@openchambery/web 2.1.8-beta.2 → 2.1.8-beta.4

package/server/lib/config-sync/magpie.test.js

@@ -23,13 +23,13 @@ const write = async (file, content = '{}') => {
 afterEach(async () => { await Promise.all(dirs.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true }))); });
 
 describe('Magpie discovery and native transfer', () => {
-  it('discovers config-only sources through XDG without installing during preview', async () => {
+  it('hides config-only sources until Magpie is installed, without installing during preview', async () => {
     const { home, options } = await machine();
     const fetchImpl = vi.fn();
     const sync = createMagpieSync({ ...options, fetchImpl });
     expect(await sync.inventory()).toEqual({ available: false, installed: false });
     await write(path.join(home, '.config', 'magpie', 'providers.json'));
-    expect(await sync.inventory()).toEqual({ available: true, installed: false });
+    expect(await sync.inventory()).toEqual({ available: false, installed: false });
     expect(fetchImpl).not.toHaveBeenCalled();
   });
 
@@ -55,6 +55,7 @@ describe('Magpie discovery and native transfer', () => {
     await write(path.join(source.home, '.config', 'magpie', 'providers.json'));
     const runSource = vi.fn(async (_binary, args, ctx) => {
       if (args[0] === '--version') return 'magpie 0.1.0';
+      if (args[0] === 'accounts') return '[]';
       expect(args[0]).toBe('backup');
       expect(ctx.input).toMatch(/^[a-f0-9]{64}\n$/);
       expect(args).not.toContain(ctx.input.trim());
@@ -70,14 +71,17 @@ describe('Magpie discovery and native transfer', () => {
       } } }) : new Response(bytes));
     const runTarget = vi.fn(async (_binary, args, ctx) => {
       if (args[0] === '--version') return 'magpie 0.1.0';
+      if (args[0] === 'accounts') return '[]';
       expect(args[0]).toBe('restore');
       expect(ctx.input.trim()).toBe(JSON.parse(payload).passphrase);
       expect(JSON.parse(await fs.readFile(args[1], 'utf8')).format).toBe('magpie-backup');
+      await write(path.join(target.home, '.config', 'magpie', 'providers.json'), '{"providers":[]}');
       return 'restored';
     });
     const destination = createMagpieSync({ ...target.options, fetchImpl, run: runTarget });
     await expect(destination.import(payload)).resolves.toEqual({ ok: true });
     expect(fetchImpl).toHaveBeenCalledTimes(2);
+    expect(await fs.realpath(path.join(target.home, '.local/bin/magpie'))).toBe(await fs.realpath(path.join(target.home, '.config/openchamber/tools/magpie/magpie')));
     await expect(destination.import(payload)).resolves.toEqual({ ok: true });
     expect(fetchImpl).toHaveBeenCalledTimes(2);
     for (const item of [source, target]) {
@@ -85,6 +89,98 @@ describe('Magpie discovery and native transfer', () => {
     }
   });
 
