@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-U32HWI76.js

@@ -0,0 +1,437 @@
+import {
+  hasPositiveBedrockCredentialSignals
+} from "./chunk-5HDP7XZG.js";
+import {
+  metadata
+} from "./chunk-LGHII5ET.js";
+import {
+  BaseProviderAuth
+} from "./chunk-4VJITV4P.js";
+import {
+  lookupFreshAuthFailure
+} from "./chunk-R6W23LKN.js";
+import {
+  resolveProviderCliCommand
+} from "./chunk-SURZ2WFE.js";
+import {
+  wrapWithSandbox
+} from "./chunk-2AICM4P3.js";
+import {
+  resolveClaudeBackend
+} from "./chunk-5WRLK5KW.js";
+import {
+  isDebugMode
+} from "./chunk-EJGCZGUF.js";
+import {
+  __export
+} from "./chunk-PZ5AY32C.js";
+
+// src/core/providers/claude/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearAuth: () => clearAuth,
+  ensureAuth: () => ensureAuth,
+  getClaudeAuthPaths: () => getClaudeAuthPaths,
+  getCredentialsPath: () => getCredentialsPath,
+  isAuthenticated: () => isAuthenticated,
+  isAuthenticatedTriState: () => isAuthenticatedTriState,
+  nextAuthMenuAction: () => nextAuthMenuAction,
+  resolveClaudeConfigDir: () => resolveClaudeConfigDir
+});
+import { readFile, stat } from "fs/promises";
+import { homedir } from "os";
+import * as path from "path";
+import { execa } from "execa";
+var ClaudeAuth = class extends BaseProviderAuth {
+  metadata = metadata;
+  defaultConfigSubdir = "claude";
+  configDirEnvVar = "CLAUDE_CONFIG_DIR";
+  /**
+   * Resolve configured Claude CLI invocation (supports compound commands like `npx pkg@ver`).
+   */
+  resolveClaudeCliInvocation() {
+    const resolved = resolveProviderCliCommand("claude");
+    return {
+      command: resolved.command,
+      prefixArgs: resolved.prefixArgs,
+      displayCommand: [resolved.command, ...resolved.prefixArgs].join(" ")
+    };
+  }
+  /**
+   * Environment variables for Claude credentials
+   */
+  getCredentialEnvVars() {
+    return ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+  }
+  /**
+   * Resolves the Claude config directory (shared for authentication)
+   * Profile is only used for agent-specific data, not authentication
+   */
+  resolveConfigDir(options) {
+    if (options?.claudeConfigDir !== void 0) {
+      return super.resolveConfigDir({
+        ...options,
+        configDir: options.claudeConfigDir
+      });
+    }
+    return super.resolveConfigDir(options);
+  }
+  /**
+   * Convert ClaudeAuthOptions to base options with CLI credentials
+   */
+  toBaseOptions(options) {
+    if (!options) return {};
+    const cliOverride = options.apiKey ?? options.oauthToken;
+    return {
+      ...options,
+      cliCredentials: cliOverride ? {
+        apiKey: cliOverride,
+        token: cliOverride
+        // Support both names
+      } : options.cliCredentials
+    };
+  }
+  getAuthFilePath(configDir) {
+    return path.join(configDir, ".claude.json");
+  }
+  getAuthPaths(configDir) {
+    return [
+      this.getAuthFilePath(configDir),
+      // .claude.json (primary)
+      path.join(configDir, ".credentials.json"),
+      // legacy
+      path.join(configDir, ".claude.json.backup")
+    ];
+  }
+  /**
+   * Claude CLI commonly stores credentials outside Poetic's XDG config dir.
+   * Check the standard Claude locations before reporting the provider as unauthenticated.
+   */
+  getStandardClaudeAuthPaths() {
+    const homeDir = homedir();
+    return [
+      path.join(homeDir, ".claude.json"),
+      path.join(homeDir, ".claude", ".claude.json"),
+      path.join(homeDir, ".claude", ".credentials.json"),
+      path.join(homeDir, ".claude", "credentials.json")
+    ];
+  }
+  async standardAuthPathHasCredentials(authPath) {
+    const fileStat = await stat(authPath);
+    if (path.basename(authPath) !== ".claude.json") {
+      return fileStat.size > 10;
+    }
+    if (typeof fileStat.size !== "number" || fileStat.size === 0) {
+      return false;
+    }
+    const raw = await readFile(authPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return Boolean(
+      parsed.oauthAccount || parsed.claudeAiOauth || parsed.claudeAiOauthToken || parsed.apiKey || parsed.primaryApiKey
+    );
+  }
+  /**
+   * Positive local (Anthropic CLI) credential signals only.
