@openchambery/web 2.1.7 → 2.1.8-beta.3

package/server/lib/config-sync/magpie.js

@@ -0,0 +1,207 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+
+const MAX_BYTES = 64 * 1024 * 1024;
+const CONFIG_FILES = ['providers.json', 'settings.json', 'profiles.json', 'library.json', 'plugins.json'];
+const exists = async (file) => {
+  try { return await fs.stat(file); }
+  catch (error) { if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return null; throw error; }
+};
+
+// Raw CLI output may contain provider names, paths or credentials. Never forward it.
+const runCli = (binary, args, { input = '', env, timeout = 600_000 } = {}) => new Promise((resolve, reject) => {
+  const child = spawn(binary, args, { env, windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] });
+  let output = '';
+  let exceeded = false;
+  const stop = () => {
+    exceeded = true;
+    try {
+      if (process.platform !== 'win32' && child.pid) process.kill(-child.pid, 'SIGKILL');
+      else child.kill('SIGKILL');
+    } catch { child.kill('SIGKILL'); }
+  };
+  const timer = setTimeout(stop, timeout);
+  const collect = (chunk) => {
+    if (output.length + chunk.length > 1024 * 1024) { stop(); return; }
+    output += chunk.toString();
+  };
+  child.stdout.on('data', collect);
+  child.stderr.on('data', collect);
+  child.stdin.on('error', () => {});
+  child.on('error', () => { clearTimeout(timer); reject(new Error('Unable to start Magpie CLI')); });
+  child.on('close', (code) => {
+    clearTimeout(timer);
+    if (code !== 0 || exceeded) reject(new Error('Magpie CLI operation failed or timed out'));
+    else resolve(output.replace(/\x1b\[[0-9;]*m/g, ''));
+  });
+  child.stdin.end(input);
+});
+
+/** Host-owned discovery and native backup/restore. No renderer-supplied paths or commands. */
+export function createMagpieSync({
+  homedir = os.homedir,
+  env = process.env,
+  platform = process.platform,
+  arch = process.arch,
+  fetchImpl = fetch,
+  run = runCli,
+  tempdir = os.tmpdir,
+} = {}) {
+  let installing = null;
+  let busy = false;
+  const home = () => homedir();
+  const configDir = () => path.join(env.XDG_CONFIG_HOME && path.isAbsolute(env.XDG_CONFIG_HOME)
+    ? env.XDG_CONFIG_HOME : path.join(home(), '.config'), 'magpie');
+  const managedBinary = () => path.join(env.OPENCHAMBER_DATA_DIR || path.join(home(), '.config', 'openchamber'),
+    'tools', 'magpie', platform === 'win32' ? 'magpie.exe' : 'magpie');
+  const hasConfig = async (dir) => {
+    for (const file of CONFIG_FILES) if ((await exists(path.join(dir, file)))?.isFile()) return true;
+    return false;
+  };
+
+  const locate = async () => {
+    const name = platform === 'win32' ? 'magpie.exe' : 'magpie';
+    const candidates = [
+      env.MAGPIE_BINARY,
+      ...(env.PATH || '').split(path.delimiter).filter(Boolean).map((dir) => path.join(dir, name)),
+      path.join(home(), '.local', 'bin', name),
+      ...(platform === 'darwin' ? [
+        '/Applications/magpie.app/Contents/MacOS/magpie',
+        path.join(home(), 'Applications', 'magpie.app', 'Contents', 'MacOS', 'magpie'),
+        '/opt/homebrew/bin/magpie', '/usr/local/bin/magpie',
+      ] : []),
+      ...(platform === 'win32' && env.LOCALAPPDATA ? [path.join(env.LOCALAPPDATA, 'Programs', 'magpie', name)] : []),
+      managedBinary(),
+    ].filter(Boolean);
+    for (const candidate of new Set(candidates)) {
+      if (!(await exists(candidate))?.isFile()) continue;