+  it('repairs a previously managed installation without downloading or overwriting a user command', async () => {
+    const { home, options } = await machine();
+    const managed = path.join(home, '.config/openchamber/tools/magpie/magpie');
+    const entry = path.join(home, '.local/bin/magpie');
+    const fetchImpl = vi.fn();
+    const run = vi.fn(async () => 'magpie 0.1.1319');
+    const sync = createMagpieSync({ ...options, fetchImpl, run });
+    await sync.repairInstallation();
+    expect(run).not.toHaveBeenCalled();
+    await write(managed, 'fixture');
+    await sync.repairInstallation();
+    await sync.repairInstallation();
+    expect(await fs.realpath(entry)).toBe(await fs.realpath(managed));
+    await fs.unlink(entry);
+    await write(entry, 'user installation');
+    await sync.repairInstallation();
+    expect(await fs.readFile(entry, 'utf8')).toBe('user installation');
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('round-trips plugin accounts and Codex through v2 and verifies the final account inventory', async () => {
+    const source = await machine();
+    const target = await machine();
+    for (const item of [source, target]) await write(path.join(item.home, '.local/bin/magpie'), 'fixture');
+    const sourceDir = path.join(source.home, '.config/magpie');
+    const targetDir = path.join(target.home, '.config/magpie');
+    await write(path.join(sourceDir, 'providers.json'), '{"providers":[{"id":"astra"},{"id":"codex"}]}');
+    await write(path.join(sourceDir, 'plugin-auth.json'), JSON.stringify({ 'astra#one': { type: 'api', key: 'fixture-key' } }));
+    await write(path.join(sourceDir, 'logins.json'), JSON.stringify([
+      { agent: 'codex', user: 'fixture@example.invalid', auth: { tokens: { access_token: 'fixture-token' } } },
+    ]));
+    const payload = await createMagpieSync({ ...source.options, run: async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'accounts') return '[{"agent":"astra"},{"agent":"codex","user":"fixture@example.invalid"}]';
+      await write(args[1], '{"format":"magpie-backup"}');
+      return '';
+    } }).download();
+    expect(JSON.parse(payload).format).toBe('magpie-sync-v2');
+    await write(path.join(targetDir, 'plugin-auth.json'), '{"destination-only":{"type":"api","key":"keep"}}');
+    let recognized = true;
+    const run = vi.fn(async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'restore') {
+        await write(path.join(targetDir, 'providers.json'), await fs.readFile(path.join(sourceDir, 'providers.json')));
+        return 'not signed in on this computer';
+      }
+      if (args[1] === 'import') {
+        expect(args).not.toContain('fixture-token');
+        expect(JSON.parse(await fs.readFile(args[3], 'utf8')).tokens.access_token).toBe('fixture-token');
+        expect((await fs.stat(args[3])).mode & 0o777).toBe(0o600);
+        return '';
+      }
+      return JSON.stringify(recognized ? [{ agent: 'astra' }, { agent: 'codex', user: 'fixture@example.invalid' }] : []);
+    });
+    const sync = createMagpieSync({ ...target.options, run });
+    await expect(sync.import(payload)).resolves.toEqual({ ok: true });
+    await expect(sync.import(payload)).resolves.toEqual({ ok: true });
+    const stored = JSON.parse(await fs.readFile(path.join(targetDir, 'plugin-auth.json'), 'utf8'));
+    expect(Object.keys(stored)).toEqual(['destination-only', 'astra#one']);
+    recognized = false;
+    await expect(sync.import(payload)).rejects.toThrow('authorization sync or verification failed');
+    expect((await fs.readdir(target.home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
+  });
+
+  it('rejects malformed v2 authorization before installing or restoring', async () => {
+    const { options } = await machine();
+    const run = vi.fn();
+    const fetchImpl = vi.fn();
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v2', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64'),
+      authorization: { plugins: {}, logins: [{ agent: 'codex', home: '/source/path', auth: {} }], incomplete: false } }));
+    await expect(createMagpieSync({ ...options, run, fetchImpl }).import(payload)).rejects.toThrow('Invalid Magpie sync payload');
+    expect(run).not.toHaveBeenCalled();
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('retries agent settings after authorizations instead of keeping a pre-login skip warning', async () => {
+    const { home, options } = await machine();
+    await write(path.join(home, '.local/bin/magpie'), 'fixture');
+    let restores = 0;
+    const run = async (_binary, args) => {
+      if (args[0] === '--version') return 'magpie 0.1.1319';
+      if (args[0] === 'accounts') return '[]';
+      return ++restores === 1 ? 'Left as they are' : 'restored';
+    };
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v2', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64'),
+      authorization: { plugins: {}, logins: [], incomplete: false } }));
+    await expect(createMagpieSync({ ...options, run }).import(payload)).resolves.toEqual({ ok: true });
+    expect(restores).toBe(2);
+  });
+
   it('does not install on malformed payload and refuses partial restore without leaking CLI output', async () => {
     const { home, options } = await machine();
     const fetchImpl = vi.fn();
@@ -100,6 +196,18 @@ describe('Magpie discovery and native transfer', () => {
     expect((await fs.readdir(home)).filter((name) => name.startsWith('openchamber-magpie-'))).toEqual([]);
   });
 
