBinary(binary);
+    const aliases = entry && entry.install && Array.isArray(entry.install.binary_aliases)
+      ? entry.install.binary_aliases
+      : [];
+    for (const candidate of [binary, ...aliases]) {
+      const found = whichBinary(candidate);
+      if (found) return found;
+    }
+    return null;
   }
 
   // -- Markers --
@@ -680,28 +737,58 @@ class Installer {
     const extraDirs = [];
     try { extraDirs.push(path.dirname(process.execPath)); } catch {}
 
-    // Check for bundled Node.js in ~/.openagents/nodejs/
+    // Whether a usable `node` is already reachable WITHOUT the bundled
+    // standalone node.exe. We must avoid shadowing a working system node with
+    // the launcher's bundled exe: that file is an unsigned standalone
+    // node.exe and on some Windows machines Defender/SmartScreen blocks
+    // CreateProcess on it, which surfaces as `cmd: 拒绝访问` ("Access
+    // Denied") when npm runs `node install.cjs` for packages like
+    // @anthropic-ai/claude-code, plus a "this app can't run on your PC"
+    // dialog.
+    const bundledDir = path.join(this.configDir, 'nodejs');
+    const hasSystemNode = this._hasSystemNode(bundledDir);
+
     if (process.platform === 'win32') {
-      try {
-        const bundledDir = path.join(this.configDir, 'nodejs');
-        if (fs.existsSync(bundledDir)) {
-          // Node.js may be directly in nodejs/ (launcher symlink style) or in nodejs/node-v*/
-          if (fs.existsSync(path.join(bundledDir, 'node.exe'))) {
-            extraDirs.push(bundledDir);
-          }
-          const entries = fs.readdirSync(bundledDir).filter(e => e.startsWith('node-'));
-          if (entries.length > 0) {
-            extraDirs.push(path.join(bundledDir, entries[0]));
-          }
-        }
-      } catch {}
       const appData = env.APPDATA || '';
       if (appData) extraDirs.push(path.join(appData, 'npm'));
       extraDirs.push(env.ProgramFiles ? path.join(env.ProgramFiles, 'nodejs') : 'C:\\Program Files\\nodejs');
       extraDirs.push(env.SystemRoot ? path.join(env.SystemRoot, 'System32') : 'C:\\Windows\\System32');
       extraDirs.push(env.ProgramFiles ? path.join(env.ProgramFiles, 'Git', 'cmd') : 'C:\\Program Files\\Git\\cmd');
+
+      // Bundled node — fallback only. Skip if system node works, otherwise
+      // verify the bundled exe can actually launch before exposing it.
+      if (!hasSystemNode) {
+        try {
+          if (fs.existsSync(bundledDir)) {
+            const directExe = path.join(bundledDir, 'node.exe');
+            if (fs.existsSync(directExe) && this._canExecute(directExe)) {
+              extraDirs.unshift(bundledDir);
+            }
+            for (const entry of fs.readdirSync(bundledDir).filter(e => e.startsWith('node-'))) {
+              const nested = path.join(bundledDir, entry);
+              if (fs.existsSync(path.join(nested, 'node.exe')) && this._canExecute(path.join(nested, 'node.exe'))) {
+                extraDirs.unshift(nested);
+              }
+            }
+          }
+        } catch {}
+      }
     } else {
       extraDirs.push('/usr/local/bin', '/opt/homebrew/bin');
+      if (!hasSystemNode) {
+        try {
+          const candidates = [
+            path.join(bundledDir, 'bin', 'node'),
+            path.join(bundledDir, 'node'),
+          ];
+          for (const bin of candidates) {
+            if (fs.existsSync(bin) && this._canExecute(bin)) {
+              extraDirs.unshift(path.dirname(bin));
+              break;
+            }
+          }
+        } catch {}
+      }
     }
     for (const d of extraDirs) {
       if (d && !(env.PATH || '').includes(d)) {
@@ -711,6 +798,51 @@ class Installer {
     return env;
   }
 
+  /**
+   * True if `node` exists outside the bundled launcher directory. Uses raw
+   * process.env.PATH (no enhancement) so we don't accidentally detect the
+   * bundled node and conclude that "system node exists".
+   */
+  _hasSystemNode(bundledDir) {
+    try {
+      const { execFileSync } = require('child_process');
+      const cmd = process.platform === 'win32' ? 'where' : 'which';
+      const args = process.platform === 'win32' ? ['node'] : ['node'];
+      const out = execFileSync(cmd, args, {
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 5000,
+        windowsHide: true,
+        env: { ...process.env },
+      });
+      const prefix = (bundledDir || '').toLowerCase();
+      for (const line of out.split(/\r?\n/).map(s => s.trim()).filter(Boolean)) {
+        if (!prefix || !line.toLowerCase().startsWith(prefix)) return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Smoke-test a node binary by running `--version`. Returns false on any
+   * failure (missing exe, blocked by AV, arch mismatch, signature policy).
+   */
+  _canExecute(binaryPath) {
+    try {
+      const { spawnSync } = require('child_process');
+      const r = spawnSync(binaryPath, ['--version'], {
+        timeout: 5000,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+      return r.status === 0 && !r.error;
+    } catch {
+      return false;
+    }
+  }
+
   /**
    * Check if Node.js/npm is available on the system.
    */