@openchambery/web 2.1.7 → 2.1.8-beta.11

package/server/lib/config-sync/magpie.test.js

@@ -0,0 +1,265 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createMagpieSync } from './magpie.js';
+import { planOpenCodeConfigSync, planOpenCodeConfigSyncFromInventory } from './plan.js';
+import { applyConfigSyncPlan } from './engine.js';
+
+const dirs = [];
+const machine = async () => {
+  const home = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-magpie-test-'));
+  dirs.push(home);
+  return { home, options: {
+    homedir: () => home, tempdir: () => home, platform: 'linux', arch: 'x64',
+    env: { HOME: home, PATH: '', XDG_CONFIG_HOME: path.join(home, '.config') },
+  } };
+};
+const write = async (file, content = '{}') => {
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  await fs.writeFile(file, content);
+};
+afterEach(async () => { await Promise.all(dirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true }))); });
+
+describe('Magpie discovery and native transfer', () => {
+  it('hides config-only sources until Magpie is installed, without installing during preview', async () => {
+    const { home, options } = await machine();
+    const fetchImpl = vi.fn();
+    const sync = createMagpieSync({ ...options, fetchImpl });
+    expect(await sync.inventory()).toEqual({ available: false, installed: false });
+    await write(path.join(home, '.config', 'magpie', 'providers.json'));
+    expect(await sync.inventory()).toEqual({ available: false, installed: false });
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('resolves a symlinked client executable and its portable configuration', async () => {
+    const { home, options } = await machine();
+    const app = path.join(home, 'portable', 'magpie.app', 'Contents', 'MacOS', 'magpie');
+    await write(app, 'fixture-binary');
+    await write(path.join(home, 'portable', '.portable'), '');
+    await write(path.join(home, 'portable', 'data', 'providers.json'));
+    const link = path.join(home, 'magpie');
+    await fs.symlink(app, link);
+    const run = vi.fn(async () => 'magpie 0.1.0');
+    const sync = createMagpieSync({ ...options, env: { ...options.env, MAGPIE_BINARY: link }, run });
+    expect(await sync.inventory()).toEqual({ available: true, installed: true });
+    expect(run.mock.calls[0][0]).toBe(await fs.realpath(app));
+  });
+
+  it('exports noninteractively, installs a verified destination CLI and cleans temporary files', async () => {
+    const source = await machine();
+    const target = await machine();
+    const binary = path.join(source.home, '.local', 'bin', 'magpie');
+    await write(binary, 'fixture-cli');
+    await write(path.join(source.home, '.config', 'magpie', 'providers.json'));
+    const runSource = vi.fn(async (_binary, args, ctx) => {
+      if (args[0] === '--version') return 'magpie 0.1.0';
+      if (args[0] === 'accounts') return '[]';
+      expect(args[0]).toBe('backup');
+      expect(ctx.input).toMatch(/^[a-f0-9]{64}\n$/);
+      expect(args).not.toContain(ctx.input.trim());
+      await write(args[1], JSON.stringify({ format: 'magpie-backup', data: 'fixture-encrypted' }));
+      return 'saved';
+    });
+    const payload = await createMagpieSync({ ...source.options, run: runSource }).download();
+    const bytes = Buffer.from('fixture-installed-cli');
+    const fetchImpl = vi.fn(async (url) => url === 'https://usemagpie.ai/api/latest'
+      ? Response.json({ assets: { 'magpie-cli-linux-amd64': {
+        url: 'https://github.com/yetone/magpie-releases/releases/download/v0.1.0/magpie-cli-linux-amd64',
+        sha256: createHash('sha256').update(bytes).digest('hex'),
+      } } }) : new Response(bytes));
+    const runTarget = vi.fn(async (_binary, args, ctx) => {
+      if (args[0] === '--version') return 'magpie 0.1.0';
+      if (args[0] === 'accounts') return '[]';
+      expect(args[0]).toBe('restore');
+      expect(ctx.input.trim()).toBe(JSON.parse(payload).passphrase);
+      expect(JSON.parse(await fs.readFile(args[1], 'utf8')).format).toBe('magpie-backup');
+      await write(path.join(target.home, '.config', 'magpie', 'providers.json'), '{"providers":[]}');
+      return 'restored';
+    });
+    const destination = createMagpieSync({ ...target.options, fetchImpl, run: runTarget });
+    await expect(destination.import(payload)).resolves.toEqual({ ok: true });
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    expect(await fs.realpath(path.join(target.home, '.local/bin/magpie'))).toBe(await fs.realpath(path.join(target.home, '.config/openchamber/tools/magpie/magpie')));
+    await expect(destination.import(payload)).resolves.toEqual({ ok: true });
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    for (const item of [source, target]) {
+      expect((await fs.readdir(item.home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+    }
+  });
+
+  it('repairs a previously managed installation without downloading or overwriting a user command', async () => {
+    const { home, options } = await machine();
+    const managed = path.join(home, '.config/openchamber/tools/magpie/magpie');