+  it('reports excluded sign-ins as a warning after a successful native restore', async () => {
+    const { home, options } = await machine();
+    await write(path.join(home, '.local', 'bin', 'magpie'), 'fixture-cli');
+    const run = async (_binary, args) => args[0] === '--version' ? 'magpie 0.1.1319'
+      : "restored providers: 0 added, 8 replaced\nThe backup's settings use these, not signed in on this computer (a backup carries settings, not sign-ins; to use one here: magpie accounts add <id>): private-fixture-account\n";
+    const payload = Buffer.from(JSON.stringify({ format: 'magpie-sync-v1', passphrase: 'a'.repeat(64),
+      backup: Buffer.from('{"format":"magpie-backup"}').toString('base64') }));
+    await expect(createMagpieSync({ ...options, run }).import(payload)).resolves.toEqual({
+      ok: true, magpieWarnings: ['sign_in_required'],
+    });
+  });
+
   it('requires current source discovery and supports a Magpie-only plan', async () => {
     const { home } = await machine();
     const selections = { fileGroups: [], singleFiles: [], directories: [], agentsRoot: false, providerCredentials: false, magpie: true };
@@ -107,9 +215,14 @@ describe('Magpie discovery and native transfer', () => {
     const plan = planOpenCodeConfigSync(home, { selections, magpie: { available: true, installed: true } });
     expect(plan.magpie).toEqual({ bytes: 0 });
     const received = [];
-    const executor = { prepare: vi.fn(), putTar: async (value) => received.push(value), finalize: vi.fn() };
-    await applyConfigSyncPlan({ plan, executor, syncRunId: 'test', sourceHomedir: home, collectMagpie: async () => Buffer.from('fixture') });
+    const executor = { prepare: vi.fn(), putTar: async (value) => received.push(value), finalize: vi.fn(async () => ({ magpieWarnings: ['sign_in_required'] })) };
+    const result = await applyConfigSyncPlan({ plan, executor, syncRunId: 'test', sourceHomedir: home, collectMagpie: async () => Buffer.from('fixture') });
+    expect(result.magpieWarnings).toEqual(['sign_in_required']);
     expect(received).toEqual([{ kind: 'magpie', payload: Buffer.from('fixture') }]);
+    received.length = 0;
+    await applyConfigSyncPlan({ plan: { ...plan, files: [{ path: 'opencode.json' }] }, executor, syncRunId: 'ordered', sourceHomedir: home,
+      collectTar: async () => Buffer.from('config'), collectMagpie: async () => Buffer.from('fixture') });
+    expect(received.map((entry) => entry.kind)).toEqual(['magpie', 'config']);
     const pull = planOpenCodeConfigSyncFromInventory({ files: [], directories: [], magpie: { available: true } }, { selections });
     expect(pull.magpieAvailable).toBe(true);
     expect(pull.magpie).toEqual({ bytes: 0 });
@@ -141,9 +254,11 @@ describe('Magpie discovery and native transfer', () => {
     }
     await write(path.join(source.home, '.config', 'magpie', 'providers.json'), JSON.stringify({ providers: [
       { id: 'sync-fixture', name: 'Sync fixture', chat: 'https://provider.invalid/v1', key: 'fixture-not-a-real-key' },
+      { id: 'fixture-subscription' },
     ] }));
     const payload = await createMagpieSync(source.options).download();
-    await createMagpieSync(target.options).import(payload);
+    const receipt = await createMagpieSync(target.options).import(payload);
+    expect(receipt).toEqual({ ok: true, magpieWarnings: ['sign_in_required'] });
     const restored = JSON.parse(await fs.readFile(path.join(target.home, '.config', 'magpie', 'providers.json'), 'utf8'));
     expect(restored.providers).toContainEqual(expect.objectContaining({ id: 'sync-fixture', key: 'fixture-not-a-real-key' }));
   }, 60_000);