+      const binary = await fs.realpath(candidate);
+      const version = await run(binary, ['--version'], { env, timeout: 10_000 });
+      if (!/^magpie\s+\S+/m.test(version)) throw new Error('Invalid Magpie executable');
+      return binary;
+    }
+    return null;
+  };
+
+  const dataDir = async (binary) => {
+    if (!binary) return configDir();
+    let beside = path.dirname(binary);
+    if (path.basename(beside) === 'MacOS' && path.basename(path.dirname(beside)) === 'Contents') {
+      beside = path.dirname(path.dirname(path.dirname(beside)));
+    } else if (platform === 'linux' && env.APPIMAGE && env.APPDIR
+      && binary.startsWith(`${env.APPDIR}${path.sep}`)) beside = path.dirname(env.APPIMAGE);
+    const portable = path.join(beside, 'data');
+    if (await exists(path.join(beside, '.portable'))) return portable;
+    if (!(await exists(portable))?.isDirectory()) return configDir();
+    const shared = [home(), '/Applications', ...['Applications', 'Downloads', 'Desktop', 'Documents'].map((dir) => path.join(home(), dir))];
+    if (!shared.some((dir) => dir.toLowerCase() === beside.toLowerCase())) return portable;
+    return await hasConfig(portable) && !await hasConfig(configDir()) ? portable : configDir();
+  };
+
+  const inventory = async () => {
+    const binary = await locate();
+    return { available: await hasConfig(await dataDir(binary)), installed: Boolean(binary) };
+  };
+
+  const downloadBytes = async (url, limit) => {
+    const response = await fetchImpl(url, { signal: AbortSignal.timeout(120_000) });
+    if (!response.ok || !response.body) throw new Error('Unable to download Magpie CLI');
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      if (size > limit) throw new Error('Magpie download exceeds size limit');
+      chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+  };
+
+  const ensure = async () => {
+    const binary = await locate();
+    if (binary) return binary;
+    if (installing) return installing;
+    installing = (async () => {
+      const cpu = { x64: 'amd64', arm64: 'arm64' }[arch];
+      if (!cpu || !['darwin', 'linux', 'win32'].includes(platform)) throw new Error('Magpie CLI is not available for this platform');
+      const assetName = `magpie-cli-${platform === 'win32' ? 'windows' : platform}-${cpu}${platform === 'win32' ? '.exe' : ''}`;
+      let feed;
+      try { feed = JSON.parse((await downloadBytes('https://usemagpie.ai/api/latest', 2 * 1024 * 1024)).toString()); }
+      catch { throw new Error('Unable to read Magpie release metadata'); }
+      const asset = feed.assets?.[assetName];
+      if (!asset || !/^[a-f0-9]{64}$/i.test(asset.sha256 || '')
+        || typeof asset.url !== 'string' || !asset.url.startsWith('https://github.com/yetone/magpie-releases/releases/download/')) {
+        throw new Error('No verified Magpie CLI release for this platform');
+      }
+      const bytes = await downloadBytes(asset.url, 256 * 1024 * 1024);
+      if (createHash('sha256').update(bytes).digest('hex') !== asset.sha256.toLowerCase()) throw new Error('Magpie CLI checksum mismatch');
+      const target = managedBinary();
+      await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+      const staging = `${target}.${randomBytes(8).toString('hex')}${platform === 'win32' ? '.exe' : ''}`;
+      try {
+        await fs.writeFile(staging, bytes, { mode: 0o700, flag: 'wx' });
