@ozyman42/ozy-cli 0.4.9-windows-x64.0 → 0.4.9

package/src/commands/ssh/get-sk-credential.ts

@@ -0,0 +1,110 @@
+import { Effect } from "effect";
+import { makeCommand } from "@/common/command";
+import * as path from 'path';
+import * as fs from 'fs';
+import { log } from "@/common/log";
+import { selectFromList } from "@ozyman42/interactive-cli-select";
+import type { EffectGen } from "effective-modules";
+
+const OPENSSH_MAGIC = Buffer.from('openssh-key-v1\0', 'utf8');
+
+function isSkPublicKey(pubKeyPath: string): boolean {
+  try {
+    const keyType = fs.readFileSync(pubKeyPath, 'utf8').trim().split(/\s+/)[0] ?? '';
+    return keyType.startsWith('sk-');
+  } catch {
+    return false;
+  }
+}
+
+function parseCredentialId(privateKeyPath: string): string {
+  const base64 = fs.readFileSync(privateKeyPath, 'utf8')
+    .split('\n')
+    .filter(line => !line.startsWith('-----'))
+    .join('');
+  const buf = Buffer.from(base64, 'base64');
+
+  if (!buf.subarray(0, OPENSSH_MAGIC.length).equals(OPENSSH_MAGIC)) {
+    throw new Error('Not an OpenSSH private key file.');
+  }
+
+  let off = OPENSSH_MAGIC.length;
+
+  function readString(): Buffer {
+    if (off + 4 > buf.length) throw new Error('Unexpected end of buffer.');
+    const len = buf.readUInt32BE(off); off += 4;
+    if (off + len > buf.length) throw new Error('Buffer underflow.');
+    const chunk = buf.subarray(off, off + len); off += len;
+    return chunk;
+  }
+
+  function readUint32(): number {
+    if (off + 4 > buf.length) throw new Error('Unexpected end of buffer.');
+    const val = buf.readUInt32BE(off); off += 4;
+    return val;
+  }
+
+  const cipherName = readString().toString('utf8');
+  if (cipherName !== 'none') throw new Error('Encrypted private keys are not supported.');
+  readString(); // kdf name
+  readString(); // kdf options
+
+  if (readUint32() !== 1) throw new Error('Expected exactly 1 key.');
+  readString(); // public key blob
+
+  const pb = readString(); // private key block
+  let p = 0;
+
+  function pbString(): Buffer {
+    if (p + 4 > pb.length) throw new Error('Unexpected end of private block.');
+    const len = pb.readUInt32BE(p); p += 4;
+    if (p + len > pb.length) throw new Error('Private block underflow.');
+    const chunk = pb.subarray(p, p + len); p += len;
+    return chunk;
+  }
+
+  const check1 = pb.readUInt32BE(p); p += 4;
+  const check2 = pb.readUInt32BE(p); p += 4;
+  if (check1 !== check2) throw new Error('Private key integrity check failed — key may be encrypted or corrupt.');
+
+  const keyType = pbString().toString('utf8');
+  if (keyType.includes('ecdsa')) {
+    pbString(); // curve identifier
+    pbString(); // ec_point
+  } else if (keyType.includes('ed25519')) {
+    pbString(); // public key (32 bytes)
+  } else {
+    throw new Error(`Unsupported security key type: ${keyType}`);
+  }
+
+  pbString(); // application string (e.g. 'ssh:')
+  p += 1;     // flags byte
+
+  return pbString().toString('hex');
+}
+
+export const skCredential = makeCommand('sk-credential', 'get credential id of a given ssh security key pointer', () =>
+  Effect.gen(function* (): EffectGen<void, never> {
+    // Effect v3 → v4 shim: Effect.async was renamed to Effect.callback
+    (Effect as any).async = (Effect as any).callback;
+
+    const cwd = process.cwd();
+    const skKeys = fs.readdirSync(cwd).filter(name =>
+      !name.endsWith('.pub') && isSkPublicKey(path.join(cwd, `${name}.pub`))
+    );
+
+    if (skKeys.length === 0) {
+      log('No SSH security keys found.');
+      return;
+    }
+
+    const choice = yield* selectFromList({
+      options: skKeys,
+      getKey: o => o,
+      renderOption: o => o,
+    }).pipe(Effect.orDie);
+
+    const credentialId = parseCredentialId(path.join(cwd, choice));
+    log(`Credential ID: ${credentialId}`);
+  })
+);