package/server/lib/config-sync/receiver.js

@@ -195,7 +195,8 @@ export const createConfigSyncReceiver = (deps = {}) => {
       await credentials.import(buffer);
     } else if (kind === 'magpie') {
       if (!flight.plan?.magpie) throw new Error('Magpie was not selected');
-      await magpie.import(buffer);
+      const result = await magpie.import(buffer);
+      flight.magpieWarnings = result.magpieWarnings;
     } else {
       const error = new Error(`Unsupported put kind: ${String(kind)}`);
       error.code = 'sync_invalid_kind';
@@ -248,6 +249,7 @@ export const createConfigSyncReceiver = (deps = {}) => {
       syncRunId: flight.syncRunId,
       kinds: [...flight.kinds],
       endedAt: new Date().toISOString(),
+      ...(flight.magpieWarnings?.length ? { magpieWarnings: flight.magpieWarnings } : {}),
     };
     clearInflight(syncRunId);
     return receipt;

package/server/lib/config-sync/routes.test.js

@@ -52,7 +52,7 @@ describe('config-sync HTTP routes', () => {
     const { app } = await createApp(undefined, {
       inventory: async () => ({ available: true, installed: false }),
       download: async () => payload,
-      import: async (buffer) => { received.push(buffer); return { ok: true }; },
+      import: async (buffer) => { received.push(buffer); return { ok: true, magpieWarnings: ['sign_in_required'] }; },
     });
     const probe = await request(app).post('/api/openchamber/config-sync/probe').send({ plan: {} });
     expect(probe.body.inventory.magpie).toEqual({ available: true, installed: false });
@@ -67,7 +67,8 @@ describe('config-sync HTTP routes', () => {
     await request(app).post('/api/openchamber/config-sync/finalize').send({ syncRunId: 'magpie-run' }).expect(500);
     await request(app).put('/api/openchamber/config-sync/put/magpie?syncRunId=magpie-run')
       .set('Content-Type', 'application/octet-stream').send(payload).expect(200);
-    await request(app).post('/api/openchamber/config-sync/finalize').send({ syncRunId: 'magpie-run' }).expect(200);
+    const receipt = await request(app).post('/api/openchamber/config-sync/finalize').send({ syncRunId: 'magpie-run' }).expect(200);
+    expect(receipt.body.magpieWarnings).toEqual(['sign_in_required']);
     expect(received).toEqual([payload, payload]);
   });
 

package/server/lib/opencode/DOCUMENTATION.md

@@ -27,6 +27,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/cli-entry-runtime.js`: CLI entrypoint runtime that detects direct execution, forces `OPENCHAMBER_RUNTIME=web` unless already `ssh-remote` (so `dev:server` cannot inherit a leftover desktop env and host a relay, while SSH-managed remotes may), parses CLI options, and starts server bootstrap.
 - `packages/web/server/lib/opencode/routes.js`: OpenCode/provider settings and auth-related route registration.
 - `packages/web/server/lib/opencode/lifecycle.js`: OpenCode process lifecycle runtime (startup, restart, readiness, health monitoring). Managed child env inherits the user shell environment unchanged; experimental flags such as `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` follow the user's own environment and are never injected by OpenChamber.
+  - Before shared-service/private startup, config-sync's Magpie adapter repairs the discoverable command entry for an existing OpenChamber-managed Magpie CLI. No download occurs at startup. Errors remain explicit rather than starting OpenCode with an undiscoverable managed dependency. External services are not modified.
 - `packages/web/server/lib/opencode/v1-migration-gate.js`: pure V1→v2 migration admission gate (`GET /api/experimental/migration/v1` → whether transcript may be fetched).
 - `packages/web/server/lib/opencode/managed-capabilities-runtime.js`: managed-child scheduled-task resources, config injection, rotating bridge identity, and bridge authorization.
 - `packages/web/server/lib/opencode/env-runtime.js`: OpenCode CLI/binary resolution and shell environment runtime.