+        const version = await run(staging, ['--version'], { env, timeout: 10_000 });
+        if (!/^magpie\s+\S+/m.test(version)) throw new Error('Invalid downloaded Magpie CLI');
+        await fs.rename(staging, target);
+      } finally { await fs.rm(staging, { force: true }); }
+      return target;
+    })();
+    try { return await installing; }
+    finally { installing = null; }
+  };
+
+  const exclusive = async (work) => {
+    if (busy) throw new Error('Magpie sync already in progress');
+    busy = true;
+    try { return await work(); } finally { busy = false; }
+  };
+  const withTemp = async (work) => {
+    const dir = await fs.mkdtemp(path.join(tempdir(), 'openchamber-magpie-'));
+    try { return await work(path.join(dir, 'setup.magpie-backup')); }
+    finally { await fs.rm(dir, { recursive: true, force: true }); }
+  };
+
+  return {
+    inventory,
+    download: () => exclusive(async () => {
+      if (!(await inventory()).available) throw new Error('No Magpie configuration found on source');
+      const binary = await ensure();
+      const passphrase = randomBytes(32).toString('hex');
+      return withTemp(async (file) => {
+        await run(binary, ['backup', file], { env, input: `${passphrase}\n` });
+        const stat = await fs.stat(file);
+        if (stat.size > MAX_BYTES) throw new Error('Magpie backup exceeds size limit');
+        const backup = await fs.readFile(file);
+        return Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase, backup: backup.toString('base64') }));
+      });
+    }),
+    import: (payload) => exclusive(async () => {
+      let decoded;
+      let backup;
+      try {
+        if (payload.length > MAX_BYTES * 2) throw new Error();
+        decoded = JSON.parse(Buffer.from(payload).toString());
+        if (decoded.format !== 'magpie-sync-v1' || !/^[a-f0-9]{64}$/.test(decoded.passphrase)
+          || typeof decoded.backup !== 'string') throw new Error();
+        backup = Buffer.from(decoded.backup, 'base64');
+        if (!backup.length || backup.length > MAX_BYTES || JSON.parse(backup.toString()).format !== 'magpie-backup') throw new Error();
+      } catch { throw new Error('Invalid Magpie sync payload'); }
+      const binary = await ensure();
+      return withTemp(async (file) => {
+        await fs.writeFile(file, backup, { mode: 0o600, flag: 'wx' });
+        let output;
+        try { output = await run(binary, ['restore', file], { env, input: `${decoded.passphrase}\n` }); }
+        catch { throw new Error('Magpie restore failed; some configuration may already have been applied. Retry to finish.'); }
+        if (/Couldn't add the plugin/i.test(output)) throw new Error('Magpie restore partially completed: plugin installation failed. Check the target Magpie plugins.');
+        if (/Library:.*couldn't/i.test(output)) throw new Error('Magpie restore partially completed: library application failed. Check the target Magpie library.');
+        if (/Needs a key/i.test(output)) throw new Error('Magpie restore partially completed: some providers still require API keys.');
+        const magpieWarnings = [];
+        if (/not signed in on this computer/i.test(output)) magpieWarnings.push('sign_in_required');
+        if (/Left as they are/i.test(output)) magpieWarnings.push('agent_settings_skipped');
+        return { ok: true, ...(magpieWarnings.length ? { magpieWarnings } : {}) };
+      });
+    }),
+  };
+}