package/src/commands/ssh/index.ts

@@ -0,0 +1,8 @@
+import { Command } from 'commander';
+import { skCredential } from './get-sk-credential';
+
+export const ssh = new Command('ssh')
+  .summary('ssh related utility commands');
+
+[skCredential]
+  .forEach(cmd => { ssh.addCommand(cmd) });

package/src/commands/upgrade.ts

@@ -0,0 +1,261 @@
+import { existsSync, readFileSync } from "node:fs";
+import * as path from "node:path";
+import { Effect, Option } from "effect";
+import { makeCommand } from "@/common/command";
+import { CLI_CMD_NAME, CLI_CMD_PATH, PACKAGE_NAME } from "@/common/constants";
+
+type PackageManager = "bun" | "pnpm" | "npm" | "yarn";
+type InstallScope = "global" | "local";
+
+interface InstallInfo {
+  pm: PackageManager;
+  scope: InstallScope;
+  cwd?: string;
+}
+
+const PACKAGE_NODE_MODULES_SEGMENT = `/node_modules/${PACKAGE_NAME}/`;
+const LOCAL_BIN_SEGMENT = "/node_modules/.bin/";
+
+/*
+ * Directory shapes this detector understands.
+ *
+ * Local installs:
+ *   project/
+ *     node_modules/
+ *       .bin/
+ *         ozy -> ../@ozyman42/ozy-cli/bin/ozy       # POSIX link or shell shim
+ *         ozy.cmd / ozy.ps1 / ozy.exe              # Windows manager-specific shim
+ *       @ozyman42/
+ *         ozy-cli/
+ *           bin/
+ *             ozy                                  # CLI_CMD_PATH after repair
+ *
+ * Bun global:
+ *   ~/.bun/bin/ozy -> ~/.bun/install/global/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *
+ * pnpm global:
+ *   ~/Library/pnpm/ozy -> ~/.local/share/pnpm/global/<slot>/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *   ~/.pnpm-global/.../node_modules/@ozyman42/ozy-cli/bin/ozy
+ *
+ * npm global:
+ *   ~/.nvm/versions/node/vX.Y.Z/bin/ozy -> ~/.nvm/versions/node/vX.Y.Z/lib/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *   /usr/local/bin/ozy -> /usr/local/lib/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *   %APPDATA%/npm/ozy.cmd -> %APPDATA%/npm/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *
+ * Yarn Classic global:
+ *   ~/.yarn/bin/ozy -> ~/.config/yarn/global/node_modules/@ozyman42/ozy-cli/bin/ozy
+ *   %LOCALAPPDATA%/Yarn/bin/ozy.cmd -> %LOCALAPPDATA%/Yarn/Data/global/node_modules/@ozyman42/ozy-cli/bin/ozy
+ */
+
+function normalizePath(filePath: string): string {
+  return filePath.replace(/\\/g, "/");
+}
+
+function parentDirectory(dir: string): string {
+  return normalizePath(path.dirname(dir));
+}
+
+function hasProjectMarkers(dir: string): boolean {
+  return (
+    existsSync(path.join(dir, "package.json")) ||
+    existsSync(path.join(dir, "bun.lock")) ||
+    existsSync(path.join(dir, "bun.lockb")) ||
+    existsSync(path.join(dir, "pnpm-lock.yaml")) ||
+    existsSync(path.join(dir, "yarn.lock")) ||
+    existsSync(path.join(dir, "package-lock.json"))
+  );
+}
+
+function packageManagerName(value: unknown): Option.Option<PackageManager> {
+  if (typeof value !== "string") return Option.none();
+  if (value.startsWith("bun@") || value === "bun") return Option.some("bun");
+  if (value.startsWith("pnpm@") || value === "pnpm") return Option.some("pnpm");
+  if (value.startsWith("yarn@") || value === "yarn") return Option.some("yarn");
+  if (value.startsWith("npm@") || value === "npm") return Option.some("npm");
+  return Option.none();
+}
+
+function packageManagerFromPackageJson(dir: string): Option.Option<PackageManager> {
+  const packageJsonPath = path.join(dir, "package.json");
+  if (!existsSync(packageJsonPath)) return Option.none();
+  try {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    const packageManager = packageManagerName(packageJson.packageManager);