+   * Does not consult cloud backends — those are handled by tri-state readiness.
+   */
+  async hasLocalClaudeCredentials(options) {
+    const baseOptions = this.toBaseOptions(options);
+    const credentialResolution = this.resolveCredentials(baseOptions);
+    if (credentialResolution.source === "cli" || credentialResolution.source === "env") {
+      return true;
+    }
+    const configDir = this.resolveConfigDir(baseOptions);
+    for (const authPath of this.getAuthPaths(configDir)) {
+      try {
+        if (await this.standardAuthPathHasCredentials(authPath)) {
+          await this.verifyFilePermissions(authPath);
+          return true;
+        }
+      } catch {
+      }
+    }
+    if (options?.configDir !== void 0 || options?.claudeConfigDir !== void 0) {
+      return false;
+    }
+    for (const authPath of this.getStandardClaudeAuthPaths()) {
+      try {
+        if (await this.standardAuthPathHasCredentials(authPath)) {
+          if (isDebugMode()) {
+            console.log(`[Claude Auth] Found valid auth at standard location: ${authPath}`);
+          }
+          return true;
+        }
+      } catch {
+      }
+    }
+    return false;
+  }
+  /**
+   * True when `filePath` exists as a regular file with nonzero size.
+   * Used for passive ADC / web-identity token validation (no network).
+   */
+  async pathIsNonemptyFile(filePath) {
+    try {
+      const fileStat = await stat(filePath);
+      return fileStat.isFile() && fileStat.size > 0;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Fail-closed positive-signal checks for Vertex credential chains.
+   *
+   * Project/region env vars are config-only (needed for routing, not proof of
+   * credentials) and must not flip readiness to `yes`. `yes` requires a
+   * concrete ADC key file that exists and is nonempty.
+   */
+  async hasPositiveVertexCredentialSignals(env = process.env) {
+    const adcPath = env.GOOGLE_APPLICATION_CREDENTIALS?.trim();
+    if (adcPath && await this.pathIsNonemptyFile(adcPath)) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Honest passive readiness: yes only with positive usable credential signals.
+   * Cloud backends without proven credential signals are `unknown`, never `yes`.
+   * Config-only cloud markers (profile name without keys, Vertex project+region)
+   * stay `unknown`.
+   */
+  async isAuthenticatedTriState(options) {
+    const claudeOptions = options;
+    if (await this.hasLocalClaudeCredentials(claudeOptions)) {
+      return "yes";
+    }
+    const env = this.resolveAuthEnv(options);
+    const backend = resolveClaudeBackend(env);
+    if (backend === "bedrock") {
+      return await hasPositiveBedrockCredentialSignals(env) ? "yes" : "unknown";
+    }
+    if (backend === "vertex") {
+      return await this.hasPositiveVertexCredentialSignals(env) ? "yes" : "unknown";
+    }
+    if (await lookupFreshAuthFailure("claude", { env })) {
+      return "no";
+    }
+    return "unknown";
+  }
+  /**
+   * Check if Claude is authenticated.
+   *
+   * **Intentional Design:** Uses multi-source credential resolution with priority:
+   * 1. CLI args (--api-key)
+   * 2. Config file (.claude.json)
+   * 3. Environment variables (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY)
+   * 4. Positive Bedrock/Vertex backend credential signals (not backend alone)
+   *
+   * - CLI presence IS verified via `runClaudePreflight()` (runs `claude --version`)
+   * - Auth state (token validity) is checked by CLI at execution time
+   * - This prevents blocking/hanging in headless CI environments
+   * - Auth failures surface with actionable stderr messages from the CLI
+   * - Unknown cloud backends are NOT treated as authenticated
+   *
+   * @returns true only when tri-state readiness is `'yes'`
+   */
+  async isAuthenticated(options) {
+    return await this.isAuthenticatedTriState(options) === "yes";
+  }
+  /**
+   * Check CLI availability using resolved provider command instead of hardcoded binary.