package/server/lib/config-sync/magpie.test.js

@@ -0,0 +1,165 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createMagpieSync } from './magpie.js';
+import { planOpenCodeConfigSync, planOpenCodeConfigSyncFromInventory } from './plan.js';
+import { applyConfigSyncPlan } from './engine.js';
+
+const dirs = [];
+const machine = async () => {
+  const home = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-magpie-test-'));
+  dirs.push(home);
+  return { home, options: {
+    homedir: () => home, tempdir: () => home, platform: 'linux', arch: 'x64',
+    env: { HOME: home, PATH: '', XDG_CONFIG_HOME: path.join(home, '.config') },
+  } };
+};
+const write = async (file, content = '{}') => {
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  await fs.writeFile(file, content);
+};
+afterEach(async () => { await Promise.all(dirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true }))); });
+
+describe('Magpie discovery and native transfer', () => {
+  it('discovers config-only sources through XDG without installing during preview', async () => {
+    const { home, options } = await machine();
+    const fetchImpl = vi.fn();
+    const sync = createMagpieSync({ ...options, fetchImpl });
+    expect(await sync.inventory()).toEqual({ available: false, installed: false });
+    await write(path.join(home, '.config', 'magpie', 'providers.json'));
+    expect(await sync.inventory()).toEqual({ available: true, installed: false });
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('resolves a symlinked client executable and its portable configuration', async () => {
+    const { home, options } = await machine();
+    const app = path.join(home, 'portable', 'magpie.app', 'Contents', 'MacOS', 'magpie');
+    await write(app, 'fixture-binary');
+    await write(path.join(home, 'portable', '.portable'), '');
+    await write(path.join(home, 'portable', 'data', 'providers.json'));
+    const link = path.join(home, 'magpie');
+    await fs.symlink(app, link);
+    const run = vi.fn(async () => 'magpie 0.1.0');
+    const sync = createMagpieSync({ ...options, env: { ...options.env, MAGPIE_BINARY: link }, run });
+    expect(await sync.inventory()).toEqual({ available: true, installed: true });
+    expect(run.mock.calls[0][0]).toBe(await fs.realpath(app));
+  });
+
+  it('exports noninteractively, installs a verified destination CLI and cleans temporary files', async () => {
+    const source = await machine();
+    const target = await machine();
+    const binary = path.join(source.home, '.local', 'bin', 'magpie');
+    await write(binary, 'fixture-cli');
+    await write(path.join(source.home, '.config', 'magpie', 'providers.json'));
+    const runSource = vi.fn(async (_binary, args, ctx) => {
+      if (args[0] === '--version') return 'magpie 0.1.0';
+      expect(args[0]).toBe('backup');
+      expect(ctx.input).toMatch(/^[a-f0-9]{64}\n$/);
+      expect(args).not.toContain(ctx.input.trim());
+      await write(args[1], JSON.stringify({ format: 'magpie-backup', data: 'fixture-encrypted' }));
+      return 'saved';
+    });
+    const payload = await createMagpieSync({ ...source.options, run: runSource }).download();
+    const bytes = Buffer.from('fixture-installed-cli');
+    const fetchImpl = vi.fn(async (url) => url === 'https://usemagpie.ai/api/latest'
+      ? Response.json({ assets: { 'magpie-cli-linux-amd64': {
+        url: 'https://github.com/yetone/magpie-releases/releases/download/v0.1.0/magpie-cli-linux-amd64',
+        sha256: createHash('sha256').update(bytes).digest('hex'),
+      } } }) : new Response(bytes));
+    const runTarget = vi.fn(async (_binary, args, ctx) => {
+      if (args[0] === '--version') return 'magpie 0.1.0';
+      expect(args[0]).toBe('restore');
+      expect(ctx.input.trim()).toBe(JSON.parse(payload).passphrase);
+      expect(JSON.parse(await fs.readFile(args[1], 'utf8')).format).toBe('magpie-backup');
+      return 'restored';
+    });
+    const destination = createMagpieSync({ ...target.options, fetchImpl, run: runTarget });
+    await expect(destination.import(payload)).resolves.toEqual({ ok: true });
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    await expect(destination.import(payload)).resolves.toEqual({ ok: true });
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+    for (const item of [source, target]) {
+      expect((await fs.readdir(item.home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+    }
+  });
+
+  it('does not install on malformed payload and refuses partial restore without leaking CLI output', async () => {
+    const { home, options } = await machine();
+    const fetchImpl = vi.fn();
+    const run = vi.fn(async (_binary, args) => args[0] === '--version'