+    const entry = path.join(home, '.local/bin/magpie');
+    const fetchImpl = vi.fn();
+    const run = vi.fn(async () => 'magpie 0.1.1319');
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    await sync.repairInstallation();
+    expect(run).not.toHaveBeenCalled();
+    await write(managed, 'fixture');
+    await sync.repairInstallation();
+    await sync.repairInstallation();
+    expect(await fs.realpath(entry)).toBe(await fs.realpath(managed));
+    await fs.unlink(entry);
+    await write(entry, 'user installation');
+    await sync.repairInstallation();
+    expect(await fs.readFile(entry, 'utf8')).toBe('user installation');
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('round-trips plugin accounts and Codex through v2 and verifies the final account inventory', async () => {
+    const source = await machine();
+    const target = await machine();
+    for (const item of [source, target]) await write(path.join(item.home, '.local/bin/magpie'), 'fixture');
+    const sourceDir = path.join(source.home, '.config/magpie');
+    const targetDir = path.join(target.home, '.config/magpie');
+    await write(path.join(sourceDir, 'providers.json'), '{"providers":[{"id":"astra"},{"id":"codex"}]}');
+    await write(path.join(sourceDir, 'plugin-auth.json'), JSON.stringify({ 'astra#one': { type: 'api', key: 'fixture-key' } }));
+    await write(path.join(sourceDir, 'logins.json'), JSON.stringify([
+      { agent: 'codex', user: 'fixture@example.invalid', auth: { tokens: { access_token: 'fixture-token' } } },
+    ]));
+    const payload = await createMagpieSync({ ...source.options, run: async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'accounts') return '[{"agent":"astra"},{"agent":"codex","user":"fixture@example.invalid"}]';
+      await write(args[1], '{"format":"magpie-backup"}');
+      return '';
+    } }).download();
+    expect(JSON.parse(payload).format).toBe('magpie-sync-v2');
+    await write(path.join(targetDir, 'plugin-auth.json'), '{"destination-only":{"type":"api","key":"keep"}}');
+    let recognized = true;
+    const run = vi.fn(async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'restore') {
+        await write(path.join(targetDir, 'providers.json'), await fs.readFile(path.join(sourceDir, 'providers.json')));
+        return 'not signed in on this computer';
+      }
+      if (args[1] === 'import') {
+        expect(args).not.toContain('fixture-token');
+        expect(JSON.parse(await fs.readFile(args[3], 'utf8')).tokens.access_token).toBe('fixture-token');
+        expect((await fs.stat(args[3])).mode & 0o777).toBe(0o600);
+        return '';
+      }
+      return JSON.stringify(recognized ? [{ agent: 'astra' }, { agent: 'codex', user: 'fixture@example.invalid' }] : []);
+    });
+    const sync = createMagpieSync({ ...target.options, run });
+    await expect(sync.import(payload)).resolves.toEqual({ ok: true });
+    await expect(sync.import(payload)).resolves.toEqual({ ok: true });
+    const stored = JSON.parse(await fs.readFile(path.join(targetDir, 'plugin-auth.json'), 'utf8'));
+    expect(Object.keys(stored)).toEqual(['destination-only', 'astra#one']);
+    recognized = false;
+    await expect(sync.import(payload)).rejects.toThrow('authorization sync or verification failed');
+    expect((await fs.readdir(target.home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+  });
+
+  it('rejects malformed v2 authorization before installing or restoring', async () => {
+    const { options } = await machine();
+    const run = vi.fn();
+    const fetchImpl = vi.fn();
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v2', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64'),
+      authorization: { plugins: {}, logins: [{ agent: 'codex', home: '/source/path', auth: {} }], incomplete: false } }));
+    await expect(createMagpieSync({ ...options, run, fetchImpl }).import(payload)).rejects.toThrow('Invalid Magpie sync payload');
+    expect(run).not.toHaveBeenCalled();
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('retries agent settings after authorizations instead of keeping a pre-login skip warning', async () => {
+    const { home, options } = await machine();
+    await write(path.join(home, '.local/bin/magpie'), 'fixture');
+    let restores = 0;
+    const run = async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'accounts') return '[]';
+      return ++restores === 1 ? 'Left as they are' : 'restored';
+    };
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v2', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64'),
+      authorization: { plugins: {}, logins: [], incomplete: false } }));
+    await expect(createMagpieSync({ ...options, run }).import(payload)).resolves.toEqual({ ok: true });
+    expect(restores).toBe(2);
+  });
+
+  it('does not install on malformed payload and refuses partial restore without leaking CLI output', async () => {
+    const { home, options } = await machine();
+    const fetchImpl = vi.fn();
+    const run = vi.fn(async (_binary, args) => args[0] === '--version'