+   */
+  async checkCliInstalled() {
+    const { command, prefixArgs, displayCommand } = this.resolveClaudeCliInvocation();
+    try {
+      const result = await execa(command, [...prefixArgs, "--version"], {
+        timeout: 3e3,
+        reject: false
+      });
+      if (typeof result.exitCode === "number" && result.exitCode === 0) {
+        return;
+      }
+    } catch (error) {
+      this.handleCliError(error);
+    }
+    this.showCliNotInstalledError(
+      `Resolved command: ${displayCommand}
+If this is incorrect, update providers.yaml or POETIC_CLAUDE_CLI_COMMAND.`
+    );
+    throw new Error(`${this.metadata.name} CLI is not installed.`);
+  }
+  /**
+   * Run Claude-specific authentication
+   * In headless mode (no TTY), fails fast with instructions instead of blocking
+   */
+  async runAuthCommand(configDir) {
+    const { command, prefixArgs, displayCommand } = this.resolveClaudeCliInvocation();
+    const backend = resolveClaudeBackend(process.env);
+    if (backend === "bedrock" || backend === "vertex") {
+      throw new Error(
+        `Interactive Claude authentication is unavailable for the ${backend} backend. Configure cloud credentials instead.`
+      );
+    }
+    const isHeadless = !process.stdin.isTTY || !process.stdout.isTTY;
+    if (isHeadless) {
+      this.showAuthSetupInstructions();
+      throw new Error(
+        `Claude authentication required but running in headless mode. Set CLAUDE_CODE_OAUTH_TOKEN environment variable or run "${displayCommand} auth login" interactively first.`
+      );
+    }
+    console.log("\nRunning Claude authentication...\n");
+    console.log(`Config directory: ${configDir}
+`);
+    try {
+      const sandboxed = wrapWithSandbox({
+        workingDir: configDir,
+        command,
+        args: [...prefixArgs, "setup-token"],
+        providerName: metadata.name,
+        env: { ...process.env, CLAUDE_CONFIG_DIR: configDir }
+      });
+      await execa(sandboxed.command, sandboxed.args, {
+        cwd: configDir,
+        env: { ...process.env, CLAUDE_CONFIG_DIR: configDir },
+        stdio: "inherit",
+        timeout: 5 * 60 * 1e3
+      });
+    } catch (error) {
+      this.handleCliError(error);
+      throw error;
+    }
+  }
+  /**
+   * Shows Claude-specific authentication setup instructions
+   */
+  showAuthSetupInstructions() {
+    const { displayCommand } = this.resolveClaudeCliInvocation();
+    const backend = resolveClaudeBackend(process.env);
+    console.error("");
+    console.error("  Warning: Claude authentication required");
+    console.error(`  Run: ${this.metadata.setupCommand}`);
+    console.error("\nTo use Claude, you need to set up authentication first.");
+    console.error("\nQuick Setup:");
+    console.error("  1. Install Claude CLI:");
+    console.error("     npm install -g @anthropic-ai/claude-code");
+    if (backend === "bedrock") {
+      console.error("\n  2. Configure Bedrock-backed Claude execution:");
+      console.error("     export POETIC_CLAUDE_BACKEND=bedrock");
+      console.error("     export AWS_PROFILE=<your-profile>");
+      console.error("     # or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY");
+      console.error("\n  3. Verify AWS credentials and Claude CLI availability:");
+      console.error("     aws sts get-caller-identity");
+      console.error(`     ${displayCommand} --version`);
+      console.error("\n  4. For detailed setup instructions:");
+      console.error("     See: docs/PROVIDER_SETUP.md");
+      console.error("\n  Note: Claude interactive login is not used for Bedrock mode.");
+    } else if (backend === "vertex") {
+      console.error("\n  2. Configure Vertex-backed Claude execution:");
+      console.error("     export POETIC_CLAUDE_BACKEND=vertex");
+      console.error("     export CLOUD_ML_REGION=<your-region>");
+      console.error("     export ANTHROPIC_VERTEX_PROJECT_ID=<your-project-id>");
+      console.error("     Option A: Authenticate with ADC (recommended)");
+      console.error("       gcloud auth application-default login");