+      ? 'magpie 0.1.0' : "Couldn't add the plugin private-fixture-value");
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    await expect(sync.import(Buffer.from('{}'))).rejects.toThrow('Invalid Magpie sync payload');
+    expect(fetchImpl).not.toHaveBeenCalled();
+    await write(path.join(home, '.local', 'bin', 'magpie'), 'fixture-cli');
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(sync.import(payload)).rejects.toThrow('Magpie restore partially completed');
+    expect((await fs.readdir(home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+  });
+
+  it('reports excluded sign-ins as a warning after a successful native restore', async () => {
+    const { home, options } = await machine();
+    await write(path.join(home, '.local', 'bin', 'magpie'), 'fixture-cli');
+    const run = async (_binary, args) => args[0] === '--version' ? 'magpie 0.1.1319'
+      : "restored providers: 0 added, 8 replaced\nThe backup's settings use these, not signed in on this computer (a backup carries settings, not sign-ins; to use one here: magpie accounts add <id>): private-fixture-account\n";
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(createMagpieSync({ ...options, run }).import(payload)).resolves.toEqual({
+      ok: true, magpieWarnings: ['sign_in_required'],
+    });
+  });
+
+  it('requires current source discovery and supports a Magpie-only plan', async () => {
+    const { home } = await machine();
+    const selections = { fileGroups: [], singleFiles: [], directories: [], agentsRoot: false, providerCredentials: false, magpie: true };
+    expect(() => planOpenCodeConfigSync(home, { selections })).toThrow('unavailable');
+    const plan = planOpenCodeConfigSync(home, { selections, magpie: { available: true, installed: true } });
+    expect(plan.magpie).toEqual({ bytes: 0 });
+    const received = [];
+    const executor = { prepare: vi.fn(), putTar: async (value) => received.push(value), finalize: vi.fn(async () => ({ magpieWarnings: ['sign_in_required'] })) };
+    const result = await applyConfigSyncPlan({ plan, executor, syncRunId: 'test', sourceHomedir: home, collectMagpie: async () => Buffer.from('fixture') });
+    expect(result.magpieWarnings).toEqual(['sign_in_required']);
+    expect(received).toEqual([{ kind: 'magpie', payload: Buffer.from('fixture') }]);
+    const pull = planOpenCodeConfigSyncFromInventory({ files: [], directories: [], magpie: { available: true } }, { selections });
+    expect(pull.magpieAvailable).toBe(true);
+    expect(pull.magpie).toEqual({ bytes: 0 });
+  });
+
+  it('rejects a corrupt installer before executing or publishing it', async () => {
+    const { home, options } = await machine();
+    const run = vi.fn();
+    const fetchImpl = async (url) => url === 'https://usemagpie.ai/api/latest'
+      ? Response.json({ assets: { 'magpie-cli-linux-amd64': {
+        url: 'https://github.com/yetone/magpie-releases/releases/download/v0.1.0/magpie-cli-linux-amd64',
+        sha256: '0'.repeat(64),
+      } } }) : new Response('corrupt');
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(sync.import(payload)).rejects.toThrow('checksum mismatch');
+    expect(run).not.toHaveBeenCalled();
+    await expect(fs.stat(path.join(home, '.config', 'openchamber', 'tools', 'magpie', 'magpie'))).rejects.toThrow();
+  });
+
+  it.skipIf(!process.env.OPENCHAMBER_MAGPIE_TEST_BINARY)('round-trips isolated configuration with the installed real CLI', async () => {
+    const source = await machine();
+    const target = await machine();
+    for (const item of [source, target]) {
+      item.options.env = { ...item.options.env, MAGPIE_BINARY: process.env.OPENCHAMBER_MAGPIE_TEST_BINARY,
+        MAGPIE_NO_ACCOUNTS: '1', PATH: '/usr/bin:/bin', XDG_CACHE_HOME: path.join(item.home, '.cache') };
+      await write(path.join(item.home, '.config', 'magpie', 'settings.json'), JSON.stringify({ noAccountDiscovery: true, noStats: true, noUsageStats: true, noAutoUpdate: true }));
+    }
+    await write(path.join(source.home, '.config', 'magpie', 'providers.json'), JSON.stringify({ providers: [
+      { id: 'sync-fixture', name: 'Sync fixture', chat: 'https://provider.invalid/v1', key: 'fixture-not-a-real-key' },
+      { id: 'fixture-subscription' },
+    ] }));
+    const payload = await createMagpieSync(source.options).download();
+    const receipt = await createMagpieSync(target.options).import(payload);
+    expect(receipt).toEqual({ ok: true, magpieWarnings: ['sign_in_required'] });
+    const restored = JSON.parse(await fs.readFile(path.join(target.home, '.config', 'magpie', 'providers.json'), 'utf8'));
+    expect(restored.providers).toContainEqual(expect.objectContaining({ id: 'sync-fixture', key: 'fixture-not-a-real-key' }));
+  }, 60_000);
+});