+      ? 'magpie 0.1.0' : "Couldn't add the plugin private-fixture-value");
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    await expect(sync.import(Buffer.from('{}'))).rejects.toThrow('Invalid Magpie sync payload');
+    expect(fetchImpl).not.toHaveBeenCalled();
+    await write(path.join(home, '.local', 'bin', 'magpie'), 'fixture-cli');
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(sync.import(payload)).rejects.toThrow('Magpie restore partially completed');
+    expect((await fs.readdir(home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+  });
+
+  it('reports excluded sign-ins as a warning after a successful native restore', async () => {
+    const { home, options } = await machine();
+    await write(path.join(home, '.local', 'bin', 'magpie'), 'fixture-cli');
+    const run = async (_binary, args) => args[0] === '--version' ? 'magpie 0.1.1319'
+      : "restored providers: 0 added, 8 replaced\nThe backup's settings use these, not signed in on this computer (a backup carries settings, not sign-ins; to use one here: magpie accounts add <id>): private-fixture-account\n";
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(createMagpieSync({ ...options, run }).import(payload)).resolves.toEqual({
+      ok: true, magpieWarnings: ['sign_in_required'],
+    });
+  });
+
+  it('requires current source discovery and supports a Magpie-only plan', async () => {
+    const { home } = await machine();
+    const selections = { fileGroups: [], singleFiles: [], directories: [], agentsRoot: false, providerCredentials: false, magpie: true };
+    expect(() => planOpenCodeConfigSync(home, { selections })).toThrow('unavailable');
+    const plan = planOpenCodeConfigSync(home, { selections, magpie: { available: true, installed: true } });
+    expect(plan.magpie).toEqual({ bytes: 0 });
+    const received = [];
+    const executor = { prepare: vi.fn(), putTar: async (value) => received.push(value), finalize: vi.fn(async () => ({ magpieWarnings: ['sign_in_required'] })) };
+    const result = await applyConfigSyncPlan({ plan, executor, syncRunId: 'test', sourceHomedir: home, collectMagpie: async () => Buffer.from('fixture') });
+    expect(result.magpieWarnings).toEqual(['sign_in_required']);
+    expect(received).toEqual([{ kind: 'magpie', payload: Buffer.from('fixture') }]);
+    received.length = 0;
+    await applyConfigSyncPlan({ plan: { ...plan, files: [{ path: 'opencode.json' }] }, executor, syncRunId: 'ordered', sourceHomedir: home,
+      collectTar: async () => Buffer.from('config'), collectMagpie: async () => Buffer.from('fixture') });
+    expect(received.map((entry) => entry.kind)).toEqual(['magpie', 'config']);
+    const pull = planOpenCodeConfigSyncFromInventory({ files: [], directories: [], magpie: { available: true } }, { selections });
+    expect(pull.magpieAvailable).toBe(true);
+    expect(pull.magpie).toEqual({ bytes: 0 });
+  });
+
+  it('rejects a corrupt installer before executing or publishing it', async () => {
+    const { home, options } = await machine();
+    const run = vi.fn();
+    const fetchImpl = async (url) => url === 'https://usemagpie.ai/api/latest'
+      ? Response.json({ assets: { 'magpie-cli-linux-amd64': {
+        url: 'https://github.com/yetone/magpie-releases/releases/download/v0.1.0/magpie-cli-linux-amd64',
+        sha256: '0'.repeat(64),
+      } } }) : new Response('corrupt');
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(sync.import(payload)).rejects.toThrow('checksum mismatch');
+    expect(run).not.toHaveBeenCalled();
+    await expect(fs.stat(path.join(home, '.config', 'openchamber', 'tools', 'magpie', 'magpie'))).rejects.toThrow();
+  });
+
+  it.skipIf(!process.env.OPENCHAMBER_MAGPIE_TEST_BINARY)('round-trips isolated configuration with the installed real CLI', async () => {
+    const source = await machine();
+    const target = await machine();
+    for (const item of [source, target]) {
+      item.options.env = { ...item.options.env, MAGPIE_BINARY: process.env.OPENCHAMBER_MAGPIE_TEST_BINARY,
+        MAGPIE_NO_ACCOUNTS: '1', PATH: '/usr/bin:/bin', XDG_CACHE_HOME: path.join(item.home, '.cache') };
+      await write(path.join(item.home, '.config', 'magpie', 'settings.json'), JSON.stringify({ noAccountDiscovery: true, noStats: true, noUsageStats: true, noAutoUpdate: true }));
+    }
+    await write(path.join(source.home, '.config', 'magpie', 'providers.json'), JSON.stringify({ providers: [
+      { id: 'sync-fixture', name: 'Sync fixture', chat: 'https://provider.invalid/v1', key: 'fixture-not-a-real-key' },
+      { id: 'fixture-subscription' },
+    ] }));
+    const payload = await createMagpieSync(source.options).download();
+    const receipt = await createMagpieSync(target.options).import(payload);
+    expect(receipt).toEqual({ ok: true, magpieWarnings: ['sign_in_required'] });
+    const restored = JSON.parse(await fs.readFile(path.join(target.home, '.config', 'magpie', 'providers.json'), 'utf8'));
+    expect(restored.providers).toContainEqual(expect.objectContaining({ id: 'sync-fixture', key: 'fixture-not-a-real-key' }));
+  }, 60_000);
+});