+    if (Option.isSome(packageManager)) return packageManager;
+
+    const devEnginePackageManager = packageJson.devEngines?.packageManager;
+    if (Array.isArray(devEnginePackageManager)) {
+      for (const entry of devEnginePackageManager) {
+        const pm = packageManagerName(entry?.name);
+        if (Option.isSome(pm)) return pm;
+      }
+    }
+
+    return packageManagerName(devEnginePackageManager?.name);
+  } catch {
+    return Option.none();
+  }
+}
+
+function findProjectPackageManager(dir: string): Option.Option<PackageManager> {
+  let current = dir;
+  while (true) {
+    const packageManager = packageManagerFromPackageJson(current);
+    if (Option.isSome(packageManager)) return packageManager;
+    if (existsSync(path.join(current, "bun.lock")) || existsSync(path.join(current, "bun.lockb"))) return Option.some("bun");
+    if (existsSync(path.join(current, "pnpm-lock.yaml"))) return Option.some("pnpm");
+    if (existsSync(path.join(current, "yarn.lock"))) return Option.some("yarn");
+    if (existsSync(path.join(current, "package-lock.json"))) return Option.some("npm");
+    const parent = parentDirectory(current);
+    if (parent === current) return Option.none();
+    current = parent;
+  }
+}
+
+function detectGlobalInstall(normalizedPath: string): Option.Option<InstallInfo> {
+  const lowerPath = normalizedPath.toLowerCase();
+
+  if (lowerPath.includes("/.bun/bin/") || lowerPath.includes("/.bun/install/global/node_modules/"))
+    return Option.some({ pm: "bun", scope: "global" });
+
+  if (
+    lowerPath.includes("/.pnpm-global/") ||
+    lowerPath.includes("/pnpm/global/") ||
+    lowerPath.includes("/library/pnpm/") ||
+    lowerPath.includes("/appdata/local/pnpm/")
+  )
+    return Option.some({ pm: "pnpm", scope: "global" });
+
+  if (
+    lowerPath.includes("/.yarn/bin/") ||
+    lowerPath.includes("/appdata/local/yarn/bin/") ||
+    lowerPath.includes("/.config/yarn/global/node_modules/") ||
+    (lowerPath.includes("/appdata/local/yarn/") && lowerPath.includes("/global/node_modules/"))
+  )
+    return Option.some({ pm: "yarn", scope: "global" });
+
+  if (
+    lowerPath.includes("/.nvm/versions/node/") ||
+    lowerPath.includes("/.nodenv/versions/") ||
+    // asdf is a multi-runtime version manager; default data lives under ~/.asdf.
+    // https://asdf-vm.com/guide/getting-started.html
+    lowerPath.includes("/.asdf/installs/nodejs/") ||
+    lowerPath.includes("/appdata/roaming/npm/") ||
+    lowerPath.includes("/program files/nodejs/node_modules/") ||
+    lowerPath.startsWith("/usr/local/bin/") ||
+    lowerPath.startsWith("/opt/homebrew/bin/") ||
+    lowerPath.startsWith("/usr/local/lib/node_modules/") ||
+    lowerPath.startsWith("/opt/homebrew/lib/node_modules/") ||
+    lowerPath.startsWith("/usr/lib/node_modules/")
+  )
+    return Option.some({ pm: "npm", scope: "global" });
+
+  return Option.none();
+}
+
+function localInstallInfo(projectRoot: string): Option.Option<InstallInfo> {
+  if (!hasProjectMarkers(projectRoot)) return Option.none();
+  const pm = Option.getOrElse(findProjectPackageManager(projectRoot), () => "npm" as PackageManager);
+  return Option.some({ pm, scope: "local", cwd: projectRoot });
+}
+
+function detectLocalInstall(normalizedPath: string): Option.Option<InstallInfo> {
+  const lowerPath = normalizedPath.toLowerCase();
+
+  const localBinIndex = lowerPath.indexOf(LOCAL_BIN_SEGMENT);
+  if (localBinIndex >= 0) {
+    return localInstallInfo(normalizedPath.slice(0, localBinIndex));
+  }
+
+  const packageIndex = lowerPath.indexOf(PACKAGE_NODE_MODULES_SEGMENT);
+  if (packageIndex >= 0) {
+    return localInstallInfo(normalizedPath.slice(0, packageIndex));