package/server/lib/config-sync/plan.js

@@ -60,7 +60,7 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
 };
 
 /**
- * Pure planner: source-home allowlist + optional `~/.agents` + optional provider auth.json.
+ * Pure planner: source-home allowlist + optional `~/.agents` + provider credential metadata.
  * Plan is computed on the source side; executors run it on the target side.
  * `direction` is a first-class field (`push` today; `pull` reuses the same shape).
  *
@@ -70,7 +70,9 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
  *   syncRunId?: string,
  *   sourceTargetId?: string,
  *   targetId?: string,
- *   includeAuthFile?: boolean,
+ *   includeProviderCredentials?: boolean,
+ *   providerCredentials?: { bytes: number } | null,
+ *   magpie?: { available: boolean, installed: boolean },
  *   selections?: import('./selections.js').SyncSelections,
  * }} [options]
  * @returns {{
@@ -81,7 +83,7 @@ export const walkAllowlistDirectory = (absPath, excludeNames, seenRealpaths) =>
  *   files: { path: string, bytes: number }[],
  *   directories: { path: string, fileCount: number, bytes: number }[],
  *   agentsRoot: { fileCount: number, bytes: number } | null,
- *   authFile: { bytes: number } | null,
+ *   providerCredentials: { bytes: number } | null,
  *   deletes: string[],
  *   totalBytes: number,
  *   selections?: import('./selections.js').SyncSelections,
@@ -93,15 +95,13 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
   if (!SYNC_DIRECTIONS.includes(direction)) {
     throw new Error(`Unsupported sync direction: ${String(direction)}`);
   }
-  // Credential transfer requires an explicit per-target grant (ticket 03).
-  // Callers that have not authorized the target pass includeAuthFile: false so
-  // auth.json is skipped rather than failing the whole sync.
+  // Credential values never enter the filesystem inventory or preview plan.
   const selections = options.selections
-    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    ? normalizeSyncSelections(options.selections, { includeProviderCredentials: options.selections.providerCredentials === true })
     : null;
-  const includeAuthFile = selections
-    ? selections.authFile === true
-    : options.includeAuthFile !== false;
+  const includeProviderCredentials = selections
+    ? selections.providerCredentials === true
+    : options.includeProviderCredentials !== false;
 
   const root = path.join(home, '.config', 'opencode');
   /** @type {{ path: string, bytes: number }[]} */
@@ -191,22 +191,9 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
   }
 
   /** @type {{ bytes: number } | null} */
-  let authFile = null;
-  if (includeAuthFile) {
-    const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
-    let authStat;
-    try {
-      // fs.stat follows symlinks (auth.json is sometimes a symlink).
-      authStat = fs.statSync(authAbs);
-    } catch {
-      authStat = null;
-    }
-    if (authStat?.isFile()) {
-      authFile = { bytes: authStat.size };
-      totalBytes += authStat.size;
-      // Single credential file — does not count against the 20000 file-count cap.
-    }
-  }
+  const providerCredentials = includeProviderCredentials && options.providerCredentials ? { bytes: options.providerCredentials.bytes } : null;
+  if (selections?.magpie && !options.magpie?.available) throw new Error('Magpie source configuration is unavailable');
+  if (providerCredentials) totalBytes += providerCredentials.bytes;
 
   if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
     throw new Error('OpenCode config sync exceeds size limit (512MB)');
@@ -222,7 +209,9 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
     files,
     directories,
     agentsRoot,
-    authFile,
+    providerCredentials,
+    magpieAvailable: options.magpie?.available === true,
+    magpie: options.selections?.magpie === true && options.magpie?.available === true ? { bytes: 0 } : null,
     deletes,
     totalBytes,
   };
@@ -237,7 +226,7 @@ export const planOpenCodeConfigSync = (sourceHomedir, options = {}) => {
  *   syncRunId?: string,
  *   sourceTargetId?: string,
  *   targetId?: string,
- *   includeAuthFile?: boolean,
+ *   includeProviderCredentials?: boolean,
  *   selections?: import('./selections.js').SyncSelections,
  * }} [options]
  */
@@ -247,21 +236,25 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     throw new Error(`Unsupported sync direction: ${String(direction)}`);
   }
   const selections = options.selections
-    ? normalizeSyncSelections(options.selections, { includeAuthFile: options.selections.authFile === true })
+    ? normalizeSyncSelections(options.selections, { includeProviderCredentials: options.selections.providerCredentials === true })
     : null;
-  const includeAuthFile = selections
-    ? selections.authFile === true
-    : options.includeAuthFile !== false;
+  const includeProviderCredentials = selections
+    ? selections.providerCredentials === true
+    : options.includeProviderCredentials !== false;
 