package/server/lib/config-sync/plan.js

@@ -60,7 +60,7 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
 };
 
 /**
- * Pure planner: source-home allowlist + optional `~/.agents` + optional provider auth.json.
+ * Pure planner: source-home allowlist + optional `~/.agents` + provider credential metadata.
  * Plan is computed on the source side; executors run it on the target side.
  * `direction` is a first-class field (`push` today; `pull` reuses the same shape).
  *
@@ -70,7 +70,9 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
  *   syncRunId?: string,
  *   sourceTargetId?: string,
  *   targetId?: string,
- *   includeAuthFile?: boolean,
+ *   includeProviderCredentials?: boolean,
+ *   providerCredentials?: { bytes: number } | null,
+ *   magpie?: { available: boolean, installed: boolean },
  *   selections?: import('./selections.js').SyncSelections,
  * }} [options]
  * @returns {{
@@ -81,7 +83,7 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
  *   files: { path: string, bytes: number }[],
  *   directories: { path: string, fileCount: number, bytes: number }[],
  *   agentsRoot: { fileCount: number, bytes: number } | null,
- *   authFile: { bytes: number } | null,
+ *   providerCredentials: { bytes: number } | null,
  *   deletes: string[],
  *   totalBytes: number,
  *   selections?: import('./selections.js').SyncSelections,
@@ -93,15 +95,13 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
   if (!SYNC_DIRECTIONS.includes(direction)) {
     throw new Error(`Unsupported sync direction: ${String(direction)}`);
   }
-  // Credential transfer requires an explicit per-target grant (ticket 03).
-  // Callers that have not authorized the target pass includeAuthFile: false so
-  // auth.json is skipped rather than failing the whole sync.
+  // Credential values never enter the filesystem inventory or preview plan.
   const selections = options.selections
-    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    ? normalizeSyncSelections(options.selections, { includeProviderCredentials: options.selections.providerCredentials === true })
     : null;
-  const includeAuthFile = selections
-    ? selections.authFile === true
-    : options.includeAuthFile !== false;
+  const includeProviderCredentials = selections
+    ? selections.providerCredentials === true
+    : options.includeProviderCredentials !== false;
 
   const root = path.join(home, '.config', 'opencode');
   /** @type {{ path: string, bytes: number }[]} */
@@ -191,22 +191,9 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
   }
 