+  }
+
+  return Option.none();
+}
+
+function detectInstall(binaryPath: string): Option.Option<InstallInfo> {
+  const normalizedPath = normalizePath(binaryPath);
+  const globalInstall = detectGlobalInstall(normalizedPath);
+  if (Option.isSome(globalInstall)) return globalInstall;
+  return detectLocalInstall(normalizedPath);
+}
+
+function buildUpgradeCommand(info: InstallInfo): string[] {
+  const pkg = `${PACKAGE_NAME}@latest`;
+  if (info.scope === "global") {
+    if (info.pm === "bun") return ["bun", "add", "--no-cache", "-g", pkg];
+    if (info.pm === "pnpm") return ["pnpm", "add", "-g", pkg];
+    if (info.pm === "yarn") return ["yarn", "global", "add", pkg];
+    return ["npm", "install", "-g", pkg];
+  }
+  if (info.pm === "bun") return ["bun", "add", "--no-cache", pkg];
+  if (info.pm === "pnpm") return ["pnpm", "add", pkg];
+  if (info.pm === "yarn") return ["yarn", "add", pkg];
+  return ["npm", "install", pkg];
+}
+
+function quotePowerShellString(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function renderWindowsUpdaterCommand(cmd: string[], cwd: string, parentPid: number): string {
+  const command = cmd.map(quotePowerShellString).join(", ");
+  const commandDisplay = cmd.join(" ");
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    "Write-Host 'Waiting for the current process to exit before upgrading...'",
+    `while (Get-Process -Id ${parentPid} -ErrorAction SilentlyContinue) { Start-Sleep -Milliseconds 250 }`,
+    `Set-Location -LiteralPath ${quotePowerShellString(cwd)}`,
+    `Write-Host ${quotePowerShellString(`Running: ${commandDisplay}`)}`,
+    `$command = @(${command})`,
+    "$executable = $command[0]",
+    "$arguments = if ($command.Length -gt 1) { $command[1..($command.Length - 1)] } else { @() }",
+    "& $executable @arguments",
+    "exit $LASTEXITCODE",
+  ].join("; ");
+}
+
+function spawnWindowsUpdater(cmd: string[], cwd: string): void {
+  const updater = ["powershell.exe", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", renderWindowsUpdaterCommand(cmd, cwd, process.pid)];
+  console.log("Spawning windows updater...");
+  const proc = Bun.spawn(updater, {
+    cwd,
+    stdin: "ignore",
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  proc.unref();
+}
+
+export const upgrade = makeCommand("upgrade", `upgrade ${CLI_CMD_NAME} to the latest version`, () =>
+  Effect.gen(function* () {
+    const binaryPath = CLI_CMD_PATH;
+    const infoOption = detectInstall(binaryPath);
+    if (Option.isNone(infoOption))
+      return yield* Effect.fail(`unknown-install: could not detect package manager from binary path: ${binaryPath}\nUpgrade manually with your package manager.`);
+    const info = infoOption.value;
+
+    const cmd = buildUpgradeCommand(info);
+    console.log(`Detected that ${PACKAGE_NAME} was installed ${info.scope}ly using ${info.pm}.`);
+    console.log(`Running: ${cmd.join(" ")}`);
+
+    // Windows locks the running package-owned .exe, so asking the package manager to replace
+    // this package in-process can fail with EBUSY. A helper process waits for this process to
+    // exit, then runs the same install command outside the executable tree being replaced.
+    if (process.platform === "win32") {
+      spawnWindowsUpdater(cmd, info.cwd ?? process.cwd());
+      return;
+    }
+
+    const proc = Bun.spawn(cmd, {
+      cwd: info.cwd ?? process.cwd(),
+      stdout: "inherit",
+      stderr: "inherit",
+    });
+    const code = yield* Effect.promise(() => proc.exited);
+    if (code !== 0)
+      yield* Effect.fail(`install-failed: ${cmd[0]} exited with code ${code}`);
+  })
+);