   const files = Array.isArray(inventory?.files) ? inventory.files.filter((entry) => entry?.path) : [];
+  if (selections?.magpie && !inventory?.magpie?.available) throw new Error('Magpie source configuration is unavailable');
+  if (includeProviderCredentials && !Object.hasOwn(inventory || {}, 'providerCredentials')) {
+    throw new Error('Provider credential inventory is missing');
+  }
   const directories = Array.isArray(inventory?.directories)
     ? inventory.directories.filter((entry) => entry?.path)
     : [];
   const agentsRoot = inventory?.agentsRoot && typeof inventory.agentsRoot === 'object'
     ? inventory.agentsRoot
     : null;
-  const authFile = includeAuthFile && inventory?.authFile && typeof inventory.authFile === 'object'
-    ? inventory.authFile
+  const providerCredentials = includeProviderCredentials && inventory?.providerCredentials && typeof inventory.providerCredentials === 'object'
+    ? inventory.providerCredentials
     : null;
 
   /** @type {string[]} */
@@ -293,8 +286,8 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     totalBytes += Number(agentsRoot.bytes) || 0;
     totalFileCount += Number(agentsRoot.fileCount) || 0;
   }
-  if (authFile) {
-    totalBytes += Number(authFile.bytes) || 0;
+  if (providerCredentials) {
+    totalBytes += Number(providerCredentials.bytes) || 0;
   }
   if (totalBytes > OPENCODE_CONFIG_SYNC_MAX_BYTES || totalFileCount > OPENCODE_CONFIG_SYNC_MAX_FILES) {
     throw new Error('OpenCode config sync exceeds size limit (512MB)');
@@ -310,7 +303,9 @@ export const planOpenCodeConfigSyncFromInventory = (inventory, options = {}) =>
     files,
     directories,
     agentsRoot,
-    authFile,
+    providerCredentials,
+    magpieAvailable: inventory?.magpie?.available === true,
+    magpie: options.selections?.magpie === true && inventory?.magpie?.available === true ? { bytes: 0 } : null,
     deletes,
     totalBytes,
   };

package/server/lib/config-sync/receiver.js

@@ -1,11 +1,9 @@
 import fs from 'node:fs';
-import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
 import {
   OPENCODE_AGENTS_ROOT_PROBE_MARKER,
-  OPENCODE_AUTH_FILE_PROBE_MARKER,
   OPENCODE_CONFIG_SYNC_ALLOWLIST,
   OPENCODE_CONFIG_SYNC_MAX_BYTES,
   OPENCODE_CONFIG_SYNC_MAX_FILES,
@@ -18,6 +16,8 @@ import {
 import { walkAllowlistDirectory } from './plan.js';
 import { sanitizeSyncRunIdForPath } from './scripts.js';
 import { collectLocalTarBuffer } from './tar.js';
+import { createCredentialSync } from './credentials.js';
+import { createMagpieSync } from './magpie.js';
 
 /**
  * In-process receiver for HTTP config-sync (direct/relay hosts).
@@ -26,6 +26,8 @@ import { collectLocalTarBuffer } from './tar.js';
 export const createConfigSyncReceiver = (deps = {}) => {
   const {
     homedir = () => os.homedir(),
+    credentials = createCredentialSync(),
+    magpie = createMagpieSync({ homedir }),
   } = deps;
 
   let inflight = null;
@@ -58,7 +60,7 @@ export const createConfigSyncReceiver = (deps = {}) => {
     }
   };
 
-  const buildInventory = () => {
+  const buildInventory = async ({ includeCredentials = false } = {}) => {
     const home = homedir();
     const root = path.join(home, '.config', 'opencode');
     const files = [];
@@ -118,33 +120,22 @@ export const createConfigSyncReceiver = (deps = {}) => {
       // missing
     }
 
-    let authFile = null;
-    let remoteAuthFileExists = false;
-    try {
-      const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
-      const st = fs.statSync(authAbs);
-      if (st.isFile()) {
-        remoteAuthFileExists = true;
-        authFile = { bytes: st.size };
-      }
-    } catch {
-      // missing
-    }
+    const providerCredentials = includeCredentials ? await credentials.inventory() : null;
+    const remoteProviderCredentialsExists = Boolean(providerCredentials);
 
     return {
-      inventory: { files, directories, agentsRoot, authFile },
+      inventory: { files, directories, agentsRoot, providerCredentials, magpie: await magpie.inventory() },
       remoteExisting,
       remoteAgentsRootExists,
-      remoteAuthFileExists,
+      remoteProviderCredentialsExists,
       markers: {
         agentsRoot: OPENCODE_AGENTS_ROOT_PROBE_MARKER,
-        authFile: OPENCODE_AUTH_FILE_PROBE_MARKER,
       },
     };
   };
 