   /** @type {{ bytes: number } | null} */
-  let authFile = null;
-  if (includeAuthFile) {
-    const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
-    let authStat;
-    try {
-      // fs.stat follows symlinks (auth.json is sometimes a symlink).
-      authStat = fs.statSync(authAbs);
-    } catch {
-      authStat = null;
-    }
-    if (authStat?.isFile()) {
-      authFile = { bytes: authStat.size };
-      totalBytes += authStat.size;
-      // Single credential file — does not count against the 20000 file-count cap.
-    }
-  }
+  const providerCredentials = includeProviderCredentials && options.providerCredentials ? { bytes: options.providerCredentials.bytes } : null;
+  if (selections?.magpie && !options.magpie?.available) throw new Error('Magpie source configuration is unavailable');
+  if (providerCredentials) totalBytes += providerCredentials.bytes;
 
   if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
     throw new Error('OpenCode config sync exceeds size limit (512MB)');
@@ -222,7 +209,9 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
     files,
     directories,
     agentsRoot,
-    authFile,
+    providerCredentials,
+    magpieAvailable: options.magpie?.available === true,
+    magpie: options.selections?.magpie === true && options.magpie?.available === true ? { bytes: 0 } : null,
     deletes,
     totalBytes,
   };
@@ -237,7 +226,7 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
  *   syncRunId?: string,
  *   sourceTargetId?: string,
  *   targetId?: string,
- *   includeAuthFile?: boolean,
+ *   includeProviderCredentials?: boolean,
  *   selections?: import('./selections.js').SyncSelections,
  * }} [options]
  */
@@ -247,21 +236,25 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     throw new Error(`Unsupported sync direction: ${String(direction)}`);
   }
   const selections = options.selections
-    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    ? normalizeSyncSelections(options.selections, { includeProviderCredentials: options.selections.providerCredentials === true })
     : null;
-  const includeAuthFile = selections
-    ? selections.authFile === true
-    : options.includeAuthFile !== false;
+  const includeProviderCredentials = selections
+    ? selections.providerCredentials === true
+    : options.includeProviderCredentials !== false;
 
   const files = Array.isArray(inventory?.files) ? inventory.files.filter((entry) => entry?.path) : [];
+  if (selections?.magpie && !inventory?.magpie?.available) throw new Error('Magpie source configuration is unavailable');
+  if (includeProviderCredentials && !Object.hasOwn(inventory || {}, 'providerCredentials')) {
+    throw new Error('Provider credential inventory is missing');
+  }
   const directories = Array.isArray(inventory?.directories)
     ? inventory.directories.filter((entry) => entry?.path)
     : [];
   const agentsRoot = inventory?.agentsRoot && typeof inventory.agentsRoot === 'object'
     ? inventory.agentsRoot
     : null;
-  const authFile = includeAuthFile && inventory?.authFile && typeof inventory.authFile === 'object'
-    ? inventory.authFile
+  const providerCredentials = includeProviderCredentials && inventory?.providerCredentials && typeof inventory.providerCredentials === 'object'
+    ? inventory.providerCredentials
     : null;
 
   /** @type {string[]} */
@@ -293,8 +286,8 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     totalBytes += Number(agentsRoot.bytes) || 0;
     totalFileCount += Number(agentsRoot.fileCount) || 0;
   }
-  if (authFile) {
-    totalBytes += Number(authFile.bytes) || 0;
+  if (providerCredentials) {
+    totalBytes += Number(providerCredentials.bytes) || 0;
   }
   if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
     throw new Error('OpenCode config sync exceeds size limit (512MB)');
@@ -310,7 +303,9 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     files,
     directories,
     agentsRoot,
-    authFile,
+    providerCredentials,
+    magpieAvailable: inventory?.magpie?.available === true,
+    magpie: options.selections?.magpie === true && inventory?.magpie?.available === true ? { bytes: 0 } : null,
     deletes,
     totalBytes,
   };