package/src/common/command.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+import { Effect, Result } from 'effect';
+import { log } from './log';
+
+export function makeCommand(name: string, description: string,
+  action: () => Effect.Effect<void, string>): Command {
+  return new Command(name)
+    .description(description)
+    .action(async () => {
+      const result = await Effect.runPromise(action().pipe(Effect.result));
+      if (Result.isFailure(result)) {
+        log(`✗ ${result.failure}`);
+      }
+      process.exit();
+    });
+}

package/src/common/constants.ts

@@ -0,0 +1,26 @@
+import * as path from "node:path";
+import { version, name } from "../../package.json";
+
+export const PACKAGE_NAME = name;
+export const FUTURE_TOOL_NAME = "jive";
+const CLI_DIR = path.dirname(process.execPath);
+const commandPath = (commandName: string) =>
+  path.resolve(CLI_DIR, process.platform === "win32" ? `${commandName}.exe` : commandName);
+export const CLI_CMD_NAME = "ozy";
+export const AGENT_CMD_NAME = "ozy-signing-agent";
+export const AGENT_CMD_PATH = commandPath(AGENT_CMD_NAME);
+export const CLI_CMD_PATH = commandPath(CLI_CMD_NAME);
+export const AGENT_SOCK_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.sock`);
+export const AGENT_LOG_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.log`);
+export const AGENT_PID_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.pid`);
+export const AGENT_PORT_FILE_PATH = path.resolve(CLI_DIR, `${AGENT_CMD_NAME}.port`);
+export const CRED_ID_COMMENT_PREFIX = 'credentialId:';
+export const CURRENT_VERSION = version;
+export const VIRTUAL_KEY_CMD_NAME = "ozy-virtual-security-key";
+export const SSH_KEYGEN_CMD_NAME = "ozy-ssh-keygen";
+export const SSH_KEYGEN_CMD_PATH = commandPath(SSH_KEYGEN_CMD_NAME);
+export const VIRTUAL_KEY_LOG_FILE_PATH = path.resolve(CLI_DIR, `${VIRTUAL_KEY_CMD_NAME}.log`);
+export const DEFAULT_SESSION_TIMEOUT_SECONDS = 120;
+export const STANDARD_REMOTE_USER = "git";
+export const STANDARD_REMOTE_HOST = "github.com";
+export const STANDARD_REMOTE_PREFIX = `${STANDARD_REMOTE_USER}@${STANDARD_REMOTE_HOST}:`;

package/src/common/effective-modules-extensions.ts

@@ -0,0 +1,24 @@
+import { type EffectGen } from "effective-modules";
+import { type Context, Effect } from "effect";
+
+type MethodsRequireSelf<S extends Context.Service<any, any>> = {
+  [k in keyof S["Service"]]: 
+    S["Service"][k] extends Function ?
+      ReturnType<S["Service"][k]> extends EffectGen<infer A, infer E, infer R> ?
+        (...args: Parameters<S["Service"][k]>) => Effect.Effect<A, E, R | S["Identifier"]>
+        : ReturnType<S["Service"][k]> extends Effect.Effect<infer A, infer E, infer R> ?
+          (...args: Parameters<S["Service"][k]>) => Effect.Effect<A, E, R | S["Identifier"]>
+          : never
+      : never;
+}
+
+export function using<S extends Context.Service<any, any>>(service: S): MethodsRequireSelf<S> {
+  return new Proxy({}, {
+    get(_target, prop, _receiver) {
+      return Effect.fn(function*(...args: any[]) {
+        const instance = yield* service;
+        return yield* instance[prop](...args);
+      })
+    }
+  }) as any;
+}

package/src/common/log.ts

@@ -0,0 +1,3 @@
+export function log(...stuff: any[]) {
+  console.log(...stuff);
+}

package/src/common/render-caller-tree.ts

@@ -0,0 +1,22 @@
+import type { CallerProcess } from "@/modules/common/os-platform/interface";
+import { Option } from "effect";
+
+const CYAN = '\x1b[36m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+
+function fmtNode(node: CallerProcess): string {
+  const dir = Option.getOrElse(() => '?')(node.directory);
+  return `${CYAN}${node.command}${RESET}  ${DIM}${dir}${RESET}`;
+}
+
+export function renderCallerTree(chain: CallerProcess[]): string {
+  if (chain.length === 0) return '(empty)';
+  const lines: string[] = [fmtNode(chain[0]!)];
+  let indent = '';
+  for (let i = 1; i < chain.length; i++) {
+    lines.push(`${indent}└── ${fmtNode(chain[i]!)}`);
+    indent += '    ';
+  }
+  return lines.join('\n');
+}