package/server/lib/opencode/lifecycle.js

@@ -6,6 +6,7 @@ import { readOpenCode2BinaryVersion } from './ensure-cli.js';
 import { createRevokedRuntimeContract, evaluateRuntimeContract } from './runtime-contract.js';
 import { OPENCODE_V1_MIGRATION_PATH, fetchV1MigrationGate } from './v1-migration-gate.js';
 import { isProcessAlive } from './shared-service.js';
+import { createMagpieSync } from '../config-sync/magpie.js';
 
 const parsePositiveInt = (value, fallback) => {
   const parsed = Number.parseInt(String(value ?? ''), 10);
@@ -71,6 +72,7 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
     buildAugmentedPath,
     buildManagedOpenCodePath,
     getManagedOpenCodeShellEnvSnapshot,
+    prepareMagpieInstallation = () => createMagpieSync().repairInstallation(),
     managedCapabilitiesRuntime = null,
     getActiveSessionCount = () => 0,
     // Official background service (shared-service.js). null keeps the private
@@ -691,6 +693,7 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
    * or the registration is missing/malformed; the caller decides rollback.
    */
   const connectSharedOpenCodeService = async ({ binaryPath } = {}) => {
+    await prepareMagpieInstallation();
     if (!binaryPath) {
       await applyOpencodeBinaryFromSettings({ strict: true });
       if (typeof ensurePinnedOpenCode2CliEnv === 'function') {
@@ -793,6 +796,7 @@ export const createOpenCodeLifecycleRuntime = (deps) => {
   const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
   const startOpenCodeOnce = async () => {
+    await prepareMagpieInstallation();
     // New managed instance — drop any prior permit before spawn/probes.
     const generationAtStart = revokeRuntimeExecutionPermit('managed-start');
     const requestedPort = env.ENV_CONFIGURED_OPENCODE_PORT;

package/server/lib/opencode/lifecycle.test.js

@@ -101,6 +101,7 @@ const createRuntime = (overrides = {}, stateRef = null) => {
     normalizeApiPrefix: vi.fn(() => ''),
     applyOpencodeBinaryFromSettings: vi.fn(async () => null),
     ensureOpencodeCliEnv: vi.fn(),
+    prepareMagpieInstallation: vi.fn(async () => {}),
     ensureLocalOpenCodeServerPassword: vi.fn(async () => 'password'),
     resolveManagedOpenCodeLaunchSpec: vi.fn((binary) => ({ binary, args: [], wrapperType: null })),
     setOpenCodePort: vi.fn((port) => {
@@ -195,14 +196,16 @@ describe('OpenCode lifecycle', () => {
   it('launches managed OpenCode with the managed PATH', async () => {
     delete process.env.OPENCODE_BINARY;
     const child = createMockChild();
+    const prepareMagpieInstallation = vi.fn(async () => {});
     spawnMock.mockImplementationOnce(() => {
+      expect(prepareMagpieInstallation).toHaveBeenCalledTimes(1);
       queueMicrotask(() => {
         child.stdout.emit('data', 'opencode server listening on http://127.0.0.1:45678\n');
       });
       return child;
     });
 
-    const runtime = createRuntime();
+    const runtime = createRuntime({ prepareMagpieInstallation });
     const server = await runtime.startOpenCode();
     const [binary, args, options] = spawnMock.mock.calls[0];
 
@@ -1100,13 +1103,15 @@ describe('shared official OpenCode service', () => {
     const sharedService = createSharedService();
     const adoptOpenCodeServerPassword = vi.fn();
     const stateRef = {};
-    const runtime = createRuntime({ env: UNCONFIGURED_ENV, sharedService, adoptOpenCodeServerPassword }, stateRef);
+    const prepareMagpieInstallation = vi.fn(async () => {});
+    const runtime = createRuntime({ env: UNCONFIGURED_ENV, sharedService, adoptOpenCodeServerPassword, prepareMagpieInstallation }, stateRef);
     const fetchMock = stubSharedFetch();
 
     await runtime.bootstrapOpenCodeAtStartup();
 
     expect(spawnMock).not.toHaveBeenCalled();
     expect(sharedService.start).toHaveBeenCalledTimes(1);
+    expect(prepareMagpieInstallation.mock.invocationCallOrder[0]).toBeLessThan(sharedService.start.mock.invocationCallOrder[0]);
     const startInput = sharedService.start.mock.calls[0][0];
     expect(startInput.binary).toBe('/mock/opencode');
     expect(startInput.env.OPENCODE_SERVER_PASSWORD).toBeUndefined();