+      console.error("     Option B: Use a service account key");
+      console.error("       export GOOGLE_APPLICATION_CREDENTIALS=<path-to-service-account.json>");
+      console.error("\n  3. Verify Google Cloud credentials and Claude CLI availability:");
+      console.error("     gcloud auth application-default print-access-token");
+      console.error(`     ${displayCommand} --version`);
+      console.error("\n  4. For detailed setup instructions:");
+      console.error("     See: docs/PROVIDER_SETUP.md");
+      console.error("\n  Note: Claude /login and /logout are disabled in Vertex mode.");
+    } else {
+      console.error("\n  2. Authenticate:");
+      console.error("     Option A: Set environment variable (recommended)");
+      console.error("       export CLAUDE_CODE_OAUTH_TOKEN=<your-token>");
+      console.error("     Option B: Use CLI authentication");
+      console.error(`       Run ${displayCommand} and complete the /login flow`);
+      console.error(
+        "\n  3. Verify authentication by running a simple Claude command (for example):"
+      );
+      console.error(`     ${displayCommand} --version`);
+      console.error("\n  4. For detailed setup instructions:");
+      console.error("     See: docs/PROVIDER_SETUP.md");
+    }
+    console.error("");
+  }
+  /**
+   * Resolve the env used for backend/readiness decisions: `process.env` with
+   * optional per-call overrides from `options.env` (options win on collisions).
+   */
+  resolveAuthEnv(options) {
+    if (options && typeof options === "object" && "env" in options && options.env) {
+      return { ...process.env, ...options.env };
+    }
+    return process.env;
+  }
+  /**
+   * Ensures Claude authentication is ready.
+   *
+   * **Intentional Design:** Uses multi-source credential resolution.
+   * Priority: CLI args > config file > environment variables
+   *
+   * - CLI availability is verified separately via `runClaudePreflight()`
+   * - Auth errors surface at execution time with stderr instructions
+   * - Users can provide credentials via --api-key, config file, or env vars
+   * - Cloud backends (Bedrock/Vertex) cannot use interactive Claude login; when
+   *   passive readiness is unknown we still skip interactive auth and let the
+   *   CLI surface credential-chain failures at execution time
+   * - Backend is resolved from `process.env` merged with `options.env` so
+   *   execute-tier env overrides (Bedrock/Vertex) match readiness
+   *
+   * @returns true if credentials available from any source (or cloud backend
+   *   that cannot be interactively provisioned here)
+   */
+  async ensureAuth(options) {
+    const env = this.resolveAuthEnv(options);
+    const backend = resolveClaudeBackend(env);
+    if (backend === "bedrock" || backend === "vertex") {
+      return true;
+    }
+    const baseOptions = this.toBaseOptions(options);
+    return super.ensureAuth(baseOptions);
+  }
+};
+var claudeAuth = new ClaudeAuth();
+function resolveClaudeConfigDir(options) {
+  return claudeAuth.resolveConfigDir(options);
+}
+function getCredentialsPath(configDir) {
+  return path.join(configDir, ".claude.json");
+}
+function getClaudeAuthPaths(configDir) {
+  return [
+    path.join(configDir, ".claude.json"),
+    // primary
+    path.join(configDir, ".credentials.json"),
+    // legacy
+    path.join(configDir, ".claude.json.backup")
+  ];
+}
+async function isAuthenticated(options) {
+  return claudeAuth.isAuthenticated(options);
+}
+async function isAuthenticatedTriState(options) {
+  return claudeAuth.isAuthenticatedTriState(options);
+}
+async function ensureAuth(options) {
+  return claudeAuth.ensureAuth(options);
+}
+async function clearAuth(options) {
+  return claudeAuth.clearAuth(options);
+}
+async function nextAuthMenuAction(options) {
+  return claudeAuth.nextAuthMenuAction(options);
+}
+
+export {
+  resolveClaudeConfigDir,
+  getCredentialsPath,
+  getClaudeAuthPaths,
+  isAuthenticated,
+  isAuthenticatedTriState,
+  ensureAuth,
+  clearAuth,
+  nextAuthMenuAction,
+  auth_exports
+};
+//# sourceMappingURL=chunk-U32HWI76.js.map