package/src/entrypoints/ozy-signing-agent.ts

@@ -0,0 +1,48 @@
+import { appendFileSync } from "node:fs";
+import { Effect, Layer, pipe } from "effect";
+import { OSPlatformImpl } from "@/modules/common/os-platform/impl";
+import { CryptoImpl } from "@/modules/common/crypto/impl";
+import { KeyMapStoreImpl } from "@/modules/common/kep-map-store/impl";
+import { SSHConfigImpl } from "@/modules/common/ssh-config/impl";
+import { SSHAgentImpl } from "@/modules/ssh-agent/ssh-agent/impl";
+import { SessionImpl } from "@/modules/ssh-agent/session/impl";
+import { AGENT_LOG_FILE_PATH, AGENT_PID_FILE_PATH, AGENT_PORT_FILE_PATH, AGENT_SOCK_FILE_PATH } from "@/common/constants";
+import { rmSync } from "node:fs";
+
+const origLog = console.log.bind(console);
+const origError = console.error.bind(console);
+const origWarn = console.warn.bind(console);
+
+function logToFile(...args: any[]) {
+  try { 
+    appendFileSync(AGENT_LOG_FILE_PATH, args.map(arg => {
+      try { return JSON.stringify(arg) }
+      catch(e) { return String(e); }
+    }).join(' ') + '\n'); 
+  } catch {}
+}
+
+console.log = (...args: any[]) => { logToFile(...args); origLog(...args); };
+console.error = (...args: any[]) => { logToFile(...args); origError(...args); };
+console.warn = (...args: any[]) => { logToFile(...args); origWarn(...args); };
+
+function cleanup() {
+  try { rmSync(AGENT_PID_FILE_PATH); } catch {}
+  try { rmSync(AGENT_PORT_FILE_PATH); } catch {}
+  try { rmSync(AGENT_SOCK_FILE_PATH); } catch {}
+}
+
+process.on("exit", cleanup);
+process.on("SIGTERM", () => { cleanup(); process.exit(0); });
+process.on("SIGINT", () => { cleanup(); process.exit(0); });
+
+pipe(
+  SSHAgentImpl.ServiceLayer,
+  Layer.provideMerge(SessionImpl.makeRpcLayer()),
+  Layer.provideMerge(KeyMapStoreImpl.Layer),
+  Layer.provideMerge(SSHConfigImpl.Layer),
+  Layer.provideMerge(CryptoImpl.Layer),
+  Layer.provideMerge(OSPlatformImpl.Layer),
+  Layer.launch,
+  Effect.runPromise
+);

package/src/entrypoints/ozy-ssh-keygen.ts

@@ -0,0 +1,10 @@
+import { AGENT_SOCK_FILE_PATH } from "@/common/constants";
+
+const result = Bun.spawnSync(["ssh-keygen", ...Bun.argv.slice(2)], {
+  stdin: "inherit",
+  stdout: "inherit",
+  stderr: "inherit",
+  env: { ...process.env, SSH_AUTH_SOCK: AGENT_SOCK_FILE_PATH },
+});
+
+process.exit(result.exitCode ?? 1);

package/src/entrypoints/ozy-virtual-security-key.ts

@@ -0,0 +1,21 @@
+import { Effect } from "effect";
+import { appendFileSync } from "node:fs";
+import { commonModules } from "@/modules/common";
+import { OSPlatformImpl } from "@/modules/common/os-platform/impl";
+import { VIRTUAL_KEY_LOG_FILE_PATH } from "@/common/constants";
+
+const program = Effect.gen(function* () {
+  const platform = yield* commonModules.OSPlatform;
+  yield* platform.registerVirtualHID((data) =>
+    Effect.sync(() => {
+      appendFileSync(VIRTUAL_KEY_LOG_FILE_PATH, `[vhid] received ${data.length} bytes: ${data.toString('hex')}\n`);
+      return Buffer.alloc(64);
+    })
+  );
+  yield* Effect.never;
+}).pipe(Effect.provide(OSPlatformImpl.Layer));
+
+Effect.runPromise(program).catch(e => {
+  console.error('Virtual security key failed:', e);
+  process.exit(1);
+});

package/src/entrypoints/ozy.ts

@@ -0,0 +1,2 @@
+// TODO: we should move commands to its own layer
+import '@/commands';

package/src/index.ts

@@ -0,0 +1 @@
+export {};

package/src/internal/thing.ts

@@ -0,0 +1,3 @@
+export function time() {
+  console.log("is with us all");
+}