   const probe = async (plan) => {
-    const snapshot = buildInventory();
+    const snapshot = await buildInventory({ includeCredentials: plan?.selections?.providerCredentials === true || Boolean(plan?.providerCredentials) });
     const existing = new Set(snapshot.remoteExisting);
     const planPaths = [
       ...(Array.isArray(plan?.files) ? plan.files.map((entry) => entry.path) : []),
@@ -199,9 +190,13 @@ export const createConfigSyncReceiver = (deps = {}) => {
       await extractTarGzBuffer(buffer, path.join(home, '.config', 'opencode'));
     } else if (kind === 'agents') {
       await extractTarGzBuffer(buffer, home);
-    } else if (kind === 'auth') {
-      await fsp.mkdir(path.join(home, '.local', 'share', 'opencode'), { recursive: true });
-      await extractTarGzBuffer(buffer, path.join(home, '.local', 'share', 'opencode'));
+    } else if (kind === 'credentials') {
+      if (!flight.plan?.providerCredentials) throw new Error('Provider credentials were not selected');
+      await credentials.import(buffer);
+    } else if (kind === 'magpie') {
+      if (!flight.plan?.magpie) throw new Error('Magpie was not selected');
+      const result = await magpie.import(buffer);
+      flight.magpieWarnings = result.magpieWarnings;
     } else {
       const error = new Error(`Unsupported put kind: ${String(kind)}`);
       error.code = 'sync_invalid_kind';
@@ -220,7 +215,7 @@ export const createConfigSyncReceiver = (deps = {}) => {
   const download = async ({ kind }) => {
     const home = homedir();
     if (kind === 'config') {
-      const snapshot = buildInventory();
+      const snapshot = await buildInventory();
       const entries = [
         ...snapshot.inventory.files.map((entry) => entry.path),
         ...snapshot.inventory.directories.map((entry) => entry.path),
@@ -235,9 +230,10 @@ export const createConfigSyncReceiver = (deps = {}) => {
     if (kind === 'agents') {
       return collectTarGz(home, ['.agents']);
     }
-    if (kind === 'auth') {
-      return collectTarGz(path.join(home, '.local', 'share', 'opencode'), ['auth.json']);
+    if (kind === 'credentials') {
+      return credentials.download();
     }
+    if (kind === 'magpie') return magpie.download();
     const error = new Error(`Unsupported download kind: ${String(kind)}`);
     error.code = 'sync_invalid_kind';
     throw error;
@@ -245,12 +241,15 @@ export const createConfigSyncReceiver = (deps = {}) => {
 
   const finalize = async ({ syncRunId }) => {
     const flight = requireInflight(syncRunId);
+    if (flight.plan?.providerCredentials && !flight.kinds.has('credentials')) throw new Error('Provider credentials transfer incomplete');
+    if (flight.plan?.magpie && !flight.kinds.has('magpie')) throw new Error('Magpie transfer incomplete');
     await finalizeLocalSyncDestination(homedir(), { syncRunId: flight.syncRunId });
     const receipt = {
       ok: true,
       syncRunId: flight.syncRunId,
       kinds: [...flight.kinds],
       endedAt: new Date().toISOString(),
+      ...(flight.magpieWarnings?.length ? { magpieWarnings: flight.magpieWarnings } : {}),
     };
     clearInflight(syncRunId);
     return receipt;
@@ -274,5 +273,9 @@ export const createConfigSyncReceiver = (deps = {}) => {
     abort,
     getInflight: () => inflight,
     buildInventory,
+    credentialInventory: () => credentials.inventory(),
+    magpieInventory: () => magpie.inventory(),
+    importMagpie: async (stream) => magpie.import(await readStreamToBuffer(stream, { maxBytes: OPENCODE_CONFIG_SYNC_MAX_BYTES })),
+    importCredentials: async (stream) => credentials.import(await readStreamToBuffer(stream, { maxBytes: OPENCODE_CONFIG_SYNC_MAX_BYTES })),
   };
 };