package/server/lib/config-sync/receiver.js

@@ -1,11 +1,9 @@
 import fs from 'node:fs';
-import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
 import {
   OPENCODE_AGENTS_ROOT_PROBE_MARKER,
-  OPENCODE_AUTH_FILE_PROBE_MARKER,
   OPENCODE_CONFIG_SYNC_ALLOWLIST,
   OPENCODE_CONFIG_SYNC_MAX_BYTES,
   OPENCODE_CONFIG_SYNC_MAX_FILES,
@@ -18,6 +16,8 @@ import {
 import { walkAllowlistDirectory } from './plan.js';
 import { sanitizeSyncRunIdForPath } from './scripts.js';
 import { collectLocalTarBuffer } from './tar.js';
+import { createCredentialSync } from './credentials.js';
+import { createMagpieSync } from './magpie.js';
 
 /**
  * In-process receiver for HTTP config-sync (direct/relay hosts).
@@ -26,6 +26,8 @@ import { collectLocalTarBuffer } from './tar.js';
 export const createConfigSyncReceiver = (deps = {}) => {
   const {
     homedir = () => os.homedir(),
+    credentials = createCredentialSync(),
+    magpie = createMagpieSync({ homedir }),
   } = deps;
 
   let inflight = null;
@@ -58,7 +60,7 @@ export const createConfigSyncReceiver = (deps = {}) => {
     }
   };
 
-  const buildInventory = () => {
+  const buildInventory = async ({ includeCredentials = false } = {}) => {
     const home = homedir();
     const root = path.join(home, '.config', 'opencode');
     const files = [];
@@ -118,33 +120,22 @@ export const createConfigSyncReceiver = (deps = {}) => {
       // missing
     }
 
-    let authFile = null;
-    let remoteAuthFileExists = false;
-    try {
-      const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
-      const st = fs.statSync(authAbs);
-      if (st.isFile()) {
-        remoteAuthFileExists = true;
-        authFile = { bytes: st.size };
-      }
-    } catch {
-      // missing
-    }
+    const providerCredentials = includeCredentials ? await credentials.inventory() : null;
+    const remoteProviderCredentialsExists = Boolean(providerCredentials);
 
     return {
-      inventory: { files, directories, agentsRoot, authFile },
+      inventory: { files, directories, agentsRoot, providerCredentials, magpie: await magpie.inventory() },
       remoteExisting,
       remoteAgentsRootExists,
-      remoteAuthFileExists,
+      remoteProviderCredentialsExists,
       markers: {
         agentsRoot: OPENCODE_AGENTS_ROOT_PROBE_MARKER,
-        authFile: OPENCODE_AUTH_FILE_PROBE_MARKER,
       },
     };
   };
 
   const probe = async (plan) => {
-    const snapshot = buildInventory();
+    const snapshot = await buildInventory({ includeCredentials: plan?.selections?.providerCredentials === true || Boolean(plan?.providerCredentials) });
     const existing = new Set(snapshot.remoteExisting);
     const planPaths = [
       ...(Array.isArray(plan?.files) ? plan.files.map((entry) => entry.path) : []),
@@ -199,9 +190,13 @@ export const createConfigSyncReceiver = (deps = {}) => {
       await extractTarGzBuffer(buffer, path.join(home, '.config', 'opencode'));
     } else if (kind === 'agents') {
       await extractTarGzBuffer(buffer, home);
-    } else if (kind === 'auth') {
-      await fsp.mkdir(path.join(home, '.local', 'share', 'opencode'), { recursive: true });
-      await extractTarGzBuffer(buffer, path.join(home, '.local', 'share', 'opencode'));
+    } else if (kind === 'credentials') {
+      if (!flight.plan?.providerCredentials) throw new Error('Provider credentials were not selected');
+      await credentials.import(buffer);
+    } else if (kind === 'magpie') {
+      if (!flight.plan?.magpie) throw new Error('Magpie was not selected');
+      const result = await magpie.import(buffer);
+      flight.magpieWarnings = result.magpieWarnings;
     } else {
       const error = new Error(`Unsupported put kind: ${String(kind)}`);
       error.code = 'sync_invalid_kind';
@@ -220,7 +215,7 @@ export const createConfigSyncReceiver = (deps = {}) => {
   const download = async ({ kind }) => {
     const home = homedir();
     if (kind === 'config') {
-      const snapshot = buildInventory();
+      const snapshot = await buildInventory();
       const entries = [
         ...snapshot.inventory.files.map((entry) => entry.path),
         ...snapshot.inventory.directories.map((entry) => entry.path),
@@ -235,9 +230,10 @@ export const createConfigSyncReceiver = (deps = {}) => {
     if (kind === 'agents') {
       return collectTarGz(home, ['.agents']);
     }
-    if (kind === 'auth') {
-      return collectTarGz(path.join(home, '.local', 'share', 'opencode'), ['auth.json']);
+    if (kind === 'credentials') {
+      return credentials.download();
     }
+    if (kind === 'magpie') return magpie.download();
     const error = new Error(`Unsupported download kind: ${String(kind)}`);
     error.code = 'sync_invalid_kind';
     throw error;
@@ -245,12 +241,15 @@ export const createConfigSyncReceiver = (deps = {}) => {
 
   const finalize = async ({ syncRunId }) => {
     const flight = requireInflight(syncRunId);
+    if (flight.plan?.providerCredentials && !flight.kinds.has('credentials')) throw new Error('Provider credentials transfer incomplete');
+    if (flight.plan?.magpie && !flight.kinds.has('magpie')) throw new Error('Magpie transfer incomplete');
     await finalizeLocalSyncDestination(homedir(), { syncRunId: flight.syncRunId });
     const receipt = {
       ok: true,
       syncRunId: flight.syncRunId,
       kinds: [...flight.kinds],
       endedAt: new Date().toISOString(),
+      ...(flight.magpieWarnings?.length ? { magpieWarnings: flight.magpieWarnings } : {}),
     };
     clearInflight(syncRunId);
     return receipt;
@@ -274,5 +273,9 @@ export const createConfigSyncReceiver = (deps = {}) => {
     abort,
     getInflight: () => inflight,
     buildInventory,
+    credentialInventory: () => credentials.inventory(),
+    magpieInventory: () => magpie.inventory(),
+    importMagpie: async (stream) => magpie.import(await readStreamToBuffer(stream, { maxBytes: OPENCODE_CONFIG_SYNC_MAX_BYTES })),
+    importCredentials: async (stream) => credentials.import(await readStreamToBuffer(stream, { maxBytes: OPENCODE_CONFIG_SYNC_MAX_BYTES })),
   };
 };

package/server/lib/config-sync/routes.js

@@ -2,7 +2,7 @@ import { createConfigSyncReceiver } from './receiver.js';
 
 /**
  * Register HTTP config-sync receive/download routes for direct (and later relay) hosts.
- * Auth is the global `/api` UI/client-token gate. Selected kinds (including auth)
+ * Auth is the global `/api` UI/client-token gate. Selected kinds (including credentials)
  * sync when present in the plan — no extra credential grant checks.
  *
  * @param {import('express').Express} app
@@ -70,11 +70,32 @@ export const registerConfigSyncRoutes = (app, deps = {}) => {
     }
   });
 
+  app.get('/api/openchamber/config-sync/magpie/inventory', async (_req, res) => {
+    try { res.json({ magpie: await receiver.magpieInventory() }); }
+    catch (error) { sendError(res, error); }
+  });
+
+  app.put('/api/openchamber/config-sync/magpie', async (req, res) => {
+    try { res.json(await receiver.importMagpie(req)); }
+    catch (error) { sendError(res, error); }
+  });
+
+  app.get('/api/openchamber/config-sync/credentials/inventory', async (_req, res) => {
+    try { res.json({ providerCredentials: await receiver.credentialInventory() }); }
+    catch (error) { sendError(res, error); }
+  });
+
+  app.put('/api/openchamber/config-sync/credentials', async (req, res) => {
+    try { res.json(await receiver.importCredentials(req)); }
+    catch (error) { sendError(res, error); }
+  });
+
   app.get('/api/openchamber/config-sync/download/:kind', async (req, res) => {
     try {
       const kind = String(req.params.kind || '').trim();
       const buffer = await receiver.download({ kind });
-      res.setHeader('Content-Type', 'application/gzip');
+      res.setHeader('Content-Type', kind === 'credentials' || kind === 'magpie' ? 'application/octet-stream' : 'application/gzip');
+      res.setHeader('Cache-Control', 'no-store');
       res.setHeader('Content-Length', String(buffer.byteLength));
       res.send(buffer);
     } catch